Skip to content

Allow disabling ignore_malformed on data stream's timestamp field #72406

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Conversation

martijnvg
Copy link
Member

If index.mapping.ignore_malformed has been set to true then
here is no way to overwrite that to false for a data stream's
timestamp field.

Before this commit, validation would fail that disallow the usage
of ignore_malformed attribute on a data stream's timestamp field.

This commit allows the usage of ignore_malformed attribute,
so that index.mapping.ignore_malformed can be disabled for a
data stream's timestamp field. The ignore_malformed attribute
can only be set to false.

This allows the following index template:

PUT /_index_template/filebeat
{
    "index_patterns": [
        "filebeat-*"
    ],
    "template": {
        "settings": {
            "index": {
                "mapping.ignore_malformed": true
            }
        },
        "mappings": {
            "properties": {
                "@timestamp": {
                    "type": "date",
                    "ignore_malformed": false
                }
            }
        }
    },
    "data_stream": {}
}

Closes #71755

If `index.mapping.ignore_malformed` has been set to `true` then
here is no way to overwrite that to `false` for a data stream's
timestamp field.

Before this commit, validation would fail that disallow the usage
of `ignore_malformed` attribute on a data stream's timestamp field.

This commit allows the usage of `ignore_malformed` attribute,
so that `index.mapping.ignore_malformed` can be disabled for a
data stream's timestamp field. The `ignore_malformed` attribute
can only be set to false.

This allows the following index template:

```
PUT /_index_template/filebeat
{
    "index_patterns": [
        "filebeat-*"
    ],
    "template": {
        "settings": {
            "index": {
                "mapping.ignore_malformed": true
            }
        },
        "mappings": {
            "properties": {
                "@timestamp": {
                    "type": "date",
                    "ignore_malformed": false
                }
            }
        }
    },
    "data_stream": {}
}
```

Closes elastic#71755
@martijnvg martijnvg requested a review from danhermann April 28, 2021 16:14
@elasticmachine elasticmachine added the Team:Data Management Meta label for data/management team label Apr 28, 2021
@elasticmachine
Copy link
Collaborator

Pinging @elastic/es-core-features (Team:Core/Features)

Copy link
Contributor

@danhermann danhermann left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM once the checkstyle issue is resolved. Non-blocking question, but do we need a test to ensure that ignore_malformed=true at the index level works when ignore_malformed=false is correctly set on the @timestamp field?

@martijnvg
Copy link
Member Author

do we need a test to ensure that ignore_malformed=true at the index level works when ignore_malformed=false is correctly set on the @timestamp field?

Yes and that is tested in the second half of the test: https://github.com/elastic/elasticsearch/pull/72406/files#diff-0de2e45646b4c7099f9eac6435368bc8bcc22c37dc2c841c4603cb3113bf23dbR167

@danhermann
Copy link
Contributor

do we need a test to ensure that ignore_malformed=true at the index level works when ignore_malformed=false is correctly set on the @timestamp field?

Yes and that is tested in the second half of the test: https://github.com/elastic/elasticsearch/pull/72406/files#diff-0de2e45646b4c7099f9eac6435368bc8bcc22c37dc2c841c4603cb3113bf23dbR167

Ah, thanks, I missed that.

@martijnvg martijnvg merged commit 4d2f709 into elastic:master Apr 29, 2021
martijnvg added a commit to martijnvg/elasticsearch that referenced this pull request Apr 29, 2021
Backporting elastic#72406 to 7.x branch.

If `index.mapping.ignore_malformed` has been set to `true` then
here is no way to overwrite that to `false` for a data stream's
timestamp field.

Before this commit, validation would fail that disallow the usage
of `ignore_malformed` attribute on a data stream's timestamp field.

This commit allows the usage of `ignore_malformed` attribute,
so that `index.mapping.ignore_malformed` can be disabled for a
data stream's timestamp field. The `ignore_malformed` attribute
can only be set to false.

This allows the following index template:

```
PUT /_index_template/filebeat
{
    "index_patterns": [
        "filebeat-*"
    ],
    "template": {
        "settings": {
            "index": {
                "mapping.ignore_malformed": true
            }
        },
        "mappings": {
            "properties": {
                "@timestamp": {
                    "type": "date",
                    "ignore_malformed": false
                }
            }
        }
    },
    "data_stream": {}
}
```

Closes elastic#71755
martijnvg added a commit to martijnvg/elasticsearch that referenced this pull request Apr 29, 2021
Backporting elastic#72406 to 7.13 branch.

If `index.mapping.ignore_malformed` has been set to `true` then
here is no way to overwrite that to `false` for a data stream's
timestamp field.

Before this commit, validation would fail that disallow the usage
of `ignore_malformed` attribute on a data stream's timestamp field.

This commit allows the usage of `ignore_malformed` attribute,
so that `index.mapping.ignore_malformed` can be disabled for a
data stream's timestamp field. The `ignore_malformed` attribute
can only be set to false.

This allows the following index template:

```
PUT /_index_template/filebeat
{
    "index_patterns": [
        "filebeat-*"
    ],
    "template": {
        "settings": {
            "index": {
                "mapping.ignore_malformed": true
            }
        },
        "mappings": {
            "properties": {
                "@timestamp": {
                    "type": "date",
                    "ignore_malformed": false
                }
            }
        }
    },
    "data_stream": {}
}
```

Closes elastic#71755
martijnvg added a commit that referenced this pull request Apr 29, 2021
…2446)

Backporting #72406 to 7.13 branch.

If `index.mapping.ignore_malformed` has been set to `true` then
here is no way to overwrite that to `false` for a data stream's
timestamp field.

Before this commit, validation would fail that disallow the usage
of `ignore_malformed` attribute on a data stream's timestamp field.

This commit allows the usage of `ignore_malformed` attribute,
so that `index.mapping.ignore_malformed` can be disabled for a
data stream's timestamp field. The `ignore_malformed` attribute
can only be set to false.

This allows the following index template:

```
PUT /_index_template/filebeat
{
    "index_patterns": [
        "filebeat-*"
    ],
    "template": {
        "settings": {
            "index": {
                "mapping.ignore_malformed": true
            }
        },
        "mappings": {
            "properties": {
                "@timestamp": {
                    "type": "date",
                    "ignore_malformed": false
                }
            }
        }
    },
    "data_stream": {}
}
```

Closes #71755
martijnvg added a commit that referenced this pull request Apr 29, 2021
…2444)

Backporting #72406 to 7.x branch.

If `index.mapping.ignore_malformed` has been set to `true` then
here is no way to overwrite that to `false` for a data stream's
timestamp field.

Before this commit, validation would fail that disallow the usage
of `ignore_malformed` attribute on a data stream's timestamp field.

This commit allows the usage of `ignore_malformed` attribute,
so that `index.mapping.ignore_malformed` can be disabled for a
data stream's timestamp field. The `ignore_malformed` attribute
can only be set to false.

This allows the following index template:

```
PUT /_index_template/filebeat
{
    "index_patterns": [
        "filebeat-*"
    ],
    "template": {
        "settings": {
            "index": {
                "mapping.ignore_malformed": true
            }
        },
        "mappings": {
            "properties": {
                "@timestamp": {
                    "type": "date",
                    "ignore_malformed": false
                }
            }
        }
    },
    "data_stream": {}
}
```

Closes #71755
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
>bug :Data Management/Data streams Data streams and their lifecycles Team:Data Management Meta label for data/management team v7.13.0 v8.0.0-alpha1
Projects
None yet
Development

Successfully merging this pull request may close these issues.

datastream doesn't work with ignore_malformed setting
4 participants