elastic / elasticsearch

Free and Open Source, Distributed, RESTful Search Engine
https://www.elastic.co/products/elasticsearch
Other
70.93k stars 24.9k forks source link

Dynamic Mappings set to false on index templates despite showing true in the UI #118026

Open CarsonHrusovsky opened 9 hours ago

CarsonHrusovsky commented 9 hours ago

Elasticsearch Version

8.16.1

Installed Plugins

No response

Java Version

23.0.0.0

OS Version

Windows Server 2019 1809

Problem Description

I first noticed this in the logs-endpoint.events.process index template (but I doubt this is just an endpoint issue). Within the Managed Index Template, dynamic mappings is set to "false". Before updating to 8.16.1 this was set to "true" and has thus broken our dynamic mappings we were relying on. Regardless of this - the true issue is the fact that mappings are set to false in this template despite this clearly showing when investigating the UI.

"mappings": { "dynamic": "false", "_meta": { "managed_by": "fleet", "managed": true, "package": { "name": "endpoint" } },

Image

If I were to toggle this off and then on again, the preview will show this.

"mappings": { "dynamic": "true", "_meta": { "managed_by": "fleet", "managed": true, "package": { "name": "endpoint" } },

This seems like a bug. Additionally, the replacement of dynamic mappings from 'true' to 'false' here is very frustrating as dynamic mappings is configured for this index template under the ecs@mappings component template, but isn't enabled by default.

Steps to Reproduce

My steps to recreate was to update to 8.16.1 from 8.15.2. I would guess this is default behavior for this index template - but I am not without a doubt sure of this.

Logs (if relevant)

No response

nicpenning commented 9 hours ago

Related: https://github.com/elastic/kibana/issues/150395 ?