[EPM] handle multi fields when creating index patterns

x-pack/legacy/plugins/epm/server/lib/fields/field.ts

@@ -19,6 +19,7 @@ export interface Field {
   required?: boolean;
   description?: string;
   fields?: Fields;
+  multi_fields?: Fields;
   searchable?: boolean;
   aggregatable?: boolean;
   doc_values?: boolean;

x-pack/legacy/plugins/epm/server/lib/kibana/index_pattern/install.ts

@@ -110,29 +110,28 @@ export const dedupeFields = (fields: Fields) => {
  */
 export const findFieldByPath = (allFields: Fields, path: string): Field | undefined => {
   const pathParts = path.split('.');
-  const getField = (fields: Fields, pathNames: string[]): Field | undefined => {
-    if (!pathNames.length) return undefined;
-    // get the first rest of path names
-    const [name, ...restPathNames] = pathNames;
-    for (const field of fields) {
-      if (field.name === name) {
-        // check field's fields, passing in the remaining path names
-        if (field.fields && field.fields.length > 0) {
-          return getField(field.fields, restPathNames);
-        }
-        // no nested fields to search, but still more names - not found
-        if (restPathNames.length) {
-          return undefined;
-        }
-        return field;
-      }
-    }
-    return undefined;
-  };
-
   return getField(allFields, pathParts);
 };
 
+const getField = (fields: Fields, pathNames: string[]): Field | undefined => {
+  if (!pathNames.length) return undefined;
+  // get the first rest of path names
+  const [name, ...restPathNames] = pathNames;
+  for (const field of fields) {
+    if (field.name === name) {
+      // check field's fields, passing in the remaining path names
+      if (field.fields && field.fields.length > 0) {
+        return getField(field.fields, restPathNames);
+      }
+      // no nested fields to search, but still more names - not found
+      if (restPathNames.length) {
+        return undefined;
+      }
+      return field;
+    }
+  }
+  return undefined;
+};
 // check for alias type and copy contents of the aliased field
 export const transformField = (field: Field, i: number, fields: Fields): IndexPatternField => {
   const newField: IndexPatternField = {
@@ -201,16 +200,11 @@ export const transformField = (field: Field, i: number, fields: Fields): IndexPa
 export const flattenFields = (allFields: Fields): Fields => {
   const flatten = (fields: Fields): Fields =>
     fields.reduce<Field[]>((acc, field) => {
-      if (field.fields?.length) {
-        const flattenedFields = flatten(field.fields);
-        flattenedFields.forEach(nestedField => {
-          acc.push({
-            ...nestedField,
-            name: `${field.name}.${nestedField.name}`,
-          });
-        });
+      if (field.type === 'group' && field.fields?.length) {
+        // look for nested fields
+        acc = renameAndFlatten(field, field.fields, [...acc]);
       } else {
-        // handle alias type fields - TODO: this should probably go somewhere else
+        // handle alias type fields
         if (field.type === 'alias' && field.path) {
           const foundField = findFieldByPath(allFields, field.path);
           // if aliased leaf field is found copy its props over except path and name
@@ -219,10 +213,29 @@ export const flattenFields = (allFields: Fields): Fields => {
             field = { ...foundField, path, name };
           }
         }
+        // add field before going through multi_fields
         acc.push(field);
+
+        // for each field in multi_field add new field
+        if (field.multi_fields?.length) {
+          acc = renameAndFlatten(field, field.multi_fields, [...acc]);
+        }
       }
       return acc;
     }, []);
+
+  // helper function to call flatten() and rename the fields
+  const renameAndFlatten = (field: Field, fields: Fields, acc: Fields): Fields => {
+    const flattenedFields = flatten(fields);
+    flattenedFields.forEach(nestedField => {
+      acc.push({
+        ...nestedField,
+        name: `${field.name}.${nestedField.name}`,
+      });
+    });
+    return acc;
+  };
+
   return flatten(allFields);
 };
 

x-pack/legacy/plugins/epm/server/lib/kibana/index_pattern/tests/nginx.fields.yml

@@ -102,4 +102,11 @@
       type: group
       fields:
         - name: continent_name
-          type: text
+          type: text
+- name: country
+  type: ""
+  multi_fields: 
+    - name: keyword
+      type: keyword
+    - name: text
+      type: text