The primary_entity field in the ti_recordedfuture.triggered_alert data stream is mapped as keyword in fields.yml, but the Recorded Future v3 alerts API returns it as an object with name, id, and type fields. When this happens, Elasticsearch rejects the document with a document_parsing_exception:
failed to parse field [recordedfuture.triggered_alert.primary_entity] of type [keyword].
Preview of field's value: '{name=Ransomware, id=J0Nl-p, type=MalwareCategory}'
caused_by: illegal_argument_exception: Expected text at 1:10642 but found START_OBJECT
The primary_entity field has the same shape as individual items in the entities array, which is already correctly mapped as a group with id, name, and type subfields. All existing test fixtures use "primary_entity": null, so the object case was never exercised.
Fix
Change primary_entity in fields/fields.yml from type: keyword to a group with id, name, type subfields (all keyword), matching the entities field structure. Add test data with a non-null primary_entity object, for example, {"name": "Ransomware", "id": "J0Nl-p", "type": "MalwareCategory"}.
Versions
- Integration: ti_recordedfuture 2.4.1
- Agent: 9.3.2
The
primary_entityfield in theti_recordedfuture.triggered_alertdata stream is mapped askeywordinfields.yml, but the Recorded Future v3 alerts API returns it as an object withname,id, andtypefields. When this happens, Elasticsearch rejects the document with adocument_parsing_exception:The
primary_entityfield has the same shape as individual items in theentitiesarray, which is already correctly mapped as a group withid,name, andtypesubfields. All existing test fixtures use"primary_entity": null, so the object case was never exercised.Fix
Change
primary_entityinfields/fields.ymlfromtype: keywordto a group withid,name,typesubfields (all keyword), matching theentitiesfield structure. Add test data with a non-nullprimary_entityobject, for example,{"name": "Ransomware", "id": "J0Nl-p", "type": "MalwareCategory"}.Versions