---
setup:
- skip:
    features:
    - "headers"
    - "allowed_warnings_regex"
- requires:
    test_runner_features:
    - "capabilities"
    capabilities:
    - method: "PUT"
      path: "/{index}"
      capabilities:
      - "logsdb_index_mode"
    reason: "Support for 'logsdb' index mode capability required"
---
create logs index:
- do:
    indices.create:
      index: "test"
      body:
        settings:
          index:
            mode: "logsdb"
            number_of_replicas: 0
            number_of_shards: 2
        mappings:
          properties:
            '@timestamp':
              type: "date"
            host.name:
              type: "keyword"
            agent_id:
              type: "keyword"
            process_id:
              type: "integer"
            http_method:
              type: "keyword"
            message:
              type: "text"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- do:
    bulk:
      index: "test"
      refresh: true
      body:
      - index: {}
      - '@timestamp': "2024-02-12T10:30:00Z"
        ignored_field_stats: "foo"
        agent_id: "darth-vader"
        process_id: 101
        http_method: "GET"
        message: "No, I am your father."
      - index: {}
      - '@timestamp': "2024-02-12T10:31:00Z"
        host.name: "bar"
        agent_id: "yoda"
        process_id: 102
        http_method: "PUT"
        message: "Do. Or do not. There is no try."
      - index: {}
      - '@timestamp': "2024-02-12T10:32:00Z"
        host.name: "foo"
        agent_id: "obi-wan"
        process_id: 103
        http_method: "GET"
        message: "May the force be with you."
      - index: {}
      - '@timestamp': "2024-02-12T10:33:00Z"
        host.name: "baz"
        agent_id: "darth-vader"
        process_id: 102
        http_method: "POST"
        message: "I find your lack of faith disturbing."
      - index: {}
      - '@timestamp': "2024-02-12T10:34:00Z"
        host.name: "baz"
        agent_id: "yoda"
        process_id: 104
        http_method: "POST"
        message: "Wars not make one great."
      - index: {}
      - '@timestamp': "2024-02-12T10:35:00Z"
        host.name: "foo"
        agent_id: "obi-wan"
        process_id: 105
        http_method: "GET"
        message: "That's no moon. It's a space station."
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- do:
    search:
      index: "test"
      body:
        query:
          match_all: {}
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    hits.total.value: 6
- do:
    indices.get_settings:
      index: "test"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- is_true: "test"
- match:
    test.settings.index.mode: "logsdb"
---
using default timestamp field mapping:
- do:
    indices.create:
      index: "test-timestamp-missing"
      body:
        settings:
          index:
            mode: "logsdb"
            number_of_replicas: 0
            number_of_shards: 2
        mappings:
          properties:
            host.name:
              type: "keyword"
            agent_id:
              type: "keyword"
            process_id:
              type: "integer"
            http_method:
              type: "keyword"
            message:
              type: "text"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
---
missing hostname field:
- do:
    indices.create:
      index: "test-hostname-missing"
      body:
        settings:
          index:
            mode: "logsdb"
            number_of_replicas: 0
            number_of_shards: 2
        mappings:
          properties:
            '@timestamp':
              type: "date"
            agent_id:
              type: "keyword"
            process_id:
              type: "integer"
            http_method:
              type: "keyword"
            message:
              type: "text"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- do:
    indices.get_settings:
      index: "test-hostname-missing"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- is_true: "test-hostname-missing"
- match:
    test-hostname-missing.settings.index.mode: "logsdb"
---
missing sort field:
- do:
    catch: "bad_request"
    indices.create:
      index: "test-hostname-missing"
      body:
        settings:
          index:
            mode: "logsdb"
            number_of_replicas: 0
            number_of_shards: 2
            sort:
              field:
              - "host_name"
        mappings:
          properties:
            '@timestamp':
              type: "date"
            host.name:
              type: "keyword"
            agent_id:
              type: "keyword"
            process_id:
              type: "integer"
            http_method:
              type: "keyword"
            message:
              type: "text"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    error.root_cause.0.type: "illegal_argument_exception"
- match:
    error.type: "illegal_argument_exception"
- match:
    error.reason: "unknown index sort field:[host_name]"
---
non-default sort settings:
- do:
    indices.create:
      index: "test-sort"
      body:
        settings:
          index:
            mode: "logsdb"
            number_of_shards: 2
            number_of_replicas: 0
            sort:
              field:
              - "agent_id"
              - "@timestamp"
              order:
              - "asc"
              - "desc"
              missing:
              - "_last"
              - "_first"
              mode:
              - "max"
              - "max"
        mappings:
          properties:
            '@timestamp':
              type: "date"
            agent_id:
              type: "keyword"
            process_id:
              type: "integer"
            http_method:
              type: "keyword"
            message:
              type: "text"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- do:
    indices.get_settings:
      index: "test-sort"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- is_true: "test-sort"
- match:
    test-sort.settings.index.mode: "logsdb"
- match:
    test-sort.settings.index.sort.field.0: "agent_id"
- match:
    test-sort.settings.index.sort.field.1: "@timestamp"
- match:
    test-sort.settings.index.sort.order.0: "asc"
- match:
    test-sort.settings.index.sort.order.1: "desc"
- match:
    test-sort.settings.index.sort.missing.0: "_last"
- match:
    test-sort.settings.index.sort.missing.1: "_first"
- match:
    test-sort.settings.index.sort.mode.0: "max"
- match:
    test-sort.settings.index.sort.mode.1: "max"
---
non-default sort settings with presence of nested:
- requires:
    cluster_features:
    - "mapper.nested.sorting_fields_check_fix"
    reason: "Fixed behavior"
- do:
    indices.create:
      index: "test-sort"
      body:
        settings:
          index:
            mode: "logsdb"
            number_of_shards: 2
            number_of_replicas: 0
            sort:
              field:
              - "agent_id"
              - "@timestamp"
              order:
              - "asc"
              - "desc"
        mappings:
          properties:
            '@timestamp':
              type: "date"
            agent_id:
              type: "keyword"
            agent:
              type: "nested"
              properties:
                id:
                  type: "keyword"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- do:
    indices.get_settings:
      index: "test-sort"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- is_true: "test-sort"
- match:
    test-sort.settings.index.mode: "logsdb"
- match:
    test-sort.settings.index.sort.field.0: "agent_id"
- match:
    test-sort.settings.index.sort.field.1: "@timestamp"
- match:
    test-sort.settings.index.sort.order.0: "asc"
- match:
    test-sort.settings.index.sort.order.1: "desc"
---
override sort order settings:
- skip:
    awaits_fix: "we changed the error message"
- requires:
    cluster_features:
    - "index.logsdb_no_host_name_field"
    reason: "Change in default sort config for logsdb"
- do:
    catch: "bad_request"
    indices.create:
      index: "test-sort-order"
      body:
        settings:
          index:
            mode: "logsdb"
            number_of_shards: 2
            number_of_replicas: 0
            sort:
              order:
              - "asc"
              - "asc"
        mappings:
          properties:
            '@timestamp':
              type: "date"
            host.name:
              type: "keyword"
            agent_id:
              type: "keyword"
            process_id:
              type: "integer"
            http_method:
              type: "keyword"
            message:
              type: "text"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    error.type: "illegal_argument_exception"
- match:
    error.reason: "index.sort.fields:[] index.sort.order:[asc, asc], size mismatch"
---
override sort missing settings:
- skip:
    awaits_fix: "we changed the error message"
- requires:
    cluster_features:
    - "index.logsdb_no_host_name_field"
    reason: "Change in default sort config for logsdb"
- do:
    catch: "bad_request"
    indices.create:
      index: "test-sort-missing"
      body:
        settings:
          index:
            mode: "logsdb"
            number_of_shards: 2
            number_of_replicas: 0
            sort:
              missing:
              - "_last"
              - "_first"
        mappings:
          properties:
            '@timestamp':
              type: "date"
            host.name:
              type: "keyword"
            agent_id:
              type: "keyword"
            process_id:
              type: "integer"
            http_method:
              type: "keyword"
            message:
              type: "text"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    error.type: "illegal_argument_exception"
- match:
    error.reason: "index.sort.fields:[] index.sort.missing:[_last, _first], size mismatch"
---
override sort mode settings:
- skip:
    awaits_fix: "we changed the error message"
- requires:
    cluster_features:
    - "index.logsdb_no_host_name_field"
    reason: "Change in default sort config for logsdb"
- do:
    catch: "bad_request"
    indices.create:
      index: "test-sort-mode"
      body:
        settings:
          index:
            mode: "logsdb"
            number_of_shards: 2
            number_of_replicas: 0
            sort:
              mode:
              - "max"
              - "max"
        mappings:
          properties:
            '@timestamp':
              type: "date"
            host.name:
              type: "keyword"
            agent_id:
              type: "keyword"
            process_id:
              type: "integer"
            http_method:
              type: "keyword"
            message:
              type: "text"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    error.type: "illegal_argument_exception"
- match:
    error.reason: "index.sort.fields:[] index.sort.mode:[MAX, MAX], size mismatch"
---
override sort field using nested field type in sorting:
- requires:
    cluster_features:
    - "mapper.index_sorting_on_nested"
    test_runner_features:
    - "capabilities"
    capabilities:
    - method: "PUT"
      path: "/{index}"
      capabilities:
      - "logsdb_index_mode"
    reason: "Support for 'logsdb' index mode capability required"
- do:
    catch: "bad_request"
    indices.create:
      index: "test-nested-sort"
      body:
        settings:
          index:
            mode: "logsdb"
            number_of_replicas: 0
            number_of_shards: 2
            sort:
              field:
              - "host.name"
              - "nested"
              - "@timestamp"
        mappings:
          properties:
            '@timestamp':
              type: "date"
            host.name:
              type: "keyword"
            agent_id:
              type: "keyword"
            process_id:
              type: "integer"
            http_method:
              type: "keyword"
            message:
              type: "text"
            nested:
              type: "nested"
              properties:
                keywords:
                  type: "keyword"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    error.root_cause.0.type: "illegal_argument_exception"
- match:
    error.type: "illegal_argument_exception"
- match:
    error.reason: "cannot apply index sort to field [nested] under nested object [nested]"
---
override sort field using nested field type:
- requires:
    cluster_features:
    - "mapper.index_sorting_on_nested"
    reason: "Support for index sorting on indexes with nested objects required"
- do:
    indices.create:
      index: "test-nested"
      body:
        settings:
          index:
            mode: "logsdb"
            number_of_replicas: 0
            number_of_shards: 2
        mappings:
          properties:
            '@timestamp':
              type: "date"
            host.name:
              type: "keyword"
            agent_id:
              type: "keyword"
            process_id:
              type: "integer"
            http_method:
              type: "keyword"
            message:
              type: "text"
            nested:
              type: "nested"
              properties:
                keywords:
                  type: "keyword"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- is_false: "error"
---
routing path not allowed in logs mode:
- do:
    catch: "bad_request"
    indices.create:
      index: "test"
      body:
        settings:
          index:
            mode: "logsdb"
            number_of_replicas: 0
            number_of_shards: 2
            routing_path:
            - "host.name"
            - "agent_id"
        mappings:
          properties:
            '@timestamp':
              type: "date"
            host.name:
              type: "keyword"
            agent_id:
              type: "keyword"
            process_id:
              type: "integer"
            http_method:
              type: "keyword"
            message:
              type: "text"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    error.root_cause.0.type: "illegal_argument_exception"
- match:
    error.type: "illegal_argument_exception"
- match:
    error.reason: "[index.routing_path] requires [index.mode=time_series]"
---
routing path allowed in logs mode with routing on sort fields:
- skip:
    awaits_fix: "Unknown feature routing.logsb_route_on_sort_fields"
- requires:
    cluster_features:
    - "routing.logsb_route_on_sort_fields"
    reason: "introduction of route on index sorting fields"
- do:
    indices.create:
      index: "test"
      body:
        settings:
          index:
            mode: "logsdb"
            number_of_replicas: 0
            number_of_shards: 2
            routing_path:
            - "host.name"
            - "agent_id"
            logsdb:
              route_on_sort_fields: true
        mappings:
          properties:
            '@timestamp':
              type: "date"
            host.name:
              type: "keyword"
            agent_id:
              type: "keyword"
            process_id:
              type: "integer"
            http_method:
              type: "keyword"
            message:
              type: "text"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- do:
    indices.get_settings:
      index: "test"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- is_true: "test"
- match:
    test.settings.index.mode: "logsdb"
- match:
    test.settings.index.logsdb.route_on_sort_fields: "true"
- match:
    test.settings.index.routing_path:
    - "host.name"
    - "agent_id"
---
start time not allowed in logs mode:
- skip:
    awaits_fix: "we don't validate for index_mode=tsdb when setting start_date/end_date\
      \ anymore"
- do:
    catch: "bad_request"
    indices.create:
      index: "test"
      body:
        settings:
          index:
            mode: "logsdb"
            number_of_replicas: 0
            number_of_shards: 2
            time_series:
              start_time: "2023-01-01T00:00:00Z"
        mappings:
          properties:
            '@timestamp':
              type: "date"
            host.name:
              type: "keyword"
            agent_id:
              type: "keyword"
            process_id:
              type: "integer"
            http_method:
              type: "keyword"
            message:
              type: "text"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    error.root_cause.0.type: "illegal_argument_exception"
- match:
    error.type: "illegal_argument_exception"
- match:
    error.reason: "[index.time_series.start_time] requires [index.mode=time_series]"
---
end time not allowed in logs mode:
- skip:
    awaits_fix: "we don't validate for index_mode=tsdb when setting start_date/end_date\
      \ anymore"
- do:
    catch: "bad_request"
    indices.create:
      index: "test"
      body:
        settings:
          index:
            mode: "logsdb"
            number_of_replicas: 0
            number_of_shards: 2
            time_series:
              end_time: "2023-01-30T00:00:00Z"
        mappings:
          properties:
            '@timestamp':
              type: "date"
            host.name:
              type: "keyword"
            agent_id:
              type: "keyword"
            process_id:
              type: "integer"
            http_method:
              type: "keyword"
            message:
              type: "text"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    error.root_cause.0.type: "illegal_argument_exception"
- match:
    error.type: "illegal_argument_exception"
- match:
    error.reason: "[index.time_series.end_time] requires [index.mode=time_series]"
---
ignore dynamic beyond limit logsdb default value:
- requires:
    cluster_features:
    - "mapper.logsdb_default_ignore_dynamic_beyond_limit"
    reason: "requires logsdb default value for `index.mapping.total_fields.ignore_dynamic_beyond_limit`"
- do:
    indices.create:
      index: "test-ignore-dynamic-default"
      body:
        settings:
          index:
            mode: "logsdb"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- do:
    indices.get_settings:
      index: "test-ignore-dynamic-default"
      include_defaults: true
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    test-ignore-dynamic-default.settings.index.mode: "logsdb"
- match:
    test-ignore-dynamic-default.defaults.index.mapping.total_fields.limit: "1000"
- match:
    test-ignore-dynamic-default.defaults.index.mapping.total_fields.ignore_dynamic_beyond_limit: "true"
---
ignore dynamic beyond limit logsdb override value:
- requires:
    cluster_features:
    - "mapper.logsdb_default_ignore_dynamic_beyond_limit"
    reason: "requires logsdb default value for `index.mapping.total_fields.ignore_dynamic_beyond_limit`"
- do:
    indices.create:
      index: "test-ignore-dynamic-override"
      body:
        settings:
          index:
            mode: "logsdb"
            mapping:
              total_fields:
                ignore_dynamic_beyond_limit: false
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- do:
    indices.get_settings:
      index: "test-ignore-dynamic-override"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    test-ignore-dynamic-override.settings.index.mode: "logsdb"
- match:
    test-ignore-dynamic-override.settings.index.mapping.total_fields.ignore_dynamic_beyond_limit: "false"
---
default ignore dynamic beyond limit and default sorting:
- requires:
    cluster_features:
    - "index.logsdb_no_host_name_field"
    reason: "No host.name field injection"
- do:
    indices.create:
      index: "test-logsdb-default-sort"
      body:
        settings:
          index:
            mode: "logsdb"
            mapping:
              total_fields:
                limit: 2
        mappings:
          properties:
            '@timestamp':
              type: "date"
            name:
              type: "keyword"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- do:
    indices.get_settings:
      index: "test-logsdb-default-sort"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    test-logsdb-default-sort.settings.index.mode: "logsdb"
- do:
    bulk:
      index: "test-logsdb-default-sort"
      refresh: true
      body:
      - "{ \"index\": { } }"
      - "{ \"@timestamp\": \"2024-08-13T12:30:00Z\", \"name\": \"foo\", \"value\"\
        : 10, \"message\": \"the quick brown fox\", \"region\": \"us-west\", \"pid\"\
        : 153462 }"
      - "{ \"index\": { } }"
      - "{ \"@timestamp\": \"2024-08-13T12:01:00Z\", \"name\": \"bar\", \"value\"\
        : 20, \"message\": \"jumps over the lazy dog\", \"region\": \"us-central\"\
        , \"pid\": 674972 }"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    errors: false
- do:
    search:
      index: "test-logsdb-default-sort"
      body:
        query:
          match_all: {}
        sort: "@timestamp"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    hits.total.value: 2
- match:
    hits.hits.0._source.name: "bar"
- match:
    hits.hits.0._source.value: 20
- match:
    hits.hits.0._source.message: "jumps over the lazy dog"
- match:
    hits.hits.0._ignored:
    - "message"
    - "pid"
    - "region"
    - "value"
- match:
    hits.hits.1._source.name: "foo"
- match:
    hits.hits.1._source.value: 10
- match:
    hits.hits.1._source.message: "the quick brown fox"
- match:
    hits.hits.1._ignored:
    - "message"
    - "pid"
    - "region"
    - "value"
---
default ignore dynamic beyond limit and default sorting with hostname:
- requires:
    cluster_features:
    - "index.logsdb_no_host_name_field"
    reason: "No host.name field injection"
- do:
    indices.create:
      index: "test-logsdb-default-sort"
      body:
        settings:
          index:
            mode: "logsdb"
            mapping:
              total_fields:
                limit: 3
        mappings:
          properties:
            '@timestamp':
              type: "date"
            host.name:
              type: "keyword"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- do:
    indices.get_settings:
      index: "test-logsdb-default-sort"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    test-logsdb-default-sort.settings.index.mode: "logsdb"
- do:
    bulk:
      index: "test-logsdb-default-sort"
      refresh: true
      body:
      - "{ \"index\": { } }"
      - "{ \"@timestamp\": \"2024-08-13T12:30:00Z\", \"host.name\": \"foo\", \"value\"\
        : 10, \"message\": \"the quick brown fox\", \"region\": \"us-west\", \"pid\"\
        : 153462 }"
      - "{ \"index\": { } }"
      - "{ \"@timestamp\": \"2024-08-13T12:01:00Z\", \"host.name\": \"bar\", \"value\"\
        : 20, \"message\": \"jumps over the lazy dog\", \"region\": \"us-central\"\
        , \"pid\": 674972 }"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    errors: false
- do:
    search:
      index: "test-logsdb-default-sort"
      body:
        query:
          match_all: {}
        sort: "@timestamp"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    hits.total.value: 2
- match:
    hits.hits.0._source.host.name: "bar"
- match:
    hits.hits.0._source.value: 20
- match:
    hits.hits.0._source.message: "jumps over the lazy dog"
- match:
    hits.hits.0._ignored:
    - "message"
    - "pid"
    - "region"
    - "value"
- match:
    hits.hits.1._source.host.name: "foo"
- match:
    hits.hits.1._source.value: 10
- match:
    hits.hits.1._source.message: "the quick brown fox"
- match:
    hits.hits.1._ignored:
    - "message"
    - "pid"
    - "region"
    - "value"
---
default ignore dynamic beyond limit and non-default sorting:
- requires:
    cluster_features:
    - "index.logsdb_no_host_name_field"
    reason: "No host.name field injection"
- do:
    indices.create:
      index: "test-logsdb-non-default-sort"
      body:
        settings:
          index:
            sort.field:
            - "name"
            sort.order:
            - "desc"
            mode: "logsdb"
            mapping:
              total_fields:
                limit: 2
        mappings:
          properties:
            '@timestamp':
              type: "date"
            name:
              type: "keyword"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- do:
    indices.get_settings:
      index: "test-logsdb-non-default-sort"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    test-logsdb-non-default-sort.settings.index.mode: "logsdb"
- do:
    bulk:
      index: "test-logsdb-non-default-sort"
      refresh: true
      body:
      - "{ \"index\": { } }"
      - "{ \"@timestamp\": \"2024-08-13T12:30:00Z\", \"name\": \"foo\", \"host.name\"\
        : \"92f4a67c\", \"value\": 10, \"message\": \"the quick brown fox\", \"region\"\
        : \"us-west\", \"pid\": 153462 }"
      - "{ \"index\": { } }"
      - "{ \"@timestamp\": \"2024-08-13T12:01:00Z\", \"name\": \"bar\", \"host.name\"\
        : \"24eea278\", \"value\": 20, \"message\": \"jumps over the lazy dog\", \"\
        region\": \"us-central\", \"pid\": 674972 }"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    errors: false
- do:
    search:
      index: "test-logsdb-non-default-sort"
      body:
        query:
          match_all: {}
        sort: "@timestamp"
    headers:
      Content-Type: "application/vnd.elasticsearch+json;compatible-with=8"
      Accept: "application/vnd.elasticsearch+json;compatible-with=8"
    allowed_warnings_regex:
    - "Use of the \\[max_size\\] rollover condition has been deprecated in favour\
      \ of the \\[max_primary_shard_size\\] condition and will be removed in a later\
      \ version"
    - "Parameter \\[confidence_interval\\] in \\[index_options\\] for dense_vector\
      \ field \\[[^\\]]+\\] is deprecated and will be removed in a future version"
- match:
    hits.total.value: 2
- match:
    hits.hits.0._source.name: "bar"
- match:
    hits.hits.0._source.value: 20
- match:
    hits.hits.0._source.message: "jumps over the lazy dog"
- match:
    hits.hits.0._ignored:
    - "host"
    - "message"
    - "pid"
    - "region"
    - "value"
- match:
    hits.hits.1._source.name: "foo"
- match:
    hits.hits.1._source.value: 10
- match:
    hits.hits.1._source.message: "the quick brown fox"
- match:
    hits.hits.1._ignored:
    - "host"
    - "message"
    - "pid"
    - "region"
    - "value"
