Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace wildcard and match_only_text types to keyword #590

Closed
3 tasks done
Tracked by #22887
AlexRuiz7 opened this issue Dec 11, 2024 · 1 comment · Fixed by #619 or wazuh/wazuh-indexer-plugins#202
Closed
3 tasks done
Tracked by #22887

Replace wildcard and match_only_text types to keyword #590

AlexRuiz7 opened this issue Dec 11, 2024 · 1 comment · Fixed by #619 or wazuh/wazuh-indexer-plugins#202
Assignees
Labels
level/task Task issue mvp Minimum Viable Product type/enhancement Enhancement issue

Comments

@AlexRuiz7
Copy link
Member

AlexRuiz7 commented Dec 11, 2024

Description

Due to a bug in OpenSearch Dashboards not rendering supported types properly in Discover and other places of the UI, we need to change the mappings for every Wazuh index replacing wildcard and match_only_text types with keyword|text.

Related issues:

Functional requirements

  • None of the stateful indices use wildcard or match_only_text field types.
  • None of the stateless (alerts, commands) indices use wildcard or match_only_text field types.

Implementation restrictions

  • The changes must be performed by updating our generation script, so the replacements are automated.
  • Consider using text instead of keyword for better search behavior.

Plan

  • Patch the generate.sh script.
  • Regenerate the mappings.
  • Update the index templates for the setup and command-manager plugins.
@f-galland
Copy link
Member

No wildcard or match_only_text fields are present in the plugins mappings anymore:

(env) fede@tyner:~/IdeaProjects/wazuh-indexer-plugins/plugins (enhancement/590-replace-wildcard-and-match_only_text)
$ grep -ERl 'wildcard|match_only_text' setup/src/main/resources/

(env) fede@tyner:~/IdeaProjects/wazuh-indexer-plugins/plugins (enhancement/590-replace-wildcard-and-match_only_text)
$ grep -ERl 'wildcard|match_only_text' command-manager/src/main/resources/

(env) fede@tyner:~/IdeaProjects/wazuh-indexer-plugins/plugins (enhancement/590-replace-wildcard-and-match_only_text)

@wazuhci wazuhci moved this from In progress to Pending review in Release 5.0.0 Dec 23, 2024
@wazuhci wazuhci moved this from Pending review to Done in Release 5.0.0 Dec 24, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
level/task Task issue mvp Minimum Viable Product type/enhancement Enhancement issue
Projects
Status: Done
2 participants