Include ip and boolean type when generating index pattern

[cwurm]

A number of fields in our fields.yml files now are type: ip (e.g. source.ip) and type: boolean, but the code generating index patterns does not know about these types yet and so does not add a type to the index pattern for those fields at all. This leads to errors in Kibana when looking at dashboards that contain references to those fields.

Output of ./auditbeat export index-pattern:

Before:

  {
    "aggregatable": true,
    "analyzed": false,
    "count": 0,
    "doc_values": true,
    "indexed": true,
    "name": "source.ip",
    "scripted": false,
    "searchable": true
  },

After:

  {
    "aggregatable": true,
    "analyzed": false,
    "count": 0,
    "doc_values": true,
    "indexed": true,
    "name": "source.ip",
    "scripted": false,
    "searchable": true,
    "type": "ip"
  },

[andrewkroh]

Nice. I just thought is was a quirk of Kibana where data needed to be indexed first.

[webmat]

Tests need updating, just adjusting the expected value to include IP: https://beats-ci.elastic.co/job/elastic+beats+pull-request+multijob-linux/5477/beat=libbeat,label=linux-immutable/console

But thanks for looking into this, I also thought this was a quirk :-)

[cwurm]

On closer inspection, I noticed the boolean type was missing as well, so I added it. Every field in the Auditbeat index pattern now has a type.

I checked Metricbeat as well and some fields there are still missing their type. At least one cause is when type: object and object_type: keyword. But I'm not going to investigate that one further at the moment. /cc @ruflin in case you want to take a look

[webmat]

LGTM! Thanks, this is a great find :-)