Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Replace wildcard and match_only_text types to keyword #590

Open
3 tasks
AlexRuiz7 opened this issue Dec 11, 2024 · 0 comments
Open
3 tasks

Replace wildcard and match_only_text types to keyword #590

AlexRuiz7 opened this issue Dec 11, 2024 · 0 comments
Labels
level/task Task issue type/enhancement Enhancement issue

Comments

@AlexRuiz7
Copy link
Member

Description

Due to a bug in OpenSearch Dashboards not rendering supported types properly in Discover and other places of the UI, we need to change the mappings for every Wazuh index replacing wildcard and match_only_text types with keyword|text.

Related issues:

Functional requirements

  • None of the stateful indices use wildcard or match_only_text field types.
  • None of the stateless (alerts, commands) indices use wildcard or match_only_text field types.

Implementation restrictions

  • The changes must be performed by updating our generation script, so the replacements are automated.
  • Consider using text instead of keyword for better search behavior.

Plan

  • Patch the generate.sh script.
  • Regenerate the mappings.
  • Update the index templates for the setup and command-manager plugins.
@AlexRuiz7 AlexRuiz7 added level/task Task issue type/enhancement Enhancement issue mvp Minimum Viable Product labels Dec 11, 2024
@wazuhci wazuhci moved this to Backlog in Release 5.0.0 Dec 11, 2024
@AlexRuiz7 AlexRuiz7 removed the mvp Minimum Viable Product label Dec 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
level/task Task issue type/enhancement Enhancement issue
Projects
Status: Backlog
Development

No branches or pull requests

1 participant