tshark: update man to explain why some fields are skipped in elastic-mapping.
This commit is contained in:
parent
fd92228e54
commit
c2b59567d3
|
@ -468,7 +468,8 @@ Field 4:: base for display (for integer types)
|
||||||
Field 5:: protocol name
|
Field 5:: protocol name
|
||||||
Field 6:: "decode as" support
|
Field 6:: "decode as" support
|
||||||
|
|
||||||
*elastic-mapping* Dumps the ElasticSearch mapping file to stdout.
|
*elastic-mapping* Dumps the ElasticSearch mapping file to stdout. Fields
|
||||||
|
falling in the default case (string) won't be mapped.
|
||||||
|
|
||||||
*fieldcount* Dumps the number of header fields to stdout.
|
*fieldcount* Dumps the number of header fields to stdout.
|
||||||
|
|
||||||
|
|
|
@ -11340,6 +11340,7 @@ proto_registrar_dump_elastic(const gchar* filter)
|
||||||
}
|
}
|
||||||
/* Skip the fields that would map into string. This is the default in elasticsearch. */
|
/* Skip the fields that would map into string. This is the default in elasticsearch. */
|
||||||
type = ws_type_to_elastic(hfinfo->type);
|
type = ws_type_to_elastic(hfinfo->type);
|
||||||
|
/* when type is NULL, we have the default mapping: string */
|
||||||
if (type) {
|
if (type) {
|
||||||
str = ws_strdup_printf("%s_%s", prev_proto, hfinfo->abbrev);
|
str = ws_strdup_printf("%s_%s", prev_proto, hfinfo->abbrev);
|
||||||
dot_to_underscore(str);
|
dot_to_underscore(str);
|
||||||
|
|
Loading…
Reference in New Issue