feat: Detect type conflicts when adding intermediate fields

[taylor-swanson]

1. What does this PR do?

• When loading schemas, the scripts can now detect situations where either an intermediate field overwrites another field of a different type, or when a leaf field overwrites an intermediate field of a different type.

2. Which ECS fields are affected/introduced?

• Not applicable

3. Why is this change necessary?

• Catches situations where type conflicts will cause an invalid mapping exception to occur in Elasticsearch.

4. Have you added/updated documentation?

• N/A, internal tooling improvement. Exception produced is self-documenting.

ValueError: Type conflict detected when adding intermediate field 'domain' (adding: object, existing: keyword)

ValueError: Type conflict detected when adding leaf field 'domain' (adding: keyword, existing: object)

5. Have you built ECS and committed any newly generated files?

• No changes to schema

6. Have you run the ECS validation tests locally?

• New tests added, all passing.

7. Anything else for the reviewers?

• N/A

---

Commit Message

• When loading schemas, the scripts can now detect situations where either an intermediate field overwrites another field of a different type, or when a leaf field overwrites an intermediate field.

---

Related

• Closes elastic/security-team#17913

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[github-actions]

ECS PR Triage (automated)

PR Triage Report

PR: #2671 — feat: Detect type conflicts when adding intermediate fields
Classification: Direct PR
Change type: Tooling
Scope: Minor

Summary

This PR adds type-conflict detection to the schema loader tooling (scripts/schema/loader.py). When nesting fields, the loader now raises a ValueError if an intermediate field would overwrite an existing field of a different type, or if a leaf field would overwrite an intermediate field of a different type. This is a pure tooling improvement with no schema changes. It routes as a Direct PR per classification-rules section 2 ("Tooling only").

Files changed

• Schemas: none
• Generated: none (not expected — no schema change)
• Tooling/scripts/tests: scripts/schema/loader.py (+7/-1), scripts/tests/unit/test_schema_loader.py (+13/0)
• Docs (hand-authored): none
• CI / GitHub: none
• RFCs: none

Routing decision

All changes are confined to scripts/ (generator tooling and unit tests). No schemas/*.yml files are touched, no new field sets are introduced, and no breaking changes are made to the schema. This matches classification-rules section 2 ("Tooling only") and is appropriate as a Direct PR.

Risk notes

• Breaking / deprecation: No. This adds a new validation check that raises ValueError on type conflicts during schema loading. Existing valid schemas are unaffected. Schemas with latent type conflicts that previously loaded silently will now fail — this is the intended behavior and is a safety improvement, not a breaking change to the schema itself.
• OTel / semconv: N/A — no schema fields added or changed.
• Scope / reuse: N/A — no fieldset, reuse, or categorization changes.

Completeness checklist

• PR description (all sections) — All 7 template sections are filled with substantive answers.
• CHANGELOG.next.md — Entry present under "Tooling and Artifact Changes > Improvements" with #0000. Note: The PR number placeholder #0000 should be updated to #2671 before merge.
• make + committed generated outputs (if schema change) — N/A, no schema change.
• OTel otel: on new/changed semconv-related fields — N/A, no schema fields changed.
• Tests / make check (per CONTRIBUTING) — New unit tests added in test_schema_loader.py covering both conflict directions (intermediate-over-leaf and leaf-over-intermediate). Author states all tests pass.
• CLA (contributor) — Author is taylor-swanson, appears to be an Elastic employee (linked to elastic/security-team issue).

Recommended next actions

1. Contributor: Update CHANGELOG.next.md entry from #0000 to #2671.
2. Maintainer: Verify CI passes (make check, yamllint). Review the edge-case handling in loader.py — specifically the new condition at line 192 (elif 'type' not in field_details) and the leaf-field conflict check at line 206 to confirm they cover all conflict scenarios without false positives on valid schemas.
3. Maintainer: Approve and merge once CI is green and changelog is corrected.

---

Posted by PR Triage workflow

[trisch-me]

so this basically triggers when 'type' in field_details but type is not object?