From 50f841c96b8e6a9f7db750a9613edf6309b61e3d Mon Sep 17 00:00:00 2001
From: Seth Grover <seth.d.grover@gmail.com>
Date: Mon, 13 Jan 2025 10:39:12 -0700
Subject: [PATCH] work for cisagov/Malcolm#542, preserve custom field
 formatting for index pattern on update of index pattern

---
 dashboards/scripts/shared-object-creation.sh | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/dashboards/scripts/shared-object-creation.sh b/dashboards/scripts/shared-object-creation.sh
index c6b526a40..b694c0eb7 100755
--- a/dashboards/scripts/shared-object-creation.sh
+++ b/dashboards/scripts/shared-object-creation.sh
@@ -266,11 +266,24 @@ if [[ "${CREATE_OS_ARKIME_SESSION_INDEX:-true}" = "true" ]] ; then
           echo "Importing index pattern..."
           [[ "${TEMPLATES_IMPORTED}" == "true" ]] && SHOW_IMPORT_ERROR="--show-error" || SHOW_IMPORT_ERROR=
 
-          # Create index pattern
+          # Save off any custom field formatting prior to an overwrite
+          FIELD_FORMAT_MAP="$( curl "${CURL_CONFIG_PARAMS[@]}" -w "\n" --silent --location --fail -XGET -H "Content-Type: application/json" -H "$XSRF_HEADER: anything" \
+                                 "$DASHB_URL/api/saved_objects/index-pattern/${INDEX_PATTERN}" 2>/dev/null | \
+                                 jq -r '.attributes.fieldFormatMap' 2>/dev/null | \
+                                 jq -c 'with_entries(.value.params.parsedUrl? = null | del(.value.params.parsedUrl))' 2>/dev/null )" || true
+
+          # Create index pattern (preserving custom field formatting)
+          MALCOLM_INDEX_PATTERN_FILE_TEMP="$(mktemp)"
+          echo "{\"attributes\":{\"title\":\"$INDEX_PATTERN\",\"timeFieldName\":\"$INDEX_TIME_FIELD\"}}" > "$MALCOLM_INDEX_PATTERN_FILE_TEMP"
+          if [[ -n "$FIELD_FORMAT_MAP" ]] && [[ "$FIELD_FORMAT_MAP" != "null" ]]; then
+            echo "Preserving existing field formatting..."
+            jq --arg fieldFormatMap "$FIELD_FORMAT_MAP" '.attributes.fieldFormatMap = $fieldFormatMap' "$MALCOLM_INDEX_PATTERN_FILE_TEMP" | sponge "$MALCOLM_INDEX_PATTERN_FILE_TEMP"
+          fi
           echo "Creating index pattern \"$INDEX_PATTERN\"..."
           curl "${CURL_CONFIG_PARAMS[@]}" -w "\n" --location --fail --silent --output /dev/null ${SHOW_IMPORT_ERROR} -XPOST -H "Content-Type: application/json" -H "$XSRF_HEADER: anything" \
             "$DASHB_URL/api/saved_objects/index-pattern/${INDEX_PATTERN}?overwrite=${TEMPLATES_IMPORTED}" \
-            -d"{\"attributes\":{\"title\":\"$INDEX_PATTERN\",\"timeFieldName\":\"$INDEX_TIME_FIELD\"}}" 2>&1 || true
+            -d @"$MALCOLM_INDEX_PATTERN_FILE_TEMP" 2>&1 || true
+          rm -f "$MALCOLM_INDEX_PATTERN_FILE_TEMP"
 
           echo "Setting default index pattern..."