-
Notifications
You must be signed in to change notification settings - Fork 417
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[RFC] Introduce email
field set - stage 2
#1593
Conversation
Opening PR to capture any feedback or suggestions around the proposed set of |
In regards to
I personally ran with option 2. I was hoping to leverage the
|
a01b7bc
to
aeb8b7e
Compare
Proposed fields now include arrays of objects with both the email address and display name for the
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
As an aside, when this is merged I'd like to use it as an example to update the docs around nested
type, as the difference between email.from
and email.to
illustrates this perfectly
…il.reply_to.address` for consistency with the other `*.address` fields
The limitations around building visualizations using type I'm going to think this over a bit more and iterate on the proposed fields. |
@ebeahan re Regarding visualisation of emails, we'd probably need a Chord or Sankey diagram - a quick look in Kibana Issues does not have those on the radar at this point in time though there is a Sankey example using Vega on the Blog - again this would probably center on There might also be value in running address and display name through ML, that would probably be incompatible with The only use case off the top of my head where we might want @peasead Do you have a specific use case/query/aggs in mind where we'd need to leverage |
@jamiehynds as the sponsor, can you take a look at how the |
FYI, nested was just thought to be a useful way to preserve the relationships between display names and emails. Multi-fields or a normalizer could work too. Ultimately any smart way to not lose the display names in the process since it could be valuable just to be able to see, if nothing else. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
Thanks @wasserman
Looking at one use case that leverages this relationship, e.g. checking for spoofing of a known Conversely, where the relationship between |
While implementing the I'll capture these details fully in the proposal doc during stage 3. |
Summary
Continuing onto Stage 2 with this proposal to introduce the
email.*
field set to the schema.Stage 2 (Candidate) Criteria:
Preview of markdown proposal