This PR introduces a new concept of an _Action Subgroup_ (naming is open for discussion) which can be used by an Alert Type when scheduling actions. An Action Subgroup can be dynamically specified, unlike Action Groups which have to be specified on the AlertType definition. When scheduling actions, and AlertType can specify an _Action Subgroup_ along side the scheduled _Action Group_, which denotes that the alert instance falls into some kind of narrower grouping in the action group. |
||
---|---|---|
.. | ||
mappings.json | ||
README.md | ||
schemas.ts |
The files in this directory were generated by manually running the script ../scripts/create-schemas.js from the root directory of the repository.
These files should not be edited by hand.
Please follow the following steps:
- clone the ECS repo locally so that it resides along side your kibana repo, and checkout the ECS version you wish to support (for example, the
1.6
branch, for version 1.6) - In the
x-pack/plugins/event_log/scripts/mappings.js
file you'll want to make th efollowing changes:- Update
EcsKibanaExtensionsMappings
to include the mapping of the fields you wish to add. - Update
EcsEventLogProperties
to include the fields in the generated mappings.json.
- Update
- cd to the
kibana
root folder and run:node ./x-pack/plugins/event_log/scripts/create_schemas.js