[Entity Store] Aligning mappings with ECS (#199001)

## Summary This PR corrects some of the mappings set in the component template to follow ECS guidelines. #### How to test Initialise an entity engine via devtools: ``` POST kbn:/api/entity_store/engines/host/init {} ``` Check the mappings with: ``` GET .entities.v1.latest.security_<entityType>_default/_mapping ``` (cherry picked from commit 3fff48a)
elastic · Nov 7, 2024 · ed0ce11 · ed0ce11
1 parent 65d84cf
commit ed0ce11
Show file tree

Hide file tree

Showing 7 changed files with 60 additions and 10 deletions.
diff --git a/.../security_solution/public/entity_analytics/components/entity_store/entities_list.test.tsx b/.../security_solution/public/entity_analytics/components/entity_store/entities_list.test.tsx
@@ -109,7 +109,7 @@ describe('EntitiesList', () => {
     fireEvent.click(columnHeader);
     expect(mockUseEntitiesListQuery).toHaveBeenCalledWith(
       expect.objectContaining({
-        sortField: 'entity.name.text',
+        sortField: 'entity.name',
         sortOrder: 'asc',
       })
     );

diff --git a/...ution/public/entity_analytics/components/entity_store/hooks/use_entities_list_columns.tsx b/...ution/public/entity_analytics/components/entity_store/hooks/use_entities_list_columns.tsx
@@ -79,7 +79,7 @@ export const useEntitiesListColumns = (): EntitiesListColumns => {
       width: '5%',
     },
     {
-      field: 'entity.name.text',
+      field: 'entity.name',
       name: (
         <FormattedMessage
           id="xpack.securitySolution.entityAnalytics.entityStore.entitiesList.nameColumn.title"

diff --git a/..._solution/server/lib/entity_analytics/entity_store/united_entity_definitions/constants.ts b/..._solution/server/lib/entity_analytics/entity_store/united_entity_definitions/constants.ts
@@ -15,10 +15,10 @@ export const BASE_ENTITY_INDEX_MAPPING: MappingProperties = {
     type: 'keyword',
   },
   'entity.name': {
-    type: 'text',
+    type: 'keyword',
     fields: {
       text: {
-        type: 'keyword',
+        type: 'match_only_text',
       },
     },
   },

diff --git a/...n/server/lib/entity_analytics/entity_store/united_entity_definitions/entity_types/host.ts b/...n/server/lib/entity_analytics/entity_store/united_entity_definitions/entity_types/host.ts
@@ -18,7 +18,17 @@ export const getHostUnitedDefinition: UnitedDefinitionBuilder = (fieldHistoryLen
       collect({ field: 'host.domain' }),
       collect({ field: 'host.hostname' }),
       collect({ field: 'host.id' }),
-      collect({ field: 'host.os.name' }),
+      collect({
+        field: 'host.os.name',
+        mapping: {
+          type: 'keyword',
+          fields: {
+            text: {
+              type: 'match_only_text',
+            },
+          },
+        },
+      }),
       collect({ field: 'host.os.type' }),
       collect({
         field: 'host.ip',

diff --git a/...n/server/lib/entity_analytics/entity_store/united_entity_definitions/entity_types/user.ts b/...n/server/lib/entity_analytics/entity_store/united_entity_definitions/entity_types/user.ts
@@ -16,7 +16,17 @@ export const getUserUnitedDefinition: UnitedDefinitionBuilder = (fieldHistoryLen
     fields: [
       collect({ field: 'user.domain' }),
       collect({ field: 'user.email' }),
-      collect({ field: 'user.full_name' }),
+      collect({
+        field: 'user.full_name',
+        mapping: {
+          type: 'keyword',
+          fields: {
+            text: {
+              type: 'match_only_text',
+            },
+          },
+        },
+      }),
       collect({ field: 'user.hash' }),
       collect({ field: 'user.id' }),
       collect({ field: 'user.roles' }),

diff --git a/...lib/entity_analytics/entity_store/united_entity_definitions/get_united_definition.test.ts b/...lib/entity_analytics/entity_store/united_entity_definitions/get_united_definition.test.ts
@@ -32,10 +32,10 @@ describe('getUnitedEntityDefinition', () => {
             "entity.name": Object {
               "fields": Object {
                 "text": Object {
-                  "type": "keyword",
+                  "type": "match_only_text",
                 },
               },
-              "type": "text",
+              "type": "keyword",
             },
             "entity.source": Object {
               "type": "keyword",
@@ -59,9 +59,19 @@ describe('getUnitedEntityDefinition', () => {
               "type": "keyword",
             },
             "host.name": Object {
+              "fields": Object {
+                "text": Object {
+                  "type": "match_only_text",
+                },
+              },
               "type": "keyword",
             },
             "host.os.name": Object {
+              "fields": Object {
+                "text": Object {
+                  "type": "match_only_text",
+                },
+              },
               "type": "keyword",
             },
             "host.os.type": Object {
@@ -335,10 +345,10 @@ describe('getUnitedEntityDefinition', () => {
             "entity.name": Object {
               "fields": Object {
                 "text": Object {
-                  "type": "keyword",
+                  "type": "match_only_text",
                 },
               },
-              "type": "text",
+              "type": "keyword",
             },
             "entity.source": Object {
               "type": "keyword",
@@ -350,6 +360,11 @@ describe('getUnitedEntityDefinition', () => {
               "type": "keyword",
             },
             "user.full_name": Object {
+              "fields": Object {
+                "text": Object {
+                  "type": "match_only_text",
+                },
+              },
               "type": "keyword",
             },
             "user.hash": Object {
@@ -359,6 +374,11 @@ describe('getUnitedEntityDefinition', () => {
               "type": "keyword",
             },
             "user.name": Object {
+              "fields": Object {
+                "text": Object {
+                  "type": "match_only_text",
+                },
+              },
               "type": "keyword",
             },
             "user.risk.calculated_level": Object {

diff --git a/...r/lib/entity_analytics/entity_store/united_entity_definitions/united_entity_definition.ts b/...r/lib/entity_analytics/entity_store/united_entity_definitions/united_entity_definition.ts
@@ -94,6 +94,11 @@ export class UnitedEntityDefinition {
       ...BASE_ENTITY_INDEX_MAPPING,
       [identityField]: {
         type: 'keyword',
+        fields: {
+          text: {
+            type: 'match_only_text',
+          },
+        },
       },
     };
 
@@ -107,6 +112,11 @@ export class UnitedEntityDefinition {
 
     properties[identityField] = {
       type: 'keyword',
+      fields: {
+        text: {
+          type: 'match_only_text',
+        },
+      },
     };
 
     return {