From 742649a33797ceb85a111402fb48cd3839d2fcbb Mon Sep 17 00:00:00 2001
From: reyesj2 <94730068+reyesj2@users.noreply.github.com>
Date: Tue, 24 Feb 2026 14:21:28 -0600
Subject: [PATCH] rename kratos file to file.path

---
 salt/elasticsearch/defaults.yaml       | 1 +
 salt/elasticsearch/files/ingest/kratos | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/salt/elasticsearch/defaults.yaml b/salt/elasticsearch/defaults.yaml
index f2245c020..f2fa4d05b 100644
--- a/salt/elasticsearch/defaults.yaml
+++ b/salt/elasticsearch/defaults.yaml
@@ -858,6 +858,7 @@ elasticsearch:
         composed_of:
         - agent-mappings
         - dtc-agent-mappings
+        - file-mappings
         - host-mappings
         - dtc-host-mappings
         - http-mappings
diff --git a/salt/elasticsearch/files/ingest/kratos b/salt/elasticsearch/files/ingest/kratos
index d59f45587..b3410d9fd 100644
--- a/salt/elasticsearch/files/ingest/kratos
+++ b/salt/elasticsearch/files/ingest/kratos
@@ -81,6 +81,14 @@
                 "ignore_missing": true
             }
         },
+        {
+            "rename": {
+                "field": "file",
+                "target_field": "file.path",
+                "ignore_failure": true,
+                "ignore_missing": true
+            }
+        },
         {
             "pipeline": {
                 "name": "common"