Make ecs@mappings work with OTel attributes

felixbarny · Aug 5, 2024 · 1a1a018 · 1a1a018
1 parent f2952a8
commit 1a1a018
Show file tree

Hide file tree

Showing 2 changed files with 31 additions and 6 deletions.
diff --git a/x-pack/plugin/core/template-resources/src/main/resources/[email protected] b/x-pack/plugin/core/template-resources/src/main/resources/[email protected]
@@ -31,7 +31,7 @@
               "doc_values": false
             },
             "path_match": [
-              "event.original"
+              "*event.original"
             ]
           }
         },
@@ -128,9 +128,9 @@
               "*file.path",
               "*file.target_path",
               "*os.full",
-              "email.subject",
-              "vulnerability.description",
-              "user_agent.original"
+              "*email.subject",
+              "*vulnerability.description",
+              "*user_agent.original"
             ],
             "unmatch_mapping_type": "object"
           }

diff --git a/...ugin/stack/src/javaRestTest/java/org/elasticsearch/xpack/stack/EcsDynamicTemplatesIT.java b/...ugin/stack/src/javaRestTest/java/org/elasticsearch/xpack/stack/EcsDynamicTemplatesIT.java
@@ -165,6 +165,22 @@ public void testFlattenedFields() throws IOException {
         verifyEcsMappings(indexName);
     }
 
+    public void testFlattenedFieldsWithinAttributes() throws IOException {
+        String indexName = "test-flattened-attributes";
+        createTestIndex(indexName);
+        Map<String, Object> flattenedFieldsMap = createTestDocument(true);
+        indexDocument(indexName, Map.of("attributes", flattenedFieldsMap));
+        verifyEcsMappings(indexName, "attributes.");
+    }
+
+    public void testFlattenedFieldsWithinResourceAttributes() throws IOException {
+        String indexName = "test-flattened-attributes";
+        createTestIndex(indexName);
+        Map<String, Object> flattenedFieldsMap = createTestDocument(true);
+        indexDocument(indexName, Map.of("resource.attributes", flattenedFieldsMap));
+        verifyEcsMappings(indexName, "resource.attributes.");
+    }
+
     public void testFlattenedFieldsWithoutSubobjects() throws IOException {
         String indexName = "test_flattened_fields_subobjects_false";
         createTestIndex(indexName, Map.of("subobjects", false));
@@ -394,12 +410,19 @@ private void processRawMappingsSubtree(
     }
 
     private void verifyEcsMappings(String indexName) throws IOException {
+        verifyEcsMappings(indexName, "");
+    }
+
+    private void verifyEcsMappings(String indexName, String fieldPrefix) throws IOException {
         final Map<String, Object> rawMappings = getMappings(indexName);
         final Map<String, Map<String, Object>> flatFieldMappings = new HashMap<>();
         final Map<String, Map<String, Object>> flatMultiFieldsMappings = new HashMap<>();
         processRawMappingsSubtree(rawMappings, flatFieldMappings, flatMultiFieldsMappings, "");
 
-        Map<String, Map<String, Object>> shallowFieldMapCopy = new HashMap<>(ecsFlatFieldDefinitions);
+        Map<String, Map<String, Object>> shallowFieldMapCopy = ecsFlatFieldDefinitions.entrySet()
+            .stream()
+            .collect(Collectors.toMap(e -> fieldPrefix + e.getKey(), Map.Entry::getValue));
+
         logger.info("Testing mapping of {} ECS fields", shallowFieldMapCopy.size());
         List<String> nonEcsFields = new ArrayList<>();
         Map<String, String> fieldToWrongMappingType = new HashMap<>();
@@ -421,7 +444,9 @@ private void verifyEcsMappings(String indexName) throws IOException {
             }
         });
 
-        Map<String, Map<String, Object>> shallowMultiFieldMapCopy = new HashMap<>(ecsFlatMultiFieldDefinitions);
+        Map<String, Map<String, Object>> shallowMultiFieldMapCopy = ecsFlatMultiFieldDefinitions.entrySet()
+            .stream()
+            .collect(Collectors.toMap(e -> fieldPrefix + e.getKey(), Map.Entry::getValue));
         logger.info("Testing mapping of {} ECS multi-fields", shallowMultiFieldMapCopy.size());
         flatMultiFieldsMappings.forEach((fieldName, actualMappings) -> {
             Map<String, Object> expectedMultiFieldMappings = shallowMultiFieldMapCopy.remove(fieldName);