diff --git a/dashboards/grafana/Grafana-DMARC_Reports.json b/dashboards/grafana/Grafana-DMARC_Reports.json index 0fc90622..88e9e54b 100644 --- a/dashboards/grafana/Grafana-DMARC_Reports.json +++ b/dashboards/grafana/Grafana-DMARC_Reports.json @@ -2681,9 +2681,7 @@ "date_range": "Date", "disposition.keyword": "Disposition", "dkim_aligned": "DKIM", - "dkim_results.domain.keyword": "DKIM Domain", "dkim_results_combined.keyword": "DKIM Auth Result", - "dkim_results.selector.keyword": "DKIM Selector", "envelope_from.keyword": "Envelope From", "header_from.keyword": "Email Domain", "org_name.keyword": "Reporter", @@ -3710,8 +3708,7 @@ "envelope_from.keyword": "Envelope From", "header_from.keyword": "Header From", "source_base_domain.keyword": "Reverse DNS Base", - "spf_aligned": "SPF Aligned", - "spf_results.result.keyword": "SPF Result" + "spf_aligned": "SPF Aligned" } } } diff --git a/tests/test_elastic.py b/tests/test_elastic.py index 2859272c..1740d091 100644 --- a/tests/test_elastic.py +++ b/tests/test_elastic.py @@ -631,11 +631,12 @@ class TestAggregateDocCombinedResults(unittest.TestCase): def test_add_dkim_result_appends_combined_string(self): """Regression guard for issue #169: dkim_results/spf_results are - stored as nested object arrays, which Kibana/Grafana tables cannot - terms-aggregate without producing a cross-product of selector/ - domain/result values. The composed "selector / domain / result" - string preserves per-signature pairing that the object-mapped - array loses.""" + arrays of objects that the engine dynamic-maps as plain ``object`` + (not ``nested``) and flattens, so Kibana/Grafana tables cannot + terms-aggregate their subfields without producing a cross-product + of selector/domain/result values. The composed + "selector / domain / result" string preserves the per-signature + pairing that the flattened array loses.""" doc = elastic_module._AggregateReportDoc() doc.add_dkim_result( domain="example.net", selector="net1", result="fail", human_result=None diff --git a/tests/test_opensearch.py b/tests/test_opensearch.py index ced0170a..1c3e4996 100644 --- a/tests/test_opensearch.py +++ b/tests/test_opensearch.py @@ -684,11 +684,12 @@ class TestAggregateDocCombinedResults(unittest.TestCase): def test_add_dkim_result_appends_combined_string(self): """Regression guard for issue #169: dkim_results/spf_results are - stored as nested object arrays, which Kibana/Grafana tables cannot - terms-aggregate without producing a cross-product of selector/ - domain/result values. The composed "selector / domain / result" - string preserves per-signature pairing that the object-mapped - array loses.""" + arrays of objects that the engine dynamic-maps as plain ``object`` + (not ``nested``) and flattens, so Kibana/Grafana tables cannot + terms-aggregate their subfields without producing a cross-product + of selector/domain/result values. The composed + "selector / domain / result" string preserves the per-signature + pairing that the flattened array loses.""" doc = opensearch_module._AggregateReportDoc() doc.add_dkim_result( domain="example.net", selector="net1", result="fail", human_result=None