elastic / ecs

Elastic Common Schema
https://www.elastic.co/what-is/ecs
Apache License 2.0
1k stars 415 forks source link

ECS tooling re-use enhancements #1839

Open kgeller opened 2 years ago

kgeller commented 2 years ago

Purpose

Adding some potential nice-to-have's to the way ECS currently implements re-uses.

Background

When working on https://github.com/elastic/ecs/issues/1736 , it became clear that, while our tooling is great at what it does, there are some things that could be done to enhance the way we display certain things about re-uses.

1) We don't set a default type for re-use objects i.e. process.parent like we do for regular object types like threat.enrichments.indicator. 2) Connect the dots between ^ and https://github.com/elastic/ecs/pull/1838 so that when we list re-uses to be arrays, that we see that come through in the generated artifacts, kind of like https://github.com/elastic/ecs/blob/main/generated/csv/fields.csv#L162

Potential question(s)

Note: https://github.com/kgeller/ecs/tree/reuse-array-support contains some startings of trying to work through the above

ebeahan commented 2 years ago

Also could explore including some sort of field filtering for reuses here.