Skip to content

Commit 97ca5b9

Browse files
Update debug string naming
1 parent eeec54d commit 97ca5b9

File tree

1 file changed

+6
-7
lines changed

1 file changed

+6
-7
lines changed

detection_rules/index_mappings.py

Lines changed: 6 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -160,17 +160,16 @@ def get_simulated_index_template_mappings(elastic_client: Elasticsearch, name: s
160160

161161

162162
def prune_mappings_of_unsupported_types(
163-
integration: str | None, index: str | None, stream_mappings: dict[str, Any], log: Callable[[str], None]
163+
debug_str_data_source: str, stream_mappings: dict[str, Any], log: Callable[[str], None]
164164
) -> dict[str, Any]:
165165
"""Prune fields with unsupported types (ES|QL) from the provided mappings."""
166-
debug_str = integration if integration is not None else index
167166
nested_multifields = find_nested_multifields(stream_mappings)
168167
for field in nested_multifields:
169168
parts = str(field).split(".fields.")[0].split(".")
170169
base_name = ".properties.".join(parts)
171170
field_name = f"{base_name}.fields"
172171
log(
173-
f"Warning: Nested multi-field `{field}` found in `{debug_str}`. "
172+
f"Warning: Nested multi-field `{field}` found in `{debug_str_data_source}`. "
174173
f"Removing parent field from schema for ES|QL validation."
175174
)
176175
delete_nested_key_from_dict(stream_mappings, field_name)
@@ -183,7 +182,7 @@ def prune_mappings_of_unsupported_types(
183182
field_name = f"{base_name}.fields"
184183
property_name = f"{base_name}.properties"
185184
log(
186-
f"Warning: flattened field `{field}` found in `{debug_str}` with sub fields. "
185+
f"Warning: flattened field `{field}` found in `{debug_str_data_source}` with sub fields. "
187186
f"Removing parent field from schema for ES|QL validation."
188187
)
189188
delete_nested_key_from_dict(stream_mappings, field_name)
@@ -231,7 +230,7 @@ def prepare_integration_mappings( # noqa: PLR0913
231230
for stream in package_schema:
232231
flat_schema = package_schema[stream]
233232
stream_mappings = flat_schema_to_index_mapping(flat_schema)
234-
stream_mappings = prune_mappings_of_unsupported_types(f"{integration}-{stream}", None, stream_mappings, log)
233+
stream_mappings = prune_mappings_of_unsupported_types(f"{integration}-{stream}", stream_mappings, log)
235234
utils.combine_dicts(integration_mappings, deepcopy(stream_mappings))
236235
index_lookup[f"{integration}-{stream}"] = stream_mappings
237236

@@ -314,7 +313,7 @@ def get_filtered_index_schema( # noqa: PLR0913
314313
# Need to use a merge here to not overwrite existing fields
315314
utils.combine_dicts(base, deepcopy(non_ecs_mapping.get(match, {})))
316315
utils.combine_dicts(base, deepcopy(custom_mapping.get(match, {})))
317-
filtered_index_lookup[match] = prune_mappings_of_unsupported_types(None, match, base, log)
316+
filtered_index_lookup[match] = prune_mappings_of_unsupported_types(match, base, log)
318317
utils.combine_dicts(combined_mappings, deepcopy(base))
319318

320319
# Reduce the index lookup to only the matched indices (remote/Kibana schema validation source of truth)
@@ -500,7 +499,7 @@ def prepare_mappings( # noqa: PLR0913
500499
# and also at a per index level as custom schemas can override non-ecs fields and/or indices
501500
non_ecs_schema = ecs.flatten(non_ecs_schema)
502501
non_ecs_schema = utils.convert_to_nested_schema(non_ecs_schema)
503-
non_ecs_schema = prune_mappings_of_unsupported_types(None, "non-ecs", non_ecs_schema, log)
502+
non_ecs_schema = prune_mappings_of_unsupported_types("non-ecs", non_ecs_schema, log)
504503

505504
# Load custom schema and convert to index mapping format (nested schema)
506505
custom_mapping: dict[str, Any] = {}

0 commit comments

Comments
 (0)