From 4d5ace2a890aea34d04ec18118c87607e813ebc7 Mon Sep 17 00:00:00 2001
From: reyesj2 <94730068+reyesj2@users.noreply.github.com>
Date: Tue, 24 Feb 2026 14:32:01 -0600
Subject: [PATCH] add file.bytes.missing field mapping

---
 salt/elasticsearch/templates/component/ecs/file.json | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/salt/elasticsearch/templates/component/ecs/file.json b/salt/elasticsearch/templates/component/ecs/file.json
index 3da5ee86a..dfd96c2b5 100644
--- a/salt/elasticsearch/templates/component/ecs/file.json
+++ b/salt/elasticsearch/templates/component/ecs/file.json
@@ -15,6 +15,13 @@
               "ignore_above": 1024,
               "type": "keyword"
             },
+            "bytes": {
+                "properties": {
+                    "missing": {
+                        "type": "long"
+                    }
+                }
+            },
             "code_signature": {
               "properties": {
                 "digest_algorithm": {