amorfo77/parsedmarc
1
0
Fork 0
mirror of https://github.com/domainaware/parsedmarc.git synced 2026-08-15 03:43:27 +00:00
Code Issues Projects Releases Wiki Activity

Correct the nested-mapping rationale in the create_indexes comments

Browse Source 
The comments claimed Kibana/OSD/Grafana "cannot terms-aggregate fields
inside a nested mapping" — too absolute. Fact-checked empirically and
against primary docs: Kibana/OSD visual editors (Lens and classic
Visualize) do not support nested fields, but Vega panels can run nested
aggregations (they just cannot render tables, per Elastic's docs), and
Grafana >= 9.4 has a nested bucket aggregation (grafana/grafana#62301)
but no reverse_nested, so parent-level metrics like Sum(message_count)
return 0 inside per-signature buckets (reproduced live). Conclusion
unchanged: the dynamic object mapping stays load-bearing for the
shipped dashboards. PR #839's body was updated with the same
correction.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Sean Whalen
2026-07-24 21:40:47 -04:00
co-authored by Claude Fable 5
parent 7320f7e12c
commit 3525eb7b89
2 changed files with 18 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
parsedmarc/elastic.py
+9 -5
View File
@@ -551,11 +551,15 @@ def create_indexes(names: list[str], settings: dict[str, Any] | None = None):
for name in names:
index = Index(name)
try:
# Deliberately no Index.document() registration: Kibana/OpenSearch
# Dashboards/Grafana cannot terms-aggregate fields inside a
# `nested` mapping, so the dynamic `object` mapping produced by a
# bare create is load-bearing for the shipped dashboards. See
# issue #169 and the *_combined fields on _AggregateReportDoc.
# Deliberately no Index.document() registration: the shipped
# dashboards cannot rebuild their detail tables on a `nested`
# mapping — Kibana/OSD visual editors do not support nested
# fields, Vega can run nested aggregations but does not render
# tables, and Grafana's nested bucket aggregation (9.4+) lacks
# reverse_nested for parent-level metrics like message_count —
# so the dynamic `object` mapping produced by a bare create is
# load-bearing for the shipped dashboards. See issue #169 and
# the *_combined fields on _AggregateReportDoc.
if not index.exists():
logger.debug("Creating Elasticsearch index: {0}".format(name))
if effective_settings:
parsedmarc/opensearch.py
+9 -5
View File
@@ -469,11 +469,15 @@ def create_indexes(names: list[str], settings: dict[str, Any] | None = None):
for name in names:
index = Index(name)
try:
# Deliberately no Index.document() registration: Kibana/OpenSearch
# Dashboards/Grafana cannot terms-aggregate fields inside a
# `nested` mapping, so the dynamic `object` mapping produced by a
# bare create is load-bearing for the shipped dashboards. See
# issue #169 and the *_combined fields on _AggregateReportDoc.
# Deliberately no Index.document() registration: the shipped
# dashboards cannot rebuild their detail tables on a `nested`
# mapping — Kibana/OSD visual editors do not support nested
# fields, Vega can run nested aggregations but does not render
# tables, and Grafana's nested bucket aggregation (9.4+) lacks
# reverse_nested for parent-level metrics like message_count —
# so the dynamic `object` mapping produced by a bare create is
# load-bearing for the shipped dashboards. See issue #169 and
# the *_combined fields on _AggregateReportDoc.
if not index.exists():
logger.debug("Creating OpenSearch index: {0}".format(name))
if settings is None: