Mapping of Gigamon Metadata Attributes to ECS fields #14692

apps-elastic-gigamon · 2025-07-25T12:55:07Z

Proposed commit message :

This is an enhancement change for the mapping of Gigamon Metadata Attributes to corresponding ECS fields

Checklist

I have reviewed tips for building integrations and this pull request is aligned with them.
I have verified that all data streams collect metrics or logs.
I have added an entry to my package's changelog.yml file.

Related issues

Supersedes Mapping of Gigamon Metadata Attributes to ECS #14665

elasticmachine · 2025-07-25T16:00:41Z

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

efd6 · 2025-07-27T22:18:28Z

/test

efd6

Please use the PR template. Can you provide a proposed commit message to repair that?

packages/gigamon/changelog.yml

packages/gigamon/data_stream/ami/fields/fields.yml

efd6 · 2025-07-27T22:26:10Z

packages/gigamon/data_stream/ami/fields/fields.yml

 type: keyword
 - name: http_rtt
- type: keyword
+ type: float


This is not OK. Please revert this.

For a recent use case from customer, we need to perform math operation for this attribute. So, changed the data type from keyword to float

Doing this is a breaking change.

@apps-elastic-gigamon, any datatype changes not within the same family, for example: keyword family, is a breaking-change because it leads to mapping conflicts for existing users.

If this is must, you will need to update changelog version as 2.0.0 with type: breaking-change. Example:

integrations/packages/ti_abusech/changelog.yml

Lines 11 to 17 in ed4eea9

- version: "3.0.0"

changes:

- description: |

Auth Key (API Key) is now required for all AbuseCH API requests. Requests without authentication will be denied.

See the official announcement: https://abuse.ch/blog/community-first/

type: breaking-change

link: https://github.com/elastic/integrations/pull/14335

Code changes done as per the comments.

version: "2.0.0"
changes:

description: Update mapping of Gigamon attributes to align with ECS fields
type: breaking-change
link: Mapping of Gigamon Metadata Attributes to ECS fields #14692

efd6 · 2025-07-27T22:26:51Z

packages/gigamon/data_stream/ami/_dev/test/pipeline/test-ami.json

Rather than mutating existing tests, please add new tests that cover the additions here.

Added new JSON records as per the comments

packages/gigamon/data_stream/ami/elasticsearch/ingest_pipeline/default.yml

efd6 · 2025-07-27T22:29:38Z

packages/gigamon/changelog.yml

 # newer versions go on top
+- version: "1.7.0"
+ changes:
+ - description: Mapping of Gigamon Attributes to ECS fields 


This should be a sentence; suggest "Improve mapping of Gigamon attributes to ECS fields."

We are currently mapping the Gigamon attributes with the appropriate ECS fields, rather than making enhancements to the existing mappings.

The current text is not a valid English sentence since it has no verb. Please apply the change or something equivalent. The suggested change adds an appropriate verb since this is an improvement.

Changed the description as per comments

efd6 · 2025-07-27T22:31:13Z

packages/gigamon/data_stream/ami/fields/fields.yml

 type: long
 - name: app_id
- type: long
+ type: keyword


This is unfortunate, but cannot be changed without a breaking change. Please revert this.

We have mapped service.id ECS field to this app_id. Hence the data type has to be changed. Also, in the backend we haven't done any math operations using this app_id

Yes, it's unfortunate that the field was originally defined as a long rather than a keyword as is conventional for an ID field, but changing this from a long to a keyword is a breaking change, so making such a change would require a significant benefit to counter the cost of breaking people.

It does need to be a keyword when it is copied to event.id, but that can either be done as a convert to a string, or just by a copy since numeric values can be mapped as keywords.

Updated the changelog.yml accordingly

I still do not believe this change is justified.

packages/gigamon/data_stream/ami/fields/fields.yml

kcreddy

CI is failing on error: Error: checking package failed: checking readme files are up-to-date failed: files do not match

To fix this CI error, you will need to run elastic-package build and commit the generated docs/README.md.

kcreddy · 2025-07-29T05:11:18Z

/test

packages/gigamon/data_stream/ami/elasticsearch/ingest_pipeline/default.yml

elastic-vault-github-plugin-prod · 2025-07-29T05:35:34Z

🚀 Benchmarks report

Package `gigamon` 👍(0) 💚(0) 💔(1)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
`ami`	4694.84	2890.17	-1804.67 (-38.44%)	💔

To see the full report comment with /test benchmark fullreport

kcreddy · 2025-07-29T06:40:11Z

/test

kcreddy

LGTM, to be merged after @efd6 comments are addressed.

packages/gigamon/changelog.yml

efd6 · 2025-07-29T20:34:43Z

packages/gigamon/changelog.yml

+- version: "2.0.0"
+ changes:
+ - description: Update mapping of Gigamon attributes to align with ECS fields
+ type: breaking-change


I do not believe the balance of benefits/costs supports a breaking change here.

efd6 · 2025-07-29T20:35:27Z

packages/gigamon/data_stream/ami/fields/fields.yml

 type: long
 - name: app_id
- type: long
+ type: keyword


I still do not believe this change is justified.

efd6

Reluctantly

efd6 · 2025-07-29T21:27:53Z

/test

elasticmachine · 2025-07-29T21:49:48Z

💚 Build Succeeded

Buildkite Build
Commit: b5fce01

History

💚 Build #29220 succeeded 349ef32
💚 Build #29213 succeeded e65845c
💔 Build #29115 failed 9adc056

elastic-sonarqube · 2025-07-29T21:49:53Z

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

elastic-vault-github-plugin-prod · 2025-07-29T22:21:48Z

Package gigamon - 2.0.0 containing this change is available at https://epr.elastic.co/package/gigamon/2.0.0/

…#14692) This is an enhancement change for the mapping of Gigamon Metadata Attributes to corresponding ECS fields.

apps-elastic-gigamon requested a review from a team as a code owner July 25, 2025 12:55

apps-elastic-gigamon force-pushed the new branch from 31da13b to 9adc056 Compare July 25, 2025 12:56

andrewkroh added Integration:gigamon Gigamon (Partner supported) Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Jul 25, 2025

efd6 reviewed Jul 27, 2025

View reviewed changes

kcreddy added enhancement New feature or request maintainer:Partner Partner supported integration labels Jul 28, 2025

kcreddy reviewed Jul 28, 2025

View reviewed changes

apps-elastic-gigamon force-pushed the new branch 3 times, most recently from 77c9706 to e65845c Compare July 28, 2025 11:04

andrewkroh added the documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. label Jul 28, 2025

kcreddy reviewed Jul 29, 2025

View reviewed changes

packages/gigamon/data_stream/ami/elasticsearch/ingest_pipeline/default.yml Show resolved Hide resolved

Mapping of Gigamon Metadata Attributes to ECS fields

349ef32

apps-elastic-gigamon force-pushed the new branch from e65845c to 349ef32 Compare July 29, 2025 06:37

kcreddy approved these changes Jul 29, 2025

View reviewed changes

efd6 reviewed Jul 29, 2025

View reviewed changes

fix changelog description

b5fce01

efd6 approved these changes Jul 29, 2025

View reviewed changes

efd6 merged commit a04f128 into elastic:main Jul 29, 2025
9 checks passed

andrewkroh added the breaking change label Aug 7, 2025

andrewkroh added enhancement New feature or request and removed enhancement New feature or request labels Aug 7, 2025

	- version: "3.0.0"
	changes:
	- description: \|
	Auth Key (API Key) is now required for all AbuseCH API requests. Requests without authentication will be denied.
	See the official announcement: https://abuse.ch/blog/community-first/
	type: breaking-change
	link: https://github.com/elastic/integrations/pull/14335

Mapping of Gigamon Metadata Attributes to ECS fields #14692

Mapping of Gigamon Metadata Attributes to ECS fields #14692

Uh oh!

Conversation

apps-elastic-gigamon commented Jul 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Related issues

elasticmachine commented Jul 25, 2025

efd6 commented Jul 27, 2025

efd6 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

apps-elastic-gigamon Jul 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kcreddy Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

apps-elastic-gigamon Jul 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

efd6 Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Uh oh!

kcreddy left a comment

Choose a reason for hiding this comment

kcreddy commented Jul 29, 2025

Uh oh!

elastic-vault-github-plugin-prod bot commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Benchmarks report

Package gigamon 👍(0) 💚(0) 💔(1)

kcreddy commented Jul 29, 2025

kcreddy left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Choose a reason for hiding this comment

efd6 left a comment

Choose a reason for hiding this comment

efd6 commented Jul 29, 2025

elasticmachine commented Jul 29, 2025

💚 Build Succeeded

History

elastic-sonarqube bot commented Jul 29, 2025

Quality Gate passed

Uh oh!

elastic-vault-github-plugin-prod bot commented Jul 29, 2025

Labels

5 participants

apps-elastic-gigamon commented Jul 25, 2025 •

edited

Loading

apps-elastic-gigamon Jul 28, 2025 •

edited

Loading

kcreddy Jul 29, 2025 •

edited

Loading

apps-elastic-gigamon Jul 28, 2025 •

edited

Loading

efd6 Jul 29, 2025 •

edited

Loading

elastic-vault-github-plugin-prod bot commented Jul 29, 2025 •

edited

Loading

Package `gigamon` 👍(0) 💚(0) 💔(1)