Skip to content

Add tags to action request documents #642

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jun 18, 2025
Merged

Add tags to action request documents #642

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
07d93fd
add tags to action req docs
pzl Jun 18, 2025
7f30865
format json
pzl Jun 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions custom_schemas/custom_action_space.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,4 +14,11 @@
short: originating space ID
description: >
The space ID that the action was initiated from
- name: tags
title: Tags
type: keyword
level: custom
short: internal categorization
description: >
Internal category flags for space awareness and future flags

1 change: 1 addition & 0 deletions custom_subsets/elastic_endpoint/actions/actions.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ fields:
space:
fields:
originSpaceId: {}
tags: {}
Comment on lines 31 to +34
Copy link

@paul-tavares paul-tavares Jun 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Whats this space field? Are these being defined as space.originSpaceId and space.tags on the index? If so, that does not line up with what we discussed.

Copy link
Member Author

@pzl pzl Jun 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not a field, just a "category" so it knows where to pull the tags definition from.

tags is a top-level field. you can take a look at the change in sample_event.json to see the end result

Copy link

@paul-tavares paul-tavares Jun 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Got it. Thanks.

rule:
fields:
id: {}
Expand Down
6 changes: 6 additions & 0 deletions package/endpoint/data_stream/actions/fields/fields.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -342,6 +342,12 @@
type: keyword
ignore_above: 1024
description: The space ID that the action was initiated from
- name: tags
level: custom
type: keyword
ignore_above: 1024
description: Internal category flags for space awareness and future flags
default_field: true
- name: user
title: User
group: 2
Expand Down
5 changes: 5 additions & 0 deletions package/endpoint/data_stream/actions/sample_event.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,11 @@
]
},
"originSpaceId": "b88dae77-9037-459b-be31-efefa6788362",
"tags": [
"foo",
"bar",
"oldspace"
],
"@timestamp": "2022-04-04T20:44:07.805Z",
"event": {
"agent_id_status": "auth_metadata_missing",
Expand Down
11 changes: 11 additions & 0 deletions schemas/v1/actions/actions.yaml
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.