FrankHassanabad

#
# Create two mappings, one with nesting and one without:
#

# Optinally clean up any old index data
DELETE /delme-test-categories
DELETE /delme-test-categories2

# Without nesting
PUT /delme-test-categories

FrankHassanabad

# Mapping with a "constant_keyword" for "data_stream.dataset"
# Mapping with an alias from "event.dataset" -> "data_stream.dataset"
DELETE const-keyword-frank-delme-1
PUT const-keyword-frank-delme-1
{
  "mappings": {
    "dynamic":"false",
    "properties": {
      "@timestamp": {
        "type": "date"

FrankHassanabad

# Create an index which has a runtime field to do a split against a "constant_keyword"
# of "data_stream.dataset" and use the first value found as the "event.module"
# I add an additional "host.name" type of keyword to compare
#   * Profile of aggregating against the runtime field which does a split against the "constant_keyword"
#   * Profile of aggregating against the const_keyword
#   * Profile of aggregating against a normal keyword 
#   * Profile against a field alias against the "constant_keyword" field
DELETE const-logs-frank-delme-1
PUT const-logs-frank-delme-1
{

FrankHassanabad

```json
# Adds an index for testing where we can test across:
#   * keyword
#   * const keyword
#   * And a corner case where someone reindexes non-compatible const data into const data from _source.
DELETE const-logs-frank-delme-2
PUT const-logs-frank-delme-2
{
  "mappings": {
    "dynamic": "false",

FrankHassanabad

I want to return @timestamp as a different format such as "YYYY" but am mixing together doc_valuefields with fields. Fields takes priority over doc_valuefields it looks like.

Ref: https://www.elastic.co/guide/en/elasticsearch/reference/current/search-fields.html

We might have a slight bug here: https://github.com/elastic/kibana/blob/master/x-pack/plugins/security_solution/server/lib/detection_engine/signals/build_events_query.ts#L109-L125

Where we mix these two. I test this by trying override the date times below but it only works when we remove doc_valuefields and not mix it with fields

FrankHassanabad

Steps are, add a simple static mapping:

# Add our mapping of just a keyword called "test"
DELETE frank-test-delme-5
PUT frank-test-delme-5
{
  "mappings": {
    "dynamic": "false",
    "properties": {
 "test": {

FrankHassanabad

# Add a mapping of with a text field
DELETE frank-test-delme-6
PUT frank-test-delme-6
{
  "mappings": {
    "dynamic": "strict",
    "properties": {
      "@timestamp": {

FrankHassanabad

# New behavior which does NOT allow us to use "-*elastic-cloud-logs-*" if it does not exist
# to subtract. Instead this blows up with a 404 error which causes a cascading 500 internal server error
POST /auditbeat-*,filebeat-*,logs-*,winlogbeat-*,-*elastic-cloud-logs-*/_terms_enum
{
  "field": "host.name",
  "string": "",
  "index_filter": {
    "bool": {
      "must": [
        {

FrankHassanabad

Public gist of Microsoft co-pilot and the interesting things it will return for entertainment values. I choose the best few examples from the co-pilot suggestions and add them here. This is all typescript examples. I do cherry pick the examples and do not just take the first one found.

What does co-pilot dream of?

Starting text:

// return a string of a dream 
export const dreamString = () => {

FrankHassanabad

# Get the alert type of "siem-notifications" which is part of the legacy system.
GET .kibana-hassanabad22/_search
{
  "query": {
    "term": {
      "alert.alertTypeId": "siem.notifications"
    }
  }
}