-
Notifications
You must be signed in to change notification settings - Fork 141
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
dynamic field type(flat_object) support #3067
Labels
catch-all acknowledged
Marks issues caught in catch-all triage for searchability
enhancement
New feature or request
Comments
kedbirhan
changed the title
dynamic field type(flat_obejct) field missing
dynamic field type(flat_obejct) value missing
Oct 11, 2024
[Catch All Triage - 1, 2, 3] |
Query SELECT requestParameters
from logs-cloudtrail WHERE
requestParameters.nextToken is not null
LIMIT 25 Response
|
kedbirhan
changed the title
dynamic field type(flat_obejct) value missing
dynamic field type(flat_obejct) support
Nov 13, 2024
SELECT * FROM logs-cloudtrail
WHERE (
(eventName = 'CreateInstanceExportTask' AND eventSource = 'ec2.amazonaws.com')
AND NOT (
(errorMessage LIKE '%%%' )
OR (errorCode LIKE '%%%') OR (responseElements LIKE '%Failure%' )))
|
acarbonetto
changed the title
dynamic field type(flat_obejct) support
dynamic field type(flat_object) support
Jan 2, 2025
Related issue: #1604 |
acarbonetto
added
enhancement
New feature or request
and removed
bug
Something isn't working
labels
Jan 2, 2025
@kedbirhan would you consider mapping the fields you'd like to search to an object? Searches on flat_objects are limited. |
Swiddis
added
the
catch-all acknowledged
Marks issues caught in catch-all triage for searchability
label
Jan 7, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
catch-all acknowledged
Marks issues caught in catch-all triage for searchability
enhancement
New feature or request
dynamic field type(flat_obejct) field are missing from returned query result. For instance requestParameter and responseElement field of cloudtrail logs are commonly mapped to flat_object field type to avoid mapping explosion but when doing so the query result returned completely ignores this field on top of that we can't even use this dynamic nested fields for querying this is a big problem for storing cloud native logs that may have dynamic field values,
The text was updated successfully, but these errors were encountered: