Flatten command field types for the jsonpacker #130
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR flattens the field type
command
in the JSON packer and fixes #132.Currently the
dissect.target
project is inconsistent in using the same field namecommand
and the new field typecommand
. This patch makes it possible to upload and aggregate on different records in Elasticsearch with the field namecommand
and differing field types.For example, see
RunKeysPlugin.runkeys
andPowerShellHistoryPlugin.powershell_history
.You could argue (and we agree) that this should be fixed in
dissect.target
as allRecordDescriptor
s currently using("string", "command")
should perhaps use the newcommand
record type. That makes sense to do in the long run. Perhaps a field calledfull
could be added to the standard output of thecommand
fieldtype dict to still be able to index the full, original, command.Historically the
command
field type introduced a backwards incompatible change into dissect. This PR fixes that inconsistency.