id->event bridge: handle array types as lists (#146)

* id->event bridge: handle array types as lists

* changelog/bump: include changes since 0.1.9

* docs: enumerate supported database types

Author: yaauie

CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.1.10
+  - Fixes handling of array-type event fields by treating them as lists [#146](https://github.com/elastic/logstash-filter-elastic_integration/pull/146)
+  - Syncs with Elasticsearch 8.14, including support for new user-provided GeoIP database types `ConnectionType`, `Domain` and `Isp` [#147](https://github.com/elastic/logstash-filter-elastic_integration/pull/147)
+
 ## 0.1.9
   - [DOC] Removes Tech Preview label and adds link to extending integrations topic in LSR [#142](https://github.com/elastic/logstash-filter-elastic_integration/pull/142)
 

VERSION

@@ -1 +1 @@
-0.1.9
+0.1.10

docs/index.asciidoc

@@ -336,13 +336,26 @@ By using managed databases you accept and agree to the https://www.maxmind.com/e
 
 You may instead configure this plugin with the path to a local directory containing database files.
 
-Databases are registered by file name, and most integrations rely on databases being present named:
-
-* `GeoLite2-ASN.mmdb`
-* `GeoLite2-City.mmdb`
+This plugin will discover all regular files with the `.mmdb` suffix in the provided directory, and make each available by its file name to the GeoIp processors in integration pipelines.
+It expects the files it finds to be in the MaxMind DB format with one of the following database types:
+
+* `AnonymousIp`
+* `ASN`
+* `City`
+* `Country`
+* `ConnectionType`
+* `Domain`
+* `Enterprise`
+* `Isp`
+
+[NOTE]
+====
+Most integrations rely on databases being present named _exactly_:
+
+* `GeoLite2-ASN.mmdb`,
+* `GeoLite2-City.mmdb`, or
 * `GeoLite2-Country.mmdb`
-
-This plugin will discover any regular file with the `.mmdb` suffix in the provided directory, and expects the files it finds to be in the MaxMind DB format.
+====
 
 [id="plugins-{type}s-{plugin}-hosts"]
 ===== `hosts`

src/main/java/co/elastic/logstash/filters/elasticintegration/IngestDuplexMarshaller.java

@@ -22,6 +22,7 @@
 import java.time.ZoneId;
 import java.time.ZonedDateTime;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.HashMap;
@@ -278,6 +279,8 @@ private Object internalize(final @Nullable Object externalObject) {
             return internalize(externalSet);
         } else if (externalObject instanceof ZonedDateTime zonedDateTime) {
             return new Timestamp(zonedDateTime.toInstant());
+        } else if (externalObject.getClass().isArray()) {
+            return internalize(Arrays.asList((Object[]) externalObject));
         } else {
             // Naively fall through to Logstash's Javafier,
             // which has identity converters for known-safe types

src/test/java/co/elastic/logstash/filters/elasticintegration/IngestDuplexMarshallerTest.java

@@ -365,6 +365,18 @@ void ingestDocToEventIncludingReservedTagsFieldWithListOfStringShape() {
         });
     }
 
+    @Test void ingestDocToEventIncludingArrayType() {
+        final Event input = BasicEventFactory.INSTANCE.newEvent(Map.of("message", "hello, world"));
+        final IngestDocument intermediate = idm.toIngestDocument(input);
+
+        final String[] arrayValueInSource = new String[]{"this", "that"};
+        intermediate.setFieldValue("deeply.nested", arrayValueInSource);
+
+        validateEvent(idm.toLogstashEvent(intermediate), (output) -> {
+            assertThat(output, includesField("[deeply][nested]").withValue(equalTo(List.of("this", "that"))));
+        });
+    }
+
 
     @Test
     void eventToIngestDocFieldWithNestedZonedDateTimeValue() {