Add back lost audit.file.path.raw field (#5943)

Somewhere in the Auditbeat module refactoring this multi-field got dropped. This was originally added in #5625.
elastic · Dec 22, 2017 · 2478bf9 · 2478bf9
1 parent e9e6bd6
commit 2478bf9
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 2 deletions.
diff --git a/auditbeat/docs/fields.asciidoc b/auditbeat/docs/fields.asciidoc
@@ -2149,10 +2149,18 @@ These are the fields generated by the file_integrity module.
 [float]
 === `audit.file.path`
 
-type: keyword
+type: text
 
 The path to the file.
 
+[float]
+=== `audit.file.path.raw`
+
+type: keyword
+
+The path to the file. This is an non-analyzed field that is useful for aggregations.
+
+
 [float]
 === `audit.file.target_path`
 

diff --git a/auditbeat/module/file_integrity/_meta/fields.yml b/auditbeat/module/file_integrity/_meta/fields.yml
@@ -9,8 +9,14 @@
       type: group
       fields:
       - name: path
-        type: keyword
+        type: text
         description: The path to the file.
+        multi_fields:
+        - name: raw
+          type: keyword
+          description: >
+            The path to the file. This is an non-analyzed field that is useful
+            for aggregations.
 
       - name: target_path
         type: keyword