Skip to content

Not all nested fields are objects  #38

@Mpdreamz

Description

@Mpdreamz

e.g:

elf.header.abiversion is not a field under a header object.

{
  "elf": {
     "header" : {
        "abiversion" : ""
     }
  }
}

But a field with dots under the elf object.

{
  "elf": {
     "header.abiversion" : ""
  }
}

https://github.com/elastic/ecs-typescript/blob/main/generated/process.ts#L106-L110

See e.g how beats maps this:

https://github.com/elastic/beats/blob/66755e6b58338fd138374314c71d5d0119d1506f/libbeat/ecs/elf.go#L54-L55

And your neighbor ecs-dotnet 👋

https://github.com/elastic/ecs-dotnet/blob/main/src/Elastic.CommonSchema/FieldSets.Generated.cs#L948-L954

Only cases where the immediate root of the field is mapped as object or nested should the typemappings create an intermediate inline object type see e.g (dns.answers](https://www.elastic.co/guide/en/ecs/master/ecs-dns.html#field-dns-answers) or elf.sections

And again how beats maps it:
https://github.com/elastic/beats/blob/66755e6b58338fd138374314c71d5d0119d1506f/libbeat/ecs/elf.go#L66

and ecs-dotnet:
https://github.com/elastic/ecs-dotnet/blob/main/src/Elastic.CommonSchema/FieldSets.Generated.cs#L1036-L1043

Currently ecs-typescript does not discover this type yet and reverts to Record<string, object>

https://github.com/elastic/ecs-typescript/blob/main/generated/elf.ts#L87

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions