Respect ignore_above if set for a flattened type field (elastic#2248

) * respect ignore_above if set for a flattened type field * changelog
kgeller · Aug 8, 2023 · b19f392 · b19f392
1 parent 630429e
commit b19f392
Show file tree

Hide file tree

Showing 3 changed files with 40 additions and 1 deletion.
diff --git a/CHANGELOG.next.md b/CHANGELOG.next.md
@@ -18,6 +18,7 @@ Thanks, you're awesome :-) -->
 * Added `container.security_context.privileged` to indicated whether a container was started in privileged mode. #2219, #2225
 
 #### Improvements
+* Permit `ignore_above` if explicitly set on a `flattened` field. #2248
 
 #### Deprecated
 

diff --git a/scripts/generators/es_template.py b/scripts/generators/es_template.py
@@ -191,7 +191,7 @@ def entry_for(field: Field) -> Dict:
         elif 'index' in field and not field['index']:
             ecs_helpers.dict_copy_existing_keys(field, field_entry, ['index', 'doc_values'])
 
-        if field['type'] == 'keyword':
+        if field['type'] == 'keyword' or field['type'] == 'flattened':
             ecs_helpers.dict_copy_existing_keys(field, field_entry, ['ignore_above'])
         elif field['type'] == 'constant_keyword':
             ecs_helpers.dict_copy_existing_keys(field, field_entry, ['value'])

diff --git a/scripts/tests/test_es_template.py b/scripts/tests/test_es_template.py
@@ -174,6 +174,44 @@ def test_constant_keyword_no_value(self):
         exp = {'type': 'constant_keyword'}
         self.assertEqual(es_template.entry_for(test_map), exp)
 
+    def test_keyword_pass_ignore_above(self):
+        test_map = {
+            'name': 'field_with_ignore_above_set',
+            'type': 'keyword',
+            'ignore_above': 1024
+        }
+
+        exp = {
+            'type': 'keyword',
+            'ignore_above': 1024
+        }
+        self.assertEqual(es_template.entry_for(test_map), exp)
+
+    def test_flattened_pass_ignore_above(self):
+        test_map = {
+            'name': 'field_with_ignore_above_set',
+            'type': 'flattened',
+            'ignore_above': 1024
+        }
+
+        exp = {
+            'type': 'flattened',
+            'ignore_above': 1024
+        }
+        self.assertEqual(es_template.entry_for(test_map), exp)
+
+    def test_other_types_not_pass_ignore_above(self):
+        test_map = {
+            'name': 'field_should_not_have_ignore_above_set',
+            'type': 'text',
+            'ignore_above': 1024
+        }
+
+        exp = {
+            'type': 'text'
+        }
+        self.assertEqual(es_template.entry_for(test_map), exp)
+
     def test_parameters(self):
         test_map = {
             'name': 'field_with_parameters',