ECS Tooling - Mapping & Template Settings

[daniel-rhoades]

Within USAGE.md (line 402 - Mapping & Template Settings), it describes how to specify a template file:

The --template-settings-legacy argument defines [index level settings (https://www.elastic.co/guide/en/elasticsearch/reference/current/index-modules.html#index-modules-settings) that will be applied to the legacy index template in the generated artifacts. The --template-settings argument now defines those same settings, but for the composable template in the generated artifacts.

This is an example template.json to be passed with --template-setting-legacy:

{
  "index_patterns": ["mylog-*"],
  "order": 1,
  "settings": {
    "index": {
      "mapping": {
        "total_fields": {
          "limit": 10000
        }
      },
      "refresh_interval": "1s"
    }
  },
  "mappings": {}
}

[...]

For template.json, the mappings object is left empty: {}. Likewise the properties object remains empty in the mapping.json example. This will be filled in automatically by the script.

However, using the example (given for --template-setting-legacy) for --template causes the ECS Tooling to error:

...
 File "[...]/ecs/scripts/generators/es_template.py", line 263, in finalize_template
    template['template']['mappings'] = mappings_section
KeyError: 'template'

Wrapping settings within a template element resolves the issue, since this would then be compliant with the standard index template schema.

If this behaviour is expected, perhaps the documentation just updating.

[mjwolf]

Hi @daniel-rhoades, thanks for finding this. The given example in the documentation is incorrect, this will fix it