OSQuery Manager Integration Mapping IP (`host.ip`) as Keyword

Hi All,

I'm using Fleet with the OSQuery Manager integration for 7.14.0, and I noticed that the data stream it created logs-osquery_manager.result-default is mapping the host.ip field as a keyword. This is causing an issue in Kibana as its causing a mapping conflict within the Kibana Index Pattern logs-*, as host.ip is supposed to be mapped as an IP according to ECS.

Example:

GET /.ds-logs-osquery_manager.result-default-2021.08.25-000001/_mapping/field/host.ip

{
  ".ds-logs-osquery_manager.result-default-2021.08.25-000001" : {
    "mappings" : {
      "host.ip" : {
        "full_name" : "host.ip",
        "mapping" : {
          "ip" : {
            "type" : "keyword",
            "ignore_above" : 1024
          }
        }
      }
    }
  }
}

Would anyone know why this is or how to fix it?

This field seems to being created when a result is returned from a query via OSQuery.

Looking at the index pattern logs-osquery_manager.result, it appears that host.ip isn't mapped, and the dynamic setting only allows mapping everything to keywords:

"dynamic_templates": [
  {
    "strings_as_keyword": {
      "mapping": {
        "ignore_above": 1024,
        "type": "keyword"
      },
      "match_mapping_type": "string"
    }
  }
]

As you pointed out, it is likely missing in the mappings: https://github.com/elastic/integrations/blob/master/packages/osquery_manager/data_stream/result/fields/osquery.yml

@aleksmaus To not have to map all fields, maybe a dynamic mapping that matches *.ip could be used?

Thank you for reporting this issue.
Yes, seems like there are more mappings that need to be defined. We will address that in the next versions of the integration package.

@aleksmaus @ruflin thanks for the information. I've found a few similar issues with some of the other integrations. Is there a better place to report these mapping issues, or should I just open up additional forum topics?

If you see mapping issues, best directly open a github issue in https://github.com/elastic/integrations Thanks for reporting these!

Will do, thanks @ruflin