search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.59k stars 8.21k forks source link

[SIEM] Check fields for mapping conflicts before sending to SearchBar #55760

Open spong opened 4 years ago

spong commented 4 years ago

There was a recent field mapping conflict that resulted in the inability to search/create filters for destination.ip as this field was mapped to both ip and keyword. When paired with the Add Filter to KQL feature, this would result in an app crash when trying to edit the filter of a conflicted field. E.g. Adding a filter on destination.ip via the Map tooltip, and then editing the filter.

Example Filter UI when trying to add a filter for aconflicted field:

In debugging, @XavierM and I verified that the conflict does indeed show up when we're querying fields to pass off to the SearchBar, and so we should be able to verify if any conflicts exist and alert the user. This may be a more intensive computation, so we might only want to do it once per app load, or even make it something the user can manually request.

elasticmachine commented 4 years ago

Pinging @elastic/siem (Team:SIEM)

spong commented 4 years ago

@MadameSheema this is still relevant as of the latest 7.9.0-snapshot.