1010
1111import org .elasticsearch .common .network .NetworkAddress ;
1212import org .elasticsearch .common .time .DateFormatters ;
13- import org .elasticsearch .common .util .Maps ;
1413import org .elasticsearch .core .Nullable ;
1514
1615import java .net .InetAddress ;
@@ -372,7 +371,6 @@ private void processExtensions(String cefString, int extensionStart, CefEvent ev
372371 removeEmptyValue (parsedExtensions );
373372 }
374373 // Translate extensions to possible ECS fields
375- final Map <String , Object > extensions = Maps .newHashMapWithExpectedSize (parsedExtensions .size ());
376374 for (Map .Entry <String , String > entry : parsedExtensions .entrySet ()) {
377375 ExtensionMapping mapping = EXTENSION_MAPPINGS .get (entry .getKey ());
378376 if (mapping != null ) {
@@ -382,17 +380,13 @@ private void processExtensions(String cefString, int extensionStart, CefEvent ev
382380 event .addRootMapping (ecsKey , convertValueToType (entry .getValue (), mapping .dataType ()));
383381 } else {
384382 // Add the extension to the CEF mappings if it doesn't have an ECS translation
385- extensions . put ( mapping .key (), convertValueToType (entry .getValue (), mapping .dataType ()));
383+ event . addCefMapping ( "extensions." + mapping .key (), convertValueToType (entry .getValue (), mapping .dataType ()));
386384 }
387385 } else {
388386 // Add the extension if the key is not in the mapping
389- extensions . put ( entry .getKey (), entry .getValue ());
387+ event . addCefMapping ( "extensions." + entry .getKey (), entry .getValue ());
390388 }
391389 }
392- // Bang the extensions into the cef mappings
393- if (extensions .isEmpty () == false ) {
394- event .addCefMapping ("extensions" , extensions );
395- }
396390 }
397391
398392 private static Map <String , String > parseExtensions (String extensionString ) {
0 commit comments