From 1d3e39b6bd3b412f2b2179f9b50e6d71ee0f8dab Mon Sep 17 00:00:00 2001
From: Wes <wlambertts@gmail.com>
Date: Tue, 18 Jul 2023 14:46:47 +0000
Subject: [PATCH] Map user name to keyword and remove security subfield
 generation

---
 .../templates/component/ecs/user.json         | 26 ++++---------------
 .../component/so/common-dynamic-mappings.json | 12 +--------
 .../component/so/dtc-user-mappings.json       |  9 -------
 3 files changed, 6 insertions(+), 41 deletions(-)

diff --git a/salt/elasticsearch/templates/component/ecs/user.json b/salt/elasticsearch/templates/component/ecs/user.json
index f0fe644d8..8cebf9dd6 100644
--- a/salt/elasticsearch/templates/component/ecs/user.json
+++ b/salt/elasticsearch/templates/component/ecs/user.json
@@ -48,7 +48,11 @@
       "properties": {
         "user": {
           "properties": {
-            "changes": {
+             "name": {
+               "ignore_above": 1024,
+               "type": "keyword"
+             },
+             "changes": {
               "properties": {
                 "domain": {
                   "ignore_above": 1024,
@@ -348,16 +352,6 @@
                 }
               }
             },
-            "name": {
-              "fields": {
-                "security": {
-                  "type": "text",
-                  "analyzer": "es_security_analyzer"
-                }
-              },
-              "ignore_above": 1024,
-              "type": "keyword"
-            },
             "roles": {
               "ignore_above": 1024,
               "type": "keyword",
@@ -454,16 +448,6 @@
                     }
                   }
                 },
-                "name": {
-                  "fields": {
-                    "security": {
-                      "type": "text",
-                      "analyzer": "es_security_analyzer"
-                    }
-                  },
-                  "ignore_above": 1024,
-                  "type": "keyword"
-                },
                 "roles": {
                   "ignore_above": 1024,
                   "type": "keyword",
diff --git a/salt/elasticsearch/templates/component/so/common-dynamic-mappings.json b/salt/elasticsearch/templates/component/so/common-dynamic-mappings.json
index bb072133a..a4713ee20 100644
--- a/salt/elasticsearch/templates/component/so/common-dynamic-mappings.json
+++ b/salt/elasticsearch/templates/component/so/common-dynamic-mappings.json
@@ -75,17 +75,7 @@
         {
           "strings": {
             "mapping": {
-              "type": "text",
-              "fields": {
-                "security": {
-                  "analyzer": "es_security_analyzer",
-                  "type": "text"
-                },
-                "keyword": {
-                  "ignore_above": 32765,
-                  "type": "keyword"
-                }
-              }
+              "type": "keyword"
             },
             "match_mapping_type": "string"
           }
diff --git a/salt/elasticsearch/templates/component/so/dtc-user-mappings.json b/salt/elasticsearch/templates/component/so/dtc-user-mappings.json
index d0162d675..f247e943f 100644
--- a/salt/elasticsearch/templates/component/so/dtc-user-mappings.json
+++ b/salt/elasticsearch/templates/component/so/dtc-user-mappings.json
@@ -49,15 +49,6 @@
         "user": {
           "properties": {
             "name": {
-              "fields": {
-                "security": {
-                  "type": "text",
-                  "analyzer": "es_security_analyzer"
-                },
-                "keyword": {
-                  "type": "keyword"
-                }
-              },
               "ignore_above": 1024,
               "type": "keyword"
             }