Adds documentation about a painless script (#98509) (#98554)

## Summary Adds dev documentation about a painless script in our code and when we could remove it. See: elastic/elasticsearch#72276 #78912 Co-authored-by: Frank Hassanabad <[email protected]>
elastic · Apr 27, 2021 · 0480fcc · 0480fcc
1 parent a0e9817
commit 0480fcc
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/...curity_solution/server/search_strategy/security_solution/factory/hosts/details/helpers.ts b/...curity_solution/server/search_strategy/security_solution/factory/hosts/details/helpers.ts
@@ -55,6 +55,11 @@ const getTermsAggregationTypeFromField = (field: string): AggregationRequest =>
       host_ip: {
         terms: {
           script: {
+            // We might be able to remove this when PR is fixed in Elasticsearch: https://github.com/elastic/elasticsearch/issues/72276
+            // Currently we cannot use "value_type" with an aggregation when we have a mapping conflict which is why this painless script exists
+            // See public ticket: https://github.com/elastic/kibana/pull/78912
+            // See private ticket: https://github.com/elastic/security-team/issues/333
+            // for more details on the use cases and causes of the conflicts and why this is here.
             source: "doc['host.ip']",
             lang: 'painless',
           },