Issue with Creating Transforms about fortinet-2-elasticsearch HOT 4 CLOSED

Looks like on your ds-logs-fortinet.fortigate.traffic-default-2023.11.10-000034 index, fgt.srchwvendor field has been created as text mapping, not keyword.

Make sure you are using [email protected] as part of your index template.

from fortinet-2-elasticsearch.

Hello @enotspe , Thank you very much. I have managed to add [email protected] as a component of the Index Template and that worked.

It has prompted me to revise all the Index Templates to look for missing components as we are getting strange errors in the dashboards.

So far I have found quite few few component templates missing from their respective index templates. I have tried to add them again via the GUI but I am getting weird errors for it.

One's missing thus far are:

"ecs-vulnerability",
"auto_expand_replicas@settings",
"refresh_interval@settings"
"ecs-log-modified",
"ecs-event-modified",
"ecs-file-modified",
"synthetic_source@mappings"
"ecs-network-transforms",
"ecs-source-transforms",
"ecs-event-transforms",
"transforms-fortinet.fortigate@mappings",
"ecs-rule-transforms",

from fortinet-2-elasticsearch.

I have managed to re-add all component templates and add the relevant component templates to each index template. I did this by simply re running the Put Index template commands and saw no error about missing components. The only thing I have left out is the Auto_Expand Replica component as I am running it on a single node and replica's make the index state yellow.

When I now look at the transforms dashboards such as Sessions Traffic [Fortigate] [Transforms] I get error's in the data fields saying that the field is missing e.g. Field @timestamp was not found.

I made sure that I do have the transform loded in te ingest pipelines and they are all there.
E.g. [transforms-fortinet.fortigate.traffic.private2private]

Not quite sure what the issue may be now, do these transforms require replica's ?

from fortinet-2-elasticsearch.

I am sorry I could not answer you on time. I am working on an script that will make easier to install all components

from fortinet-2-elasticsearch.