55
66package org .opensearch .securityanalytics .mapper ;
77
8- import java .io .IOException ;
9- import java .util .ArrayList ;
10- import java .util .Collection ;
11- import java .util .HashMap ;
12- import java .util .HashSet ;
13- import java .util .List ;
14- import java .util .Map ;
15- import java .util .Optional ;
16- import java .util .Set ;
17- import java .util .stream .Collectors ;
188import org .apache .commons .lang3 .tuple .Pair ;
199import org .apache .logging .log4j .LogManager ;
2010import org .apache .logging .log4j .Logger ;
21- import org .opensearch .OpenSearchStatusException ;
2211import org .opensearch .action .ActionListener ;
2312import org .opensearch .action .admin .indices .get .GetIndexRequest ;
2413import org .opensearch .action .admin .indices .get .GetIndexResponse ;
4433import org .opensearch .securityanalytics .util .IndexUtils ;
4534import org .opensearch .securityanalytics .util .SecurityAnalyticsException ;
4635
36+ import java .io .IOException ;
37+ import java .util .ArrayList ;
38+ import java .util .Collection ;
39+ import java .util .HashMap ;
40+ import java .util .HashSet ;
41+ import java .util .List ;
42+ import java .util .Map ;
43+ import java .util .Optional ;
44+ import java .util .Set ;
45+ import java .util .stream .Collectors ;
4746
4847import static org .opensearch .securityanalytics .mapper .MapperUtils .PATH ;
4948import static org .opensearch .securityanalytics .mapper .MapperUtils .PROPERTIES ;
@@ -78,9 +77,11 @@ public void createMappingAction(String indexName, String logType, String aliasMa
7877 // since you can't update documents in non-write indices
7978 String index = indexName ;
8079 boolean shouldUpsertIndexTemplate = IndexUtils .isConcreteIndex (indexName , this .clusterService .state ()) == false ;
81- if (IndexUtils .isDataStream (indexName , this .clusterService .state ())) {
80+ if (IndexUtils .isDataStream (indexName , this .clusterService .state ()) || IndexUtils .isAlias (indexName , this .clusterService .state ())) {
81+ log .debug ("{} is an alias or datastream. Fetching write index for create mapping action." , indexName );
8282 String writeIndex = IndexUtils .getWriteIndex (indexName , this .clusterService .state ());
8383 if (writeIndex != null ) {
84+ log .debug ("Write index for {} is {}" , indexName , writeIndex );
8485 index = writeIndex ;
8586 }
8687 }
@@ -92,6 +93,7 @@ public void onResponse(GetMappingsResponse getMappingsResponse) {
9293 applyAliasMappings (getMappingsResponse .getMappings (), logType , aliasMappings , partial , new ActionListener <>() {
9394 @ Override
9495 public void onResponse (Collection <CreateMappingResult > createMappingResponse ) {
96+ log .debug ("Completed create mappings for {}" , indexName );
9597 // We will return ack==false if one of the requests returned that
9698 // else return ack==true
9799 Optional <AcknowledgedResponse > notAckd = createMappingResponse .stream ()
@@ -110,6 +112,7 @@ public void onResponse(Collection<CreateMappingResult> createMappingResponse) {
110112
111113 @ Override
112114 public void onFailure (Exception e ) {
115+ log .debug ("Failed to create mappings for {}" , indexName );
113116 actionListener .onFailure (e );
114117 }
115118 });
@@ -478,13 +481,16 @@ public void onResponse(GetMappingsResponse getMappingsResponse) {
478481 String rawPath = requiredField .getRawField ();
479482 String ocsfPath = requiredField .getOcsf ();
480483 if (allFieldsFromIndex .contains (rawPath )) {
481- if (alias != null ) {
482- // Maintain list of found paths in index
483- applyableAliases .add (alias );
484- } else {
485- applyableAliases .add (rawPath );
484+ // if the alias was already added into applyable aliases, then skip to avoid duplicates
485+ if (!applyableAliases .contains (alias ) && !applyableAliases .contains (rawPath )) {
486+ if (alias != null ) {
487+ // Maintain list of found paths in index
488+ applyableAliases .add (alias );
489+ } else {
490+ applyableAliases .add (rawPath );
491+ }
492+ pathsOfApplyableAliases .add (rawPath );
486493 }
487- pathsOfApplyableAliases .add (rawPath );
488494 } else if (allFieldsFromIndex .contains (ocsfPath )) {
489495 applyableAliases .add (alias );
490496 pathsOfApplyableAliases .add (ocsfPath );
@@ -498,13 +504,23 @@ public void onResponse(GetMappingsResponse getMappingsResponse) {
498504 }
499505 }
500506
507+ // turn unmappedFieldAliases into a set to remove duplicates
508+ Set <String > setOfUnmappedFieldAliases = new HashSet <>(unmappedFieldAliases );
509+
510+ // filter out aliases that were included in applyableAliases already
511+ List <String > filteredUnmappedFieldAliases = setOfUnmappedFieldAliases .stream ()
512+ .filter (e -> false == applyableAliases .contains (e ))
513+ .collect (Collectors .toList ());
514+
501515 Map <String , Map <String , String >> aliasMappingFields = new HashMap <>();
502516 XContentBuilder aliasMappingsObj = XContentFactory .jsonBuilder ().startObject ();
503517 for (LogType .Mapping mapping : requiredFields ) {
504518 if (allFieldsFromIndex .contains (mapping .getOcsf ())) {
505519 aliasMappingFields .put (mapping .getEcs (), Map .of ("type" , "alias" , "path" , mapping .getOcsf ()));
506520 } else if (mapping .getEcs () != null ) {
507- aliasMappingFields .put (mapping .getEcs (), Map .of ("type" , "alias" , "path" , mapping .getRawField ()));
521+ shouldUpdateEcsMappingAndMaybeUpdates (mapping , aliasMappingFields , pathsOfApplyableAliases );
522+ } else if (mapping .getEcs () == null ) {
523+ aliasMappingFields .put (mapping .getRawField (), Map .of ("type" , "alias" , "path" , mapping .getRawField ()));
508524 }
509525 }
510526 aliasMappingsObj .field ("properties" , aliasMappingFields );
@@ -519,7 +535,7 @@ public void onResponse(GetMappingsResponse getMappingsResponse) {
519535 .collect (Collectors .toList ());
520536
521537 actionListener .onResponse (
522- new GetMappingsViewResponse (aliasMappings , unmappedIndexFields , unmappedFieldAliases )
538+ new GetMappingsViewResponse (aliasMappings , unmappedIndexFields , filteredUnmappedFieldAliases )
523539 );
524540 } catch (Exception e ) {
525541 actionListener .onFailure (e );
@@ -533,6 +549,26 @@ public void onFailure(Exception e) {
533549 });
534550 }
535551
552+ /**
553+ * Only updates the alias mapping fields if the ecs key has not been mapped yet
554+ * or if pathOfApplyableAliases contains the raw field
555+ *
556+ * @param mapping
557+ * @param aliasMappingFields
558+ * @param pathsOfApplyableAliases
559+ */
560+ private static void shouldUpdateEcsMappingAndMaybeUpdates (LogType .Mapping mapping , Map <String , Map <String , String >> aliasMappingFields , List <String > pathsOfApplyableAliases ) {
561+ // check if aliasMappingFields already contains a key
562+ if (aliasMappingFields .containsKey (mapping .getEcs ())) {
563+ // if the pathOfApplyableAliases contains the raw field, then override the existing map
564+ if (pathsOfApplyableAliases .contains (mapping .getRawField ())) {
565+ aliasMappingFields .put (mapping .getEcs (), Map .of ("type" , "alias" , "path" , mapping .getRawField ()));
566+ }
567+ } else {
568+ aliasMappingFields .put (mapping .getEcs (), Map .of ("type" , "alias" , "path" , mapping .getRawField ()));
569+ }
570+ }
571+
536572 /**
537573 * Given index name, resolves it to single concrete index, depending on what initial <code>indexName</code> is.
538574 * In case of Datastream or Alias, WriteIndex would be returned. In case of index pattern, newest index by creation date would be returned.
0 commit comments