From 7ba6017eefebcdba6695111b6d88bb7f4ab932ba Mon Sep 17 00:00:00 2001
From: Marcin Tojek <mtojek@users.noreply.github.com>
Date: Fri, 30 Jul 2021 13:17:44 +0200
Subject: [PATCH] Escape special characters in docs (#451)

* Escape wildcard characters in docs

* Use escaper

* More characters to escape
---
 internal/docs/exported_fields.go         |  7 ++++++-
 test/packages/aws/docs/billing.md        |  6 +++---
 test/packages/aws/docs/cloudwatch.md     |  6 +++---
 test/packages/aws/docs/dynamodb.md       |  6 +++---
 test/packages/aws/docs/ebs.md            |  6 +++---
 test/packages/aws/docs/ec2.md            |  6 +++---
 test/packages/aws/docs/elb.md            |  6 +++---
 test/packages/aws/docs/lambda.md         |  6 +++---
 test/packages/aws/docs/natgateway.md     |  6 +++---
 test/packages/aws/docs/rds.md            |  6 +++---
 test/packages/aws/docs/s3.md             | 12 ++++++------
 test/packages/aws/docs/sns.md            |  6 +++---
 test/packages/aws/docs/sqs.md            |  6 +++---
 test/packages/aws/docs/transitgateway.md |  6 +++---
 test/packages/aws/docs/usage.md          |  6 +++---
 test/packages/aws/docs/vpn.md            |  6 +++---
 16 files changed, 54 insertions(+), 49 deletions(-)

diff --git a/internal/docs/exported_fields.go b/internal/docs/exported_fields.go
index 88e153add..6ad4777ab 100644
--- a/internal/docs/exported_fields.go
+++ b/internal/docs/exported_fields.go
@@ -23,6 +23,8 @@ type fieldsTableRecord struct {
 	metricType  string
 }
 
+var escaper = strings.NewReplacer("*", "\\*", "{", "\\{", "}", "\\}", "<", "\\<", ">", "\\>")
+
 func renderExportedFields(packageRoot, dataStreamName string) (string, error) {
 	dataStreamPath := filepath.Join(packageRoot, "data_stream", dataStreamName)
 	validator, err := fields.CreateValidatorForDataStream(dataStreamPath)
@@ -70,7 +72,10 @@ func renderFieldsTable(builder *strings.Builder, collected []fieldsTableRecord)
 	builder.WriteString("\n")
 	for _, c := range collected {
 		description := strings.TrimSpace(strings.ReplaceAll(c.description, "\n", " "))
-		builder.WriteString(fmt.Sprintf("| %s | %s | %s |", c.name, description, c.aType))
+		builder.WriteString(fmt.Sprintf("| %s | %s | %s |",
+			escaper.Replace(c.name),
+			escaper.Replace(description),
+			c.aType))
 		if unitsPresent {
 			builder.WriteString(fmt.Sprintf(" %s |", c.unit))
 		}
diff --git a/test/packages/aws/docs/billing.md b/test/packages/aws/docs/billing.md
index 4b5be8e76..ec22eaf70 100644
--- a/test/packages/aws/docs/billing.md
+++ b/test/packages/aws/docs/billing.md
@@ -60,7 +60,7 @@ An example event for `billing` looks as following:
 | Field | Description | Type |
 |---|---|---|
 | @timestamp | Event timestamp. | date |
-| aws.*.metrics.*.* | Metrics that returned from Cloudwatch API query. | object |
+| aws.\*.metrics.\*.\* | Metrics that returned from Cloudwatch API query. | object |
 | aws.billing.AmortizedCost.amount | Amortized cost amount. | double |
 | aws.billing.AmortizedCost.unit | Amortized cost unit. | keyword |
 | aws.billing.BlendedCost.amount | Blended cost amount. | double |
@@ -80,9 +80,9 @@ An example event for `billing` looks as following:
 | aws.billing.group_definition.type | The string that represents the type of group. | keyword |
 | aws.billing.start_date | Start date for retrieving AWS costs. | keyword |
 | aws.cloudwatch.namespace | The namespace specified when query cloudwatch api. | keyword |
-| aws.dimensions.* | Metric dimensions. | object |
+| aws.dimensions.\* | Metric dimensions. | object |
 | aws.s3.bucket.name | Name of a S3 bucket. | keyword |
-| aws.tags.* | Tag key value pairs from aws resources. | object |
+| aws.tags.\* | Tag key value pairs from aws resources. | object |
 | cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
 | cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword |
 | cloud.availability_zone | Availability zone in which this host is running. | keyword |
diff --git a/test/packages/aws/docs/cloudwatch.md b/test/packages/aws/docs/cloudwatch.md
index ebaf40276..8e43e471d 100644
--- a/test/packages/aws/docs/cloudwatch.md
+++ b/test/packages/aws/docs/cloudwatch.md
@@ -112,11 +112,11 @@ An example event for `cloudwatch` looks as following:
 | Field | Description | Type |
 |---|---|---|
 | @timestamp | Event timestamp. | date |
-| aws.*.metrics.*.* | Metrics that returned from Cloudwatch API query. | object |
+| aws.\*.metrics.\*.\* | Metrics that returned from Cloudwatch API query. | object |
 | aws.cloudwatch.namespace | The namespace specified when query cloudwatch api. | keyword |
-| aws.dimensions.* | Metric dimensions. | object |
+| aws.dimensions.\* | Metric dimensions. | object |
 | aws.s3.bucket.name | Name of a S3 bucket. | keyword |
-| aws.tags.* | Tag key value pairs from aws resources. | object |
+| aws.tags.\* | Tag key value pairs from aws resources. | object |
 | cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
 | cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword |
 | cloud.availability_zone | Availability zone in which this host is running. | keyword |
diff --git a/test/packages/aws/docs/dynamodb.md b/test/packages/aws/docs/dynamodb.md
index fdc6ee451..42fc2b596 100644
--- a/test/packages/aws/docs/dynamodb.md
+++ b/test/packages/aws/docs/dynamodb.md
@@ -71,9 +71,9 @@ An example event for `dynamodb` looks as following:
 | Field | Description | Type |
 |---|---|---|
 | @timestamp | Event timestamp. | date |
-| aws.*.metrics.*.* | Metrics that returned from Cloudwatch API query. | object |
+| aws.\*.metrics.\*.\* | Metrics that returned from Cloudwatch API query. | object |
 | aws.cloudwatch.namespace | The namespace specified when query cloudwatch api. | keyword |
-| aws.dimensions.* | Metric dimensions. | object |
+| aws.dimensions.\* | Metric dimensions. | object |
 | aws.dynamodb.metrics.AccountMaxReads.max | The maximum number of read capacity units that can be used by an account. This limit does not apply to on-demand tables or global secondary indexes. | long |
 | aws.dynamodb.metrics.AccountMaxTableLevelReads.max | The maximum number of read capacity units that can be used by a table or global secondary index of an account. For on-demand tables this limit caps the maximum read request units a table or a global secondary index can use. | long |
 | aws.dynamodb.metrics.AccountMaxTableLevelWrites.max | The maximum number of write capacity units that can be used by a table or global secondary index of an account. For on-demand tables this limit caps the maximum write request units a table or a global secondary index can use. | long |
@@ -102,7 +102,7 @@ An example event for `dynamodb` looks as following:
 | aws.dynamodb.metrics.TransactionConflict.sum |  | long |
 | aws.dynamodb.metrics.WriteThrottleEvents.sum | Requests to DynamoDB that exceed the provisioned write capacity units for a table or a global secondary index. | long |
 | aws.s3.bucket.name | Name of a S3 bucket. | keyword |
-| aws.tags.* | Tag key value pairs from aws resources. | object |
+| aws.tags.\* | Tag key value pairs from aws resources. | object |
 | cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
 | cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword |
 | cloud.availability_zone | Availability zone in which this host is running. | keyword |
diff --git a/test/packages/aws/docs/ebs.md b/test/packages/aws/docs/ebs.md
index 5b516309b..e4529dffc 100644
--- a/test/packages/aws/docs/ebs.md
+++ b/test/packages/aws/docs/ebs.md
@@ -78,9 +78,9 @@ An example event for `ebs` looks as following:
 | Field | Description | Type |
 |---|---|---|
 | @timestamp | Event timestamp. | date |
-| aws.*.metrics.*.* | Metrics that returned from Cloudwatch API query. | object |
+| aws.\*.metrics.\*.\* | Metrics that returned from Cloudwatch API query. | object |
 | aws.cloudwatch.namespace | The namespace specified when query cloudwatch api. | keyword |
-| aws.dimensions.* | Metric dimensions. | object |
+| aws.dimensions.\* | Metric dimensions. | object |
 | aws.dimensions.VolumeId | Amazon EBS volume ID | keyword |
 | aws.ebs.metrics.BurstBalance.avg | Used with General Purpose SSD (gp2), Throughput Optimized HDD (st1), and Cold HDD (sc1) volumes only. Provides information about the percentage of I/O credits (for gp2) or throughput credits (for st1 and sc1) remaining in the burst bucket. | double |
 | aws.ebs.metrics.VolumeConsumedReadWriteOps.avg | The total amount of read and write operations (normalized to 256K capacity units) consumed in a specified period of time. Used with Provisioned IOPS SSD volumes only. | double |
@@ -94,7 +94,7 @@ An example event for `ebs` looks as following:
 | aws.ebs.metrics.VolumeWriteBytes.avg | Average size of each write operation during the period, except on volumes attached to a Nitro-based instance, where the average represents the average over the specified period. | double |
 | aws.ebs.metrics.VolumeWriteOps.avg | The total number of write operations in a specified period of time. | double |
 | aws.s3.bucket.name | Name of a S3 bucket. | keyword |
-| aws.tags.* | Tag key value pairs from aws resources. | object |
+| aws.tags.\* | Tag key value pairs from aws resources. | object |
 | cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
 | cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword |
 | cloud.availability_zone | Availability zone in which this host is running. | keyword |
diff --git a/test/packages/aws/docs/ec2.md b/test/packages/aws/docs/ec2.md
index 67a07af30..56e688b5d 100644
--- a/test/packages/aws/docs/ec2.md
+++ b/test/packages/aws/docs/ec2.md
@@ -170,9 +170,9 @@ An example event for `ec2` looks as following:
 | Field | Description | Type |
 |---|---|---|
 | @timestamp | Event timestamp. | date |
-| aws.*.metrics.*.* | Metrics that returned from Cloudwatch API query. | object |
+| aws.\*.metrics.\*.\* | Metrics that returned from Cloudwatch API query. | object |
 | aws.cloudwatch.namespace | The namespace specified when query cloudwatch api. | keyword |
-| aws.dimensions.* | Metric dimensions. | object |
+| aws.dimensions.\* | Metric dimensions. | object |
 | aws.dimensions.AutoScalingGroupName | An Auto Scaling group is a collection of instances you define if you're using Auto Scaling. | keyword |
 | aws.dimensions.ImageId | This dimension filters the data you request for all instances running this Amazon EC2 Amazon Machine Image (AMI) | keyword |
 | aws.dimensions.InstanceId | Amazon EC2 instance ID | keyword |
@@ -212,7 +212,7 @@ An example event for `ec2` looks as following:
 | aws.ec2.status.check_failed_instance | Reports whether the instance has passed the instance status check in the last minute. | long |
 | aws.ec2.status.check_failed_system | Reports whether the instance has passed the system status check in the last minute. | long |
 | aws.s3.bucket.name | Name of a S3 bucket. | keyword |
-| aws.tags.* | Tag key value pairs from aws resources. | object |
+| aws.tags.\* | Tag key value pairs from aws resources. | object |
 | cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
 | cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword |
 | cloud.availability_zone | Availability zone in which this host is running. | keyword |
diff --git a/test/packages/aws/docs/elb.md b/test/packages/aws/docs/elb.md
index 57c41b0b8..5638b1e77 100644
--- a/test/packages/aws/docs/elb.md
+++ b/test/packages/aws/docs/elb.md
@@ -181,7 +181,7 @@ An example event for `elb` looks as following:
 | Field | Description | Type |
 |---|---|---|
 | @timestamp | Event timestamp. | date |
-| aws.*.metrics.*.* | Metrics that returned from Cloudwatch API query. | object |
+| aws.\*.metrics.\*.\* | Metrics that returned from Cloudwatch API query. | object |
 | aws.applicationelb.metrics.ActiveConnectionCount.sum | The total number of concurrent TCP connections active from clients to the load balancer and from the load balancer to targets. | long |
 | aws.applicationelb.metrics.ClientTLSNegotiationErrorCount.sum | The number of TLS connections initiated by the client that did not establish a session with the load balancer due to a TLS error. | long |
 | aws.applicationelb.metrics.ConsumedLCUs.avg | The number of load balancer capacity units (LCU) used by your load balancer. | double |
@@ -203,7 +203,7 @@ An example event for `elb` looks as following:
 | aws.applicationelb.metrics.RequestCount.sum | The number of requests processed over IPv4 and IPv6. | long |
 | aws.applicationelb.metrics.RuleEvaluations.sum | The number of rules processed by the load balancer given a request rate averaged over an hour. | long |
 | aws.cloudwatch.namespace | The namespace specified when query cloudwatch api. | keyword |
-| aws.dimensions.* | Metric dimensions. | object |
+| aws.dimensions.\* | Metric dimensions. | object |
 | aws.dimensions.AvailabilityZone | Filters the metric data by the specified Availability Zone. | keyword |
 | aws.dimensions.LoadBalancer | Filters the metric data by load balancer. | keyword |
 | aws.dimensions.LoadBalancerName | Filters the metric data by the specified load balancer. | keyword |
@@ -242,7 +242,7 @@ An example event for `elb` looks as following:
 | aws.networkelb.metrics.TargetTLSNegotiationErrorCount.sum | The total number of TLS handshakes that failed during negotiation between a TLS listener and a target. | long |
 | aws.networkelb.metrics.UnHealthyHostCount.max | The number of targets that are considered unhealthy. | long |
 | aws.s3.bucket.name | Name of a S3 bucket. | keyword |
-| aws.tags.* | Tag key value pairs from aws resources. | object |
+| aws.tags.\* | Tag key value pairs from aws resources. | object |
 | cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
 | cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword |
 | cloud.availability_zone | Availability zone in which this host is running. | keyword |
diff --git a/test/packages/aws/docs/lambda.md b/test/packages/aws/docs/lambda.md
index f949745cb..8bbb73075 100644
--- a/test/packages/aws/docs/lambda.md
+++ b/test/packages/aws/docs/lambda.md
@@ -70,9 +70,9 @@ An example event for `lambda` looks as following:
 | Field | Description | Type |
 |---|---|---|
 | @timestamp | Event timestamp. | date |
-| aws.*.metrics.*.* | Metrics that returned from Cloudwatch API query. | object |
+| aws.\*.metrics.\*.\* | Metrics that returned from Cloudwatch API query. | object |
 | aws.cloudwatch.namespace | The namespace specified when query cloudwatch api. | keyword |
-| aws.dimensions.* | Metric dimensions. | object |
+| aws.dimensions.\* | Metric dimensions. | object |
 | aws.dimensions.ExecutedVersion | Use the ExecutedVersion dimension to compare error rates for two versions of a function that are both targets of a weighted alias. | keyword |
 | aws.dimensions.FunctionName | Lambda function name. | keyword |
 | aws.dimensions.Resource | Resource name. | keyword |
@@ -90,7 +90,7 @@ An example event for `lambda` looks as following:
 | aws.lambda.metrics.Throttles.avg | The number of invocation requests that are throttled. | double |
 | aws.lambda.metrics.UnreservedConcurrentExecutions.avg | For an AWS Region, the number of events that are being processed by functions that don't have reserved concurrency. | double |
 | aws.s3.bucket.name | Name of a S3 bucket. | keyword |
-| aws.tags.* | Tag key value pairs from aws resources. | object |
+| aws.tags.\* | Tag key value pairs from aws resources. | object |
 | cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
 | cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword |
 | cloud.availability_zone | Availability zone in which this host is running. | keyword |
diff --git a/test/packages/aws/docs/natgateway.md b/test/packages/aws/docs/natgateway.md
index 69445ec4f..b88d7108f 100644
--- a/test/packages/aws/docs/natgateway.md
+++ b/test/packages/aws/docs/natgateway.md
@@ -96,9 +96,9 @@ An example event for `natgateway` looks as following:
 | Field | Description | Type |
 |---|---|---|
 | @timestamp | Event timestamp. | date |
-| aws.*.metrics.*.* | Metrics that returned from Cloudwatch API query. | object |
+| aws.\*.metrics.\*.\* | Metrics that returned from Cloudwatch API query. | object |
 | aws.cloudwatch.namespace | The namespace specified when query cloudwatch api. | keyword |
-| aws.dimensions.* | Metric dimensions. | object |
+| aws.dimensions.\* | Metric dimensions. | object |
 | aws.dimensions.NatGatewayId | Filter the metric data by the NAT gateway ID. | keyword |
 | aws.natgateway.metrics.ActiveConnectionCount.max | The total number of concurrent active TCP connections through the NAT gateway. | long |
 | aws.natgateway.metrics.BytesInFromDestination.sum | The number of bytes received by the NAT gateway from the destination. | long |
@@ -115,7 +115,7 @@ An example event for `natgateway` looks as following:
 | aws.natgateway.metrics.PacketsOutToDestination.sum | The number of packets sent out through the NAT gateway to the destination. | long |
 | aws.natgateway.metrics.PacketsOutToSource.sum | The number of packets sent through the NAT gateway to the clients in your VPC. | long |
 | aws.s3.bucket.name | Name of a S3 bucket. | keyword |
-| aws.tags.* | Tag key value pairs from aws resources. | object |
+| aws.tags.\* | Tag key value pairs from aws resources. | object |
 | cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
 | cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword |
 | cloud.availability_zone | Availability zone in which this host is running. | keyword |
diff --git a/test/packages/aws/docs/rds.md b/test/packages/aws/docs/rds.md
index 79a17adf5..4ac41d328 100644
--- a/test/packages/aws/docs/rds.md
+++ b/test/packages/aws/docs/rds.md
@@ -101,8 +101,8 @@ An example event for `rds` looks as following:
 | Field | Description | Type |
 |---|---|---|
 | @timestamp | Event timestamp. | date |
-| aws.*.metrics.*.* | Metrics that returned from Cloudwatch API query. | object |
-| aws.dimensions.* | Metric dimensions. | object |
+| aws.\*.metrics.\*.\* | Metrics that returned from Cloudwatch API query. | object |
+| aws.dimensions.\* | Metric dimensions. | object |
 | aws.dimensions.DBClusterIdentifier | This dimension filters the data that you request for a specific Amazon Aurora DB cluster. | keyword |
 | aws.dimensions.DBClusterIdentifier,Role | This dimension filters the data that you request for a specific Aurora DB cluster, aggregating the metric by instance role (WRITER/READER). | keyword |
 | aws.dimensions.DBInstanceIdentifier | This dimension filters the data that you request for a specific DB instance. | keyword |
@@ -185,7 +185,7 @@ An example event for `rds` looks as following:
 | aws.rds.volume_used.bytes | The amount of storage used by your Aurora DB instance, in bytes. | long |
 | aws.rds.write_io.ops_per_sec | The average number of disk write I/O operations per second. | float |
 | aws.s3.bucket.name | Name of a S3 bucket. | keyword |
-| aws.tags.* | Tag key value pairs from aws resources. | object |
+| aws.tags.\* | Tag key value pairs from aws resources. | object |
 | cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
 | cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword |
 | cloud.availability_zone | Availability zone in which this host is running. | keyword |
diff --git a/test/packages/aws/docs/s3.md b/test/packages/aws/docs/s3.md
index a74bce3c5..eb4ad6c43 100644
--- a/test/packages/aws/docs/s3.md
+++ b/test/packages/aws/docs/s3.md
@@ -170,15 +170,15 @@ An example event for `s3_daily_storage` looks as following:
 | Field | Description | Type |
 |---|---|---|
 | @timestamp | Event timestamp. | date |
-| aws.*.metrics.*.* | Metrics that returned from Cloudwatch API query. | object |
-| aws.dimensions.* | Metric dimensions. | object |
+| aws.\*.metrics.\*.\* | Metrics that returned from Cloudwatch API query. | object |
+| aws.dimensions.\* | Metric dimensions. | object |
 | aws.dimensions.BucketName | This dimension filters the data you request for the identified bucket only. | keyword |
 | aws.dimensions.FilterId | This dimension filters metrics configurations that you specify for request metrics on a bucket, for example, a prefix or a tag. | keyword |
 | aws.dimensions.StorageType | This dimension filters the data that you have stored in a bucket by types of storage. | keyword |
 | aws.s3.bucket.name | Name of a S3 bucket. | keyword |
 | aws.s3_daily_storage.bucket.size.bytes | The amount of data in bytes stored in a bucket. | long |
 | aws.s3_daily_storage.number_of_objects | The total number of objects stored in a bucket for all storage classes. | long |
-| aws.tags.* | Tag key value pairs from aws resources. | object |
+| aws.tags.\* | Tag key value pairs from aws resources. | object |
 | cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
 | cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword |
 | cloud.availability_zone | Availability zone in which this host is running. | keyword |
@@ -289,8 +289,8 @@ An example event for `s3_request` looks as following:
 | Field | Description | Type |
 |---|---|---|
 | @timestamp | Event timestamp. | date |
-| aws.*.metrics.*.* | Metrics that returned from Cloudwatch API query. | object |
-| aws.dimensions.* | Metric dimensions. | object |
+| aws.\*.metrics.\*.\* | Metrics that returned from Cloudwatch API query. | object |
+| aws.dimensions.\* | Metric dimensions. | object |
 | aws.dimensions.BucketName | This dimension filters the data you request for the identified bucket only. | keyword |
 | aws.dimensions.FilterId | This dimension filters metrics configurations that you specify for request metrics on a bucket, for example, a prefix or a tag. | keyword |
 | aws.dimensions.StorageType | This dimension filters the data that you have stored in a bucket by types of storage. | keyword |
@@ -311,7 +311,7 @@ An example event for `s3_request` looks as following:
 | aws.s3_request.requests.select_scanned.bytes | The number of bytes of data scanned with Amazon S3 SELECT Object Content requests in an Amazon S3 bucket. | long |
 | aws.s3_request.requests.total | The total number of HTTP requests made to an Amazon S3 bucket, regardless of type. | long |
 | aws.s3_request.uploaded.bytes | The number bytes uploaded that contain a request body, made to an Amazon S3 bucket. | long |
-| aws.tags.* | Tag key value pairs from aws resources. | object |
+| aws.tags.\* | Tag key value pairs from aws resources. | object |
 | cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
 | cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword |
 | cloud.availability_zone | Availability zone in which this host is running. | keyword |
diff --git a/test/packages/aws/docs/sns.md b/test/packages/aws/docs/sns.md
index eca22586d..2c2905fd0 100644
--- a/test/packages/aws/docs/sns.md
+++ b/test/packages/aws/docs/sns.md
@@ -69,9 +69,9 @@ An example event for `sns` looks as following:
 | Field | Description | Type |
 |---|---|---|
 | @timestamp | Event timestamp. | date |
-| aws.*.metrics.*.* | Metrics that returned from Cloudwatch API query. | object |
+| aws.\*.metrics.\*.\* | Metrics that returned from Cloudwatch API query. | object |
 | aws.cloudwatch.namespace | The namespace specified when query cloudwatch api. | keyword |
-| aws.dimensions.* | Metric dimensions. | object |
+| aws.dimensions.\* | Metric dimensions. | object |
 | aws.dimensions.Application | Filters on application objects, which represent an app and device registered with one of the supported push notification services, such as APNs and FCM. | keyword |
 | aws.dimensions.Application,Platform | Filters on application and platform objects, where the platform objects are for the supported push notification services, such as APNs and FCM. | keyword |
 | aws.dimensions.Country | Filters on the destination country or region of an SMS message. | keyword |
@@ -90,7 +90,7 @@ An example event for `sns` looks as following:
 | aws.sns.metrics.PublishSize.avg | The size of messages published. | double |
 | aws.sns.metrics.SMSMonthToDateSpentUSD.sum | The charges you have accrued since the start of the current calendar month for sending SMS messages. | long |
 | aws.sns.metrics.SMSSuccessRate.avg | The rate of successful SMS message deliveries. | double |
-| aws.tags.* | Tag key value pairs from aws resources. | object |
+| aws.tags.\* | Tag key value pairs from aws resources. | object |
 | cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
 | cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword |
 | cloud.availability_zone | Availability zone in which this host is running. | keyword |
diff --git a/test/packages/aws/docs/sqs.md b/test/packages/aws/docs/sqs.md
index 4f9a54916..2a6dc4ca7 100644
--- a/test/packages/aws/docs/sqs.md
+++ b/test/packages/aws/docs/sqs.md
@@ -65,8 +65,8 @@ An example event for `sqs` looks as following:
 | Field | Description | Type |
 |---|---|---|
 | @timestamp | Event timestamp. | date |
-| aws.*.metrics.*.* | Metrics that returned from Cloudwatch API query. | object |
-| aws.dimensions.* | Metric dimensions. | object |
+| aws.\*.metrics.\*.\* | Metrics that returned from Cloudwatch API query. | object |
+| aws.dimensions.\* | Metric dimensions. | object |
 | aws.dimensions.QueueName | SQS queue name | keyword |
 | aws.s3.bucket.name | Name of a S3 bucket. | keyword |
 | aws.sqs.empty_receives | The number of ReceiveMessage API calls that did not return a message. | long |
@@ -79,7 +79,7 @@ An example event for `sqs` looks as following:
 | aws.sqs.oldest_message_age.sec | The approximate age of the oldest non-deleted message in the queue. | long |
 | aws.sqs.queue.name | SQS queue name | keyword |
 | aws.sqs.sent_message_size.bytes | The size of messages added to a queue. | long |
-| aws.tags.* | Tag key value pairs from aws resources. | object |
+| aws.tags.\* | Tag key value pairs from aws resources. | object |
 | cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
 | cloud.account.name | The cloud account name or alias used to identify different entities in a multi-tenant environment. Examples: AWS account name, Google Cloud ORG display name. | keyword |
 | cloud.availability_zone | Availability zone in which this host is running. | keyword |
diff --git a/test/packages/aws/docs/transitgateway.md b/test/packages/aws/docs/transitgateway.md
index 358dcf683..f8c99e8b6 100644
--- a/test/packages/aws/docs/transitgateway.md
+++ b/test/packages/aws/docs/transitgateway.md
@@ -75,13 +75,13 @@ An example event for `transitgateway` looks as following:
 | Field | Description | Type |
 |---|---|---|
 | @timestamp | Event timestamp. | date |
-| aws.*.metrics.*.* | Metrics that returned from Cloudwatch API query. | object |
+| aws.\*.metrics.\*.\* | Metrics that returned from Cloudwatch API query. | object |
 | aws.cloudwatch.namespace | The namespace specified when query cloudwatch api. | keyword |
-| aws.dimensions.* | Metric dimensions. | object |
+| aws.dimensions.\* | Metric dimensions. | object |
 | aws.dimensions.TransitGateway | Filters the metric data by transit gateway. | keyword |
 | aws.dimensions.TransitGatewayAttachment | Filters the metric data by transit gateway attachment. | keyword |
 | aws.s3.bucket.name | Name of a S3 bucket. | keyword |
-| aws.tags.* | Tag key value pairs from aws resources. | object |
+| aws.tags.\* | Tag key value pairs from aws resources. | object |
 | aws.transitgateway.metrics.BytesIn.sum | The number of bytes received by the transit gateway. | long |
 | aws.transitgateway.metrics.BytesOut.sum | The number of bytes sent from the transit gateway. | long |
 | aws.transitgateway.metrics.PacketDropCountBlackhole.sum | The number of packets dropped because they matched a blackhole route. | long |
diff --git a/test/packages/aws/docs/usage.md b/test/packages/aws/docs/usage.md
index a2dc953ad..4a6d7009f 100644
--- a/test/packages/aws/docs/usage.md
+++ b/test/packages/aws/docs/usage.md
@@ -63,15 +63,15 @@ An example event for `usage` looks as following:
 | Field | Description | Type |
 |---|---|---|
 | @timestamp | Event timestamp. | date |
-| aws.*.metrics.*.* | Metrics that returned from Cloudwatch API query. | object |
+| aws.\*.metrics.\*.\* | Metrics that returned from Cloudwatch API query. | object |
 | aws.cloudwatch.namespace | The namespace specified when query cloudwatch api. | keyword |
-| aws.dimensions.* | Metric dimensions. | object |
+| aws.dimensions.\* | Metric dimensions. | object |
 | aws.dimensions.Class | The class of resource being tracked. | keyword |
 | aws.dimensions.Resource | The name of the API operation. | keyword |
 | aws.dimensions.Service | The name of the AWS service containing the resource. | keyword |
 | aws.dimensions.Type | The type of resource being tracked. | keyword |
 | aws.s3.bucket.name | Name of a S3 bucket. | keyword |
-| aws.tags.* | Tag key value pairs from aws resources. | object |
+| aws.tags.\* | Tag key value pairs from aws resources. | object |
 | aws.usage.metrics.CallCount.sum | The number of specified API operations performed in your account. | long |
 | aws.usage.metrics.ResourceCount.sum | The number of the specified resources running in your account. The resources are defined by the dimensions associated with the metric. | long |
 | cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword |
diff --git a/test/packages/aws/docs/vpn.md b/test/packages/aws/docs/vpn.md
index a35db1f3a..70e6f1aef 100644
--- a/test/packages/aws/docs/vpn.md
+++ b/test/packages/aws/docs/vpn.md
@@ -63,13 +63,13 @@ An example event for `vpn` looks as following:
 | Field | Description | Type |
 |---|---|---|
 | @timestamp | Event timestamp. | date |
-| aws.*.metrics.*.* | Metrics that returned from Cloudwatch API query. | object |
+| aws.\*.metrics.\*.\* | Metrics that returned from Cloudwatch API query. | object |
 | aws.cloudwatch.namespace | The namespace specified when query cloudwatch api. | keyword |
-| aws.dimensions.* | Metric dimensions. | object |
+| aws.dimensions.\* | Metric dimensions. | object |
 | aws.dimensions.TunnelIpAddress | Filters the metric data by the IP address of the tunnel for the virtual private gateway. | keyword |
 | aws.dimensions.VpnId | Filters the metric data by the Site-to-Site VPN connection ID. | keyword |
 | aws.s3.bucket.name | Name of a S3 bucket. | keyword |
-| aws.tags.* | Tag key value pairs from aws resources. | object |
+| aws.tags.\* | Tag key value pairs from aws resources. | object |
 | aws.vpn.metrics.TunnelDataIn.sum | The bytes received through the VPN tunnel. | double |
 | aws.vpn.metrics.TunnelDataOut.sum | The bytes sent through the VPN tunnel. | double |
 | aws.vpn.metrics.TunnelState.avg | The state of the tunnel. For static VPNs, 0 indicates DOWN and 1 indicates UP. For BGP VPNs, 1 indicates ESTABLISHED and 0 is used for all other states. | double |