Hello,
I would like to propose a change to the mapping of the 'source' field in the blocklist report which is currently mapped to 'extra.source' in IntelMQ to 'extra.source_name'.
This change is necessary to avoid conflicts with the elasticsearch mapping of the 'extra.source' field where it is commonly an object instead of a string.
Reports details can be found here:
https://www.shadowserver.org/what-we-do/network-reporting/blocklist-report/
Regards,
Jason
Hi!
It sounds good to me. To limit the collateral damage, I'd suggest making setting a date for the change in 2-4 weeks to let anyone who use it eventually prepare their mappings.
Best regards
// Kamil Mańkowski mankowski@cert.at - T: +43 676 898 298 7204 // CERT Austria - https://www.cert.at/ // CERT.at GmbH, FB-Nr. 561772k, HG Wien
On 7/15/25 16:58, elsif via IntelMQ-dev wrote:
Hello,
I would like to propose a change to the mapping of the 'source' field in the blocklist report which is currently mapped to 'extra.source' in IntelMQ to 'extra.source_name'.
This change is necessary to avoid conflicts with the elasticsearch mapping of the 'extra.source' field where it is commonly an object instead of a string.
Reports details can be found here:
https://www.shadowserver.org/what-we-do/network-reporting/blocklist-report/
Regards,
Jason
IntelMQ-dev mailing list -- intelmq-dev@lists.cert.at To unsubscribe send an email to intelmq-dev-leave@lists.cert.at
The change will occur on August 4th.
https://github.com/The-Shadowserver-Foundation/report_schema/blob/main/upcom...
Regards,
Jason
On 7/17/25 1:40 AM, Kamil Mankowski via IntelMQ-dev wrote:
Hi!
It sounds good to me. To limit the collateral damage, I'd suggest making setting a date for the change in 2-4 weeks to let anyone who use it eventually prepare their mappings.
Best regards
// Kamil Mańkowski mankowski@cert.at - T: +43 676 898 298 7204 // CERT Austria - https://www.cert.at/ // CERT.at GmbH, FB-Nr. 561772k, HG Wien
On 7/15/25 16:58, elsif via IntelMQ-dev wrote:
Hello,
I would like to propose a change to the mapping of the 'source' field in the blocklist report which is currently mapped to 'extra.source' in IntelMQ to 'extra.source_name'.
This change is necessary to avoid conflicts with the elasticsearch mapping of the 'extra.source' field where it is commonly an object instead of a string.
Reports details can be found here:
https://www.shadowserver.org/what-we-do/network-reporting/blocklist-report/
Regards,
Jason
IntelMQ-dev mailing list -- intelmq-dev@lists.cert.at To unsubscribe send an email to intelmq-dev-leave@lists.cert.at
IntelMQ-dev mailing list -- intelmq-dev@lists.cert.at To unsubscribe send an email to intelmq-dev-leave@lists.cert.at