elastic_agent - Add path_unmatch to filebeat_input metrics mappings

Explicitly specify not to match `*.histogram.*` paths. Fixes elastic/beats#35933
andrewkroh · Jul 28, 2023 · 94e2b54 · 94e2b54
1 parent 7935dee
commit 94e2b54
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 15 deletions.
diff --git a/packages/elastic_agent/data_stream/filebeat_input_metrics/fields/fields.yml b/packages/elastic_agent/data_stream/filebeat_input_metrics/fields/fields.yml
@@ -21,21 +21,6 @@
       object_type: double
       object_type_mapping_type: "*"
       description: Map all fields with `path_match:``*.histogram.*` to `double`
-    - name: '*_total'
-      type: object
-      object_type: long
-      object_type_mapping_type: "*"
-      description: Map all fields with `path_match:``*_total` to `long`
-    - name: '*_gauge'
-      type: object
-      object_type: long
-      object_type_mapping_type: "*"
-      description: Map all fields with `path_match:``*_gauge` to `long`
-    - name: '*_length'
-      type: object
-      object_type: long
-      object_type_mapping_type: "*"
-      description: Map all fields with `path_match:``*_length` to `long`
     # CEL specific fields
     - name: resource
       type: keyword

diff --git a/packages/elastic_agent/data_stream/filebeat_input_metrics/manifest.yml b/packages/elastic_agent/data_stream/filebeat_input_metrics/manifest.yml
@@ -6,3 +6,23 @@ elasticsearch:
   index_template:
     mappings:
       dynamic: true
+      # Use this instead of fields.yml so that path_unmatch can be used.
+      dynamic_templates:
+        - filebeat_input.*_gauge:
+            path_match: filebeat_input.*_gauge
+            path_unmatch: '*.histogram.*'
+            mapping:
+              type: long
+            match_mapping_type: '*'
+        - filebeat_input.*_length:
+            path_match: filebeat_input.*_length
+            path_unmatch: '*.histogram.*'
+            mapping:
+              type: long
+            match_mapping_type: '*'
+        - filebeat_input.*_total:
+            path_match: filebeat_input.*_total
+            path_unmatch: '*.histogram.*'
+            mapping:
+              type: long
+            match_mapping_type: '*'