[8.x] [Automatic Import] add timestamp to ECS constants (#204931) (#2…

…05216) # Backport This will backport the following commits from `main` to `8.x`: - [[Automatic Import] add timestamp to ECS constants (#204931)](#204931)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)  Co-authored-by: Hanna Tamoudi <[email protected]>
elastic · Dec 27, 2024 · e4ca5b0 · e4ca5b0
1 parent c028120
commit e4ca5b0
Show file tree

Hide file tree

Showing 4 changed files with 51 additions and 1 deletion.
diff --git a/x-pack/platform/plugins/shared/integration_assistant/server/graphs/ecs/constants.ts b/x-pack/platform/plugins/shared/integration_assistant/server/graphs/ecs/constants.ts
@@ -1681,6 +1681,7 @@ export const ECS_TYPES: EcsFields = {
 };
 
 export const ECS_FIELDS: EcsFields = {
+  '@timestamp': 'Date/time when the event originated.',
   'as.number': 'Unique number allocated to the autonomous system.',
   'as.organization.name': 'Organization name of the autonomous system.',
   'client.address': 'Client network address.',

diff --git a/x-pack/platform/plugins/shared/integration_assistant/server/graphs/ecs/prompts.ts b/x-pack/platform/plugins/shared/integration_assistant/server/graphs/ecs/prompts.ts
@@ -37,6 +37,7 @@ Go through each value step by step and modify it with the following process:
 9. When you want to use an ECS field as a value for a target, but another field already has the same ECS field as its target, try to find another fitting ECS field. If none is found then the one you are least confident about should have the object replaced with null.
 10. If you are not confident for a specific field, you should always set the value to null.
 11. These {package_name} log samples are based on source and destination type data, prioritize these compared to other related ECS fields like host.* and observer.*.
+12. Whenever possible, map the @timestamp field to the relevant field that contains the event creation date.
 
 You ALWAYS follow these guidelines when writing your response:
 <guidelines>

diff --git a/x-pack/platform/plugins/shared/integration_assistant/server/graphs/ecs/validate.test.ts b/x-pack/platform/plugins/shared/integration_assistant/server/graphs/ecs/validate.test.ts
@@ -5,12 +5,15 @@
  * 2.0.
  */
 
+import { ecsTestState } from '../../../__jest__/fixtures/ecs_mapping';
 import { ECS_RESERVED } from './constants';
 
+import { EcsMappingState } from '../../types';
 import {
   extractECSMapping,
   findDuplicateFields,
   findInvalidEcsFields,
+  handleValidateMappings,
   removeReservedFields,
 } from './validate';
 
@@ -286,3 +289,48 @@ describe('removeReservedFields', () => {
     expect(ecsMapping).not.toEqual(result);
   });
 });
+
+describe('handleValidateMappings', () => {
+  it('should return empty missing fields if none found', () => {
+    const state: EcsMappingState = ecsTestState;
+    state.currentMapping = {
+      test: {
+        test: {
+          event: { target: 'event.action', confidence: 0.95, type: 'string' },
+        },
+      },
+    };
+    state.combinedSamples = JSON.stringify({
+      test: {
+        test: {
+          event: 'cert.create',
+        },
+      },
+    });
+    const { missingKeys } = handleValidateMappings({ state });
+
+    expect(missingKeys).toEqual([]);
+  });
+
+  it('should return missing fields list if any', () => {
+    const state: EcsMappingState = ecsTestState;
+    state.currentMapping = {
+      test: {
+        test: {
+          event: { target: 'event.action', confidence: 0.95, type: 'string' },
+        },
+      },
+    };
+    state.combinedSamples = JSON.stringify({
+      test: {
+        test: {
+          event: 'cert.create',
+          version: '1',
+        },
+      },
+    });
+    const { missingKeys } = handleValidateMappings({ state });
+
+    expect(missingKeys).toEqual(['test.test.version']);
+  });
+});
diff --git a/x-pack/platform/plugins/shared/integration_assistant/tsconfig.json b/x-pack/platform/plugins/shared/integration_assistant/tsconfig.json
@@ -43,6 +43,6 @@
     "@kbn/kibana-utils-plugin",
     "@kbn/utils",
     "@kbn/zod",
-    "@kbn/tooling-log"
+    "@kbn/tooling-log",
   ]
 }