schema
Inspect Wazuh 5 index schema: list fields and document counts to distinguish mapped fields from populated ones, avoiding empty aggregation results.
Instructions
List the fields of a Wazuh 5 index and how many documents actually fill them.
Use this before writing any aggregation. The Wazuh 5 engine schema defines
2351 fields, and a mapped field is not necessarily a populated one: agent.id
and wazuh.agent.id are both mapped as keyword, but only wazuh.agent.id
ever carries a value. Aggregating on the wrong one returns zero buckets and
HTTP 200 — no error at all. With only_populated=true this tool reports the
document count per field, which makes that distinction visible.
Namespace sizes in the engine schema: wazuh=492, threat=444, process=391, file=144, tls=77, host=57, observer=53, dll=46, user=46, client=35, destination=35, server=35.
Args: index: Index or datastream pattern, e.g. "wazuh-events-v5-network-activity*". prefix: Restrict to a field namespace, e.g. "wazuh." or "source.". Strongly recommended — an unfiltered listing over 2351 fields is capped. only_populated: When true (default), issue a second pass with exists aggregations and return only fields holding a value in at least one document.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| index | Yes | ||
| prefix | No | ||
| only_populated | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |