diff --git a/package/endpoint/changelog.yml b/package/endpoint/changelog.yml index ecaf5c80e..3b67af41e 100644 --- a/package/endpoint/changelog.yml +++ b/package/endpoint/changelog.yml @@ -3,6 +3,9 @@ - description: TBD type: enhancement link: https://github.com/elastic/endpoint-package/pull/99999 + - description: Split the metadata_united transform into stateful (cross-cluster) and serverless (local) variants gated by _meta.environments + type: enhancement + link: https://github.com/elastic/endpoint-package/pull/750 - version: "9.4.0" changes: - description: automatic troubleshooting endpoint context docs diff --git a/package/endpoint/elasticsearch/transform/metadata_united/default.json b/package/endpoint/elasticsearch/transform/metadata_united/default.json index 38d565a0e..677ee06c7 100644 --- a/package/endpoint/elasticsearch/transform/metadata_united/default.json +++ b/package/endpoint/elasticsearch/transform/metadata_united/default.json @@ -2,6 +2,7 @@ "source": { "index": [ "metrics-endpoint.metadata_current_default*", + "*:metrics-endpoint.metadata_current_default*", ".fleet-agents*" ] }, @@ -36,6 +37,9 @@ }, "description": "Merges latest Endpoint and Agent metadata documents", "_meta": { - "managed": true + "managed": true, + "environments": [ + "stateful" + ] } } \ No newline at end of file diff --git a/package/endpoint/elasticsearch/transform/metadata_united/serverless.json b/package/endpoint/elasticsearch/transform/metadata_united/serverless.json new file mode 100644 index 000000000..131d3fc9d --- /dev/null +++ b/package/endpoint/elasticsearch/transform/metadata_united/serverless.json @@ -0,0 +1,44 @@ +{ + "source": { + "index": [ + "metrics-endpoint.metadata_current_default*", + ".fleet-agents*" + ] + }, + "dest": { + "index": ".metrics-endpoint.metadata_united_default" + }, + "frequency": "1s", + "sync": { + "time": { + "delay": "4s", + "field": "updated_at" + } + }, + "pivot": { + "aggs": { + "united": { + "scripted_metric": { + "init_script": "state.docs = []", + "map_script": "state.docs.add(new HashMap(params['_source']))", + "combine_script": "return state.docs", + "reduce_script": "def ret = new HashMap(); for (s in states) { for (d in s) { if (d.containsKey('Endpoint')) { ret.endpoint = d } else { ret.agent = d } }} return ret" + } + } + }, + "group_by": { + "agent.id": { + "terms": { + "field": "agent.id" + } + } + } + }, + "description": "Merges latest Endpoint and Agent metadata documents", + "_meta": { + "managed": true, + "environments": [ + "serverless" + ] + } +} \ No newline at end of file