Automate the removal of the base.tags field

wazuh · Aug 30, 2024 · 85f7a00 · 85f7a00
1 parent 3960298
commit 85f7a00
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 8 deletions.
diff --git a/ecs/agent/event-generator/event_generator.py b/ecs/agent/event-generator/event_generator.py
@@ -52,19 +52,12 @@ def generate_random_host():
     return host
 
 
-def generate_random_tags():
-    tags = [f'tag{random.randint(0, 99)}' for _ in range(random.randint(0, 5))]
-    return tags
-
-
 def generate_random_data(number):
     data = []
     for _ in range(number):
         event_data = {
             'agent': generate_random_agent(),
             'host': generate_random_host(),
-            'message': f'message{random.randint(0, 99999)}',
-            'tags': generate_random_tags()
         }
         data.append(event_data)
     return data

diff --git a/ecs/agent/fields/subset.yml b/ecs/agent/fields/subset.yml
@@ -4,7 +4,6 @@ fields:
   base:
     fields:
       tags: []
-      message: ""
   agent:
     fields:
       id: {}

diff --git a/ecs/generate.sh b/ecs/generate.sh
@@ -34,6 +34,11 @@ generate_mappings() {
   echo "Replacing \"match_only_text\" type with \"text\""
   find "$OUT_DIR" -type f -exec sed -i 's/match_only_text/text/g' {} \;
 
+  # Delete the "tags" field from the index template
+  jq 'del(.mappings.properties.tags)' "$OUT_DIR/generated/elasticsearch/legacy/template.json" >"$OUT_DIR/generated/elasticsearch/legacy/template.json.tmp"
+  rm "$OUT_DIR/generated/elasticsearch/legacy/template.json"
+  mv "$OUT_DIR/generated/elasticsearch/legacy/template.json.tmp" "$OUT_DIR/generated/elasticsearch/legacy/template.json"
+
   # Transform legacy index template for OpenSearch compatibility
   cat "$OUT_DIR/generated/elasticsearch/legacy/template.json" | jq '{
     "index_patterns": .index_patterns,