Add Beats compatible fields.yml for ECS #108
Conversation
Makefile
Outdated
| sed -i.bak 's/---//g' fields.tmp.yml | ||
| cat scripts/fields_header.yml > fields.yml | ||
| cat fields.tmp.yml >> fields.yml | ||
| rm fields.tmp.yml.bak |
There was a problem hiding this comment.
make check needs to updated to call fields.
It looks like it could be simplified by making it depend on the targets that it invokes by calling $(MAKE) (e.g. change it to check: generate fmt fields).
fields.yml
Outdated
| ECS fields. | ||
| fields: | ||
|
|
||
| - name: agent |
There was a problem hiding this comment.
Shouldn't this have type: group?
fields.yml
Outdated
| ECS fields. | ||
| fields: | ||
|
|
||
| - name: agent |
There was a problem hiding this comment.
Would it be easy to move this over another 2 spaces? My goal is to have the it look like this
fields:
- blah
rather than
fields:
- blah
which is consistent with indentations found in other areas of the file.
Makefile
Outdated
| sed -i.bak 's/---//g' fields.tmp.yml | ||
| cat scripts/fields_header.yml > fields.yml | ||
| cat fields.tmp.yml >> fields.yml | ||
| rm fields.tmp.yml.bak |
There was a problem hiding this comment.
make check needs to updated to call fields.
It looks like it could be simplified by making it depend on the targets that it invokes by calling $(MAKE) (e.g. change it to check: generate fmt fields).
|
@ruflin I pushed an update. And I tried out the fields.yml file with a Beat and it worked 👍 . I had to remove the duplicates for things that were already defined in libbeat. |
Add `type: group` to each prefix.
|
Thanks @andrewkroh I rebased on master and pushed again. Somehow build had a diff, not sure why. |
|
With the rebase it looks like it pulled in the recent .original changes so ‘make fields’ needs to run again. |
|
The problem was that the fields target was missing for generate, so only check failed but it was not updated when running just make. I assume updating it always is the behaviour we want? |
| title: ECS | ||
| description: > | ||
| ECS fields. | ||
| fields: |
There was a problem hiding this comment.
Not familiar with the automation we have in Beats that will consume this. I won't nest everything under ecs.*, will it?
There was a problem hiding this comment.
It will not. There is quite a bit of history on why this additional thingy is here but in short it has to do with docs and how the fields.yml was organised in the past.
This adds a new fields file, libbeat/_meta/fields.ecs.yml, that is a copy of fields.yml from elastic/ecs#108, except: - the document separator --- has been removed. - keyword subfields have been renamed to raw (to maintain backwards compatibility). - source group has been removed.
Add
type: groupto each prefix.