object_type: keyword

[pzl]

Change Summary

for any field marked type: object, it must have the accompanying setting object_type per package-spec.

This sets all of our objects to keyword.

Sample values

N/A

Sample document:

N/A

Release Target

8.12

Q/A

For mapping changes:

• I ran make after making the schema changes, and committed all changes
• If these field(s) are "exception"-able, I made a companion PR to Kibana adding it (see Readme)
• [] If this is a metadata change, I also updated both transform destination schemas to match
  ^^ ????

For Transform changes:

• [ ] The new transform successfully starts in Kibana
• [ ] The corresponding transform destination schema was updated if necessary

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2023-10-10T19:12:14.617+0000

• Duration: 7 min 18 sec

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[andrewkroh]

This will create a dynamic mapping for call_stack.* that maps any matching properties a keyword. If you are not expecting properties beyond what is already explicitly mapped, then I would recommend setting type: group and eliminating object_type.

I think all of the cases here where the a non-leaf field was changed to a dynamic mapping should be changed to group. Then the resulting index template would not change, and the package would be following package-spec.

[elasticmachine]

Package endpoint - 8.13.0 containing this change is available at https://epr.elastic.co/search?package=endpoint