Revert "Remove host fields at root level from stateful indices defini…

…tions (#…" (#574) This reverts commit 6f5398d.
wazuh · Dec 2, 2024 · 979d7ad · 979d7ad
1 parent 6f5398d
commit 979d7ad
Show file tree

Hide file tree

Showing 28 changed files with 378 additions and 168 deletions.
diff --git a/ecs/docs/README.md b/ecs/docs/README.md
diff --git a/ecs/docs/inventory-hardware.md b/ecs/docs/inventory-hardware.md
@@ -34,17 +34,25 @@ fields:
       "@timestamp": {}
   agent:
     fields:
-      groups: {}
       id: {}
-      name: {}
-      type: {}
-      version: {}
-      host:
-        fields: "*"
+      groups: {}
   observer:
     fields:
       serial_number: {}
-
+  host:
+    fields:
+      memory:
+        fields:
+          total: {}
+          free: {}
+          used:
+            fields:
+              percentage: {}
+      cpu:
+        fields:
+          name: {}
+          cores: {}
+          speed: {}
 ```
 
 ### Index settings
@@ -56,12 +64,77 @@ fields:
   "template": {
     "settings": {
       "index": {
-        "number_of_shards": "1",
         "number_of_replicas": "0",
-        "refresh_interval": "5s",
-        "query.default_field": [
-          "observer.board_serial"
-        ]
+        "number_of_shards": "1",
+        "query.default_field": ["observer.board_serial"],
+        "refresh_interval": "5s"
+      }
+    },
+    "mappings": {
+      "date_detection": false,
+      "dynamic": "strict",
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "properties": {
+            "groups": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "host": {
+          "properties": {
+            "cpu": {
+              "properties": {
+                "cores": {
+                  "type": "long"
+                },
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                },
+                "speed": {
+                  "type": "long"
+                }
+              },
+              "type": "object"
+            },
+            "memory": {
+              "properties": {
+                "free": {
+                  "type": "long"
+                },
+                "total": {
+                  "type": "long"
+                },
+                "used": {
+                  "properties": {
+                    "percentage": {
+                      "type": "long"
+                    }
+                  },
+                  "type": "object"
+                }
+              },
+              "type": "object"
+            }
+          }
+        },
+        "observer": {
+          "properties": {
+            "serial_number": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        }
       }
     }
   }

diff --git a/ecs/docs/inventory-hotfixes.md b/ecs/docs/inventory-hotfixes.md
@@ -27,19 +27,13 @@ fields:
       "@timestamp": {}
   agent:
     fields:
-      groups: {}
       id: {}
-      name: {}
-      type: {}
-      version: {}
-      host:
-        fields: "*"
+      groups: {}
   package:
     fields:
       hotfix:
         fields:
           name: {}
-
 ```
 
 ### Index settings
@@ -51,12 +45,44 @@ fields:
   "template": {
     "settings": {
       "index": {
-        "number_of_shards": "1",
         "number_of_replicas": "0",
-        "refresh_interval": "5s",
-        "query.default_field": [
-          "package.hotfix.name"
-        ]
+        "number_of_shards": "1",
+        "query.default_field": ["package.hotfix.name"],
+        "refresh_interval": "5s"
+      }
+    },
+    "mappings": {
+      "date_detection": false,
+      "dynamic": "strict",
+      "properties": {
+        "@timestamp": {
+          "type": "date"
+        },
+        "agent": {
+          "properties": {
+            "groups": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            },
+            "id": {
+              "ignore_above": 1024,
+              "type": "keyword"
+            }
+          }
+        },
+        "package": {
+          "properties": {
+            "hotfix": {
+              "properties": {
+                "name": {
+                  "ignore_above": 1024,
+                  "type": "keyword"
+                }
+              },
+              "type": "object"
+            }
+          }
+        }
       }
     }
   }