Adding warning to exceptions that describes field conflicts and mapping issues #3025
Conversation
nastasha-solomon
added
Team: Detections/Response
|
Documentation previews: |
There was a problem hiding this comment.
Good stuff! I did a pretty quick review, and will do a more thoroughly edit soon, but just wanted to pass along a few suggestions to start. Overall I think the organization works well.
The troubleshooting topic also explains the situation pretty well, but the call to action isn't super clear: what is the user supposed to do to resolve the situation, or do they need to do anything at all? The most explicit instruction is "Use this information to ensure you're entering correct values," but that's pretty general advice.
If fields are conflicting or unmapped across indices, does the user need to do anything with the indices themselves so they're no longer conflicting? Maybe we could point toward some ES/Kibana docs on how to map indices to types?
Co-authored-by: Joe Peeples <[email protected]>
Co-authored-by: Benjamin Ironside Goldstein <[email protected]>
Co-authored-by: Benjamin Ironside Goldstein <[email protected]>
…ng issues (#3025) Co-authored-by: Joe Peeples <[email protected]> Co-authored-by: Benjamin Ironside Goldstein <[email protected]> (cherry picked from commit b925ecc)
… mapping issues (backport #3025) (#3076) Co-authored-by: Joe Peeples <[email protected]> Co-authored-by: Benjamin Ironside Goldstein <[email protected]> Co-authored-by: nastasha-solomon <[email protected]>
Fixes #2957.
Previews:
Note to self: elastic/kibana#152726 updated the copy in this warning so I'll need to update the three screenshots I added after once the next BC comes out.