-
Notifications
You must be signed in to change notification settings - Fork 25.2k
Allow disabling ignore_malformed on data stream's timestamp field #72406
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Allow disabling ignore_malformed on data stream's timestamp field #72406
Conversation
If `index.mapping.ignore_malformed` has been set to `true` then here is no way to overwrite that to `false` for a data stream's timestamp field. Before this commit, validation would fail that disallow the usage of `ignore_malformed` attribute on a data stream's timestamp field. This commit allows the usage of `ignore_malformed` attribute, so that `index.mapping.ignore_malformed` can be disabled for a data stream's timestamp field. The `ignore_malformed` attribute can only be set to false. This allows the following index template: ``` PUT /_index_template/filebeat { "index_patterns": [ "filebeat-*" ], "template": { "settings": { "index": { "mapping.ignore_malformed": true } }, "mappings": { "properties": { "@timestamp": { "type": "date", "ignore_malformed": false } } } }, "data_stream": {} } ``` Closes elastic#71755
Pinging @elastic/es-core-features (Team:Core/Features) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM once the checkstyle issue is resolved. Non-blocking question, but do we need a test to ensure that ignore_malformed=true
at the index level works when ignore_malformed=false
is correctly set on the @timestamp
field?
Yes and that is tested in the second half of the test: https://github.com/elastic/elasticsearch/pull/72406/files#diff-0de2e45646b4c7099f9eac6435368bc8bcc22c37dc2c841c4603cb3113bf23dbR167 |
Ah, thanks, I missed that. |
Backporting elastic#72406 to 7.x branch. If `index.mapping.ignore_malformed` has been set to `true` then here is no way to overwrite that to `false` for a data stream's timestamp field. Before this commit, validation would fail that disallow the usage of `ignore_malformed` attribute on a data stream's timestamp field. This commit allows the usage of `ignore_malformed` attribute, so that `index.mapping.ignore_malformed` can be disabled for a data stream's timestamp field. The `ignore_malformed` attribute can only be set to false. This allows the following index template: ``` PUT /_index_template/filebeat { "index_patterns": [ "filebeat-*" ], "template": { "settings": { "index": { "mapping.ignore_malformed": true } }, "mappings": { "properties": { "@timestamp": { "type": "date", "ignore_malformed": false } } } }, "data_stream": {} } ``` Closes elastic#71755
Backporting elastic#72406 to 7.13 branch. If `index.mapping.ignore_malformed` has been set to `true` then here is no way to overwrite that to `false` for a data stream's timestamp field. Before this commit, validation would fail that disallow the usage of `ignore_malformed` attribute on a data stream's timestamp field. This commit allows the usage of `ignore_malformed` attribute, so that `index.mapping.ignore_malformed` can be disabled for a data stream's timestamp field. The `ignore_malformed` attribute can only be set to false. This allows the following index template: ``` PUT /_index_template/filebeat { "index_patterns": [ "filebeat-*" ], "template": { "settings": { "index": { "mapping.ignore_malformed": true } }, "mappings": { "properties": { "@timestamp": { "type": "date", "ignore_malformed": false } } } }, "data_stream": {} } ``` Closes elastic#71755
…2446) Backporting #72406 to 7.13 branch. If `index.mapping.ignore_malformed` has been set to `true` then here is no way to overwrite that to `false` for a data stream's timestamp field. Before this commit, validation would fail that disallow the usage of `ignore_malformed` attribute on a data stream's timestamp field. This commit allows the usage of `ignore_malformed` attribute, so that `index.mapping.ignore_malformed` can be disabled for a data stream's timestamp field. The `ignore_malformed` attribute can only be set to false. This allows the following index template: ``` PUT /_index_template/filebeat { "index_patterns": [ "filebeat-*" ], "template": { "settings": { "index": { "mapping.ignore_malformed": true } }, "mappings": { "properties": { "@timestamp": { "type": "date", "ignore_malformed": false } } } }, "data_stream": {} } ``` Closes #71755
…2444) Backporting #72406 to 7.x branch. If `index.mapping.ignore_malformed` has been set to `true` then here is no way to overwrite that to `false` for a data stream's timestamp field. Before this commit, validation would fail that disallow the usage of `ignore_malformed` attribute on a data stream's timestamp field. This commit allows the usage of `ignore_malformed` attribute, so that `index.mapping.ignore_malformed` can be disabled for a data stream's timestamp field. The `ignore_malformed` attribute can only be set to false. This allows the following index template: ``` PUT /_index_template/filebeat { "index_patterns": [ "filebeat-*" ], "template": { "settings": { "index": { "mapping.ignore_malformed": true } }, "mappings": { "properties": { "@timestamp": { "type": "date", "ignore_malformed": false } } } }, "data_stream": {} } ``` Closes #71755
If
index.mapping.ignore_malformed
has been set totrue
thenhere is no way to overwrite that to
false
for a data stream'stimestamp field.
Before this commit, validation would fail that disallow the usage
of
ignore_malformed
attribute on a data stream's timestamp field.This commit allows the usage of
ignore_malformed
attribute,so that
index.mapping.ignore_malformed
can be disabled for adata stream's timestamp field. The
ignore_malformed
attributecan only be set to false.
This allows the following index template:
Closes #71755