[chrisberkhout]

Proposed commit message

[o365] Add explicit ECS mapping for file.size

Since 3.8.2 the audit pipeline has delivered file.size as a string, and
because file.size is not covered by the ecs@mappings dynamic templates,
new backing indices mapped it as keyword. That conflicts with earlier
backing indices where it was long, and breaks rules and visualizations
that treat it as a number. Map it explicitly as the ECS long field.

What does this PR do?

Adds file.size to data_stream/audit/fields/ecs.yml so it is always mapped as long, matching ECS.
This will trigger a rollover, which will cause new data to be mapped correctly where dynamic mappings used a string in an earlier backing index.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

cd packages/o365
elastic-package check
elastic-package test pipeline

Related issues

• Closes [o365] Field file.size being mapped as keyword leading to mapping conflict and rules failing #21137

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[efd6]

What is the relationship between this and #21875?

[chrisberkhout]

What is the relationship between this and #21875?

#21875 restores the _source values wherever that makes sense.

New installs will get the correct indexed values after either PR. For existing installs the explicit mapping in this PR will trigger a rollover so that new data is indexed correctly. Even if that wasn't necessary, I'd be inclined to add the explicit mapping since it's the only field that was going wrong when left to fall though to dynamic mappings.

[efd6]

I was wondering why this is not include in that change.

[chrisberkhout]

I was wondering why this is not include in that change.

This one is all that's needed to fix indexed values, so I wanted to get it in quicker and separately from the _source fix, which has a lot more details and choices. The separation is not really important now that they may land at the same time.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[vera-review-bot]

Review summary

Issues found across the latest commits 6952dbd — 1 low

Package-level:

• 🔵 Proposed commit message

  o365: map file.size explicitly as ECS long in audit data stream
  
  Since 3.8.2 the audit pipeline has delivered file.size as a string, and
  because file.size is not covered by the ecs@​mappings dynamic templates,
  new backing indices mapped it as keyword. That conflicts with earlier
  backing indices where it was long, and breaks rules and visualizations
  that treat it as a number. Declare file.size in the audit data stream's
  ecs.yml so it is always mapped as the ECS long field. Installing the
  updated package rolls the data stream over, so new data is mapped
  correctly.
  
  Closes #​21137
  

A new commit triggers another review — at most once every 15 minutes. I skip the PR while it's approved or has merge conflicts.

🤖 AI-Generated Review | Vera Review Bot - v0.4.3 | 📚 Knowledge base: integration-skills

⚠️ Automated review — verify suggestions before applying.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package o365 👍(0) 💚(1) 💔(1)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
audit	1644.74	1367.99	-276.75 (-16.83%)	💔

To see the full report comment with /test benchmark fullreport

[infra-vault-gh-plugin-prod]

💚 Build Succeeded

• Buildkite Build
• Commit: 6952dbd

History

• 💚 Build #51096 succeeded a5e7a0b

cc @chrisberkhout

[mergify]

This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again.

[elastic-vault-github-plugin-prod]

Package o365 - 4.0.1 containing this change is available at https://epr.elastic.co/package/o365/4.0.1/