elastic / elastic/elastic-package

Import ECS dynamic templates into transform destinations

Open
#1,641 8 comments 0 reactions 0 assignees View on GitHub
enhancement stale
Dominant language
Go
Stars
72
Forks
141
Avg merge
19h 42m
Merged PRs (30d)
55

Description

In an integration set (in `_dev/build/build.yml`) to import ECS mappings, the build process will inject ECS's dynamic templates at `elasticsearch.index_template.mappings.dynamic_templates` in `data_stream//manifest.yml`.

However, for transforms, it does not put them into `destination_index_template.mappings.dynamic_templates` in `elasticsearch/transform//manifest.yml`.

The relevant code is [here](https://github.com/elastic/elastic-package/blob/3d0c32f3690f979cc92f433597cc852ae97588d9/internal/builder/dynamic_mappings.go#L58-L72).

This came up while building an [IOC expiry transform for OpenCTI](https://github.com/elastic/integrations/pull/8920). The workaround was to add an explicit external field reference for each ECS field used.

**2025-06-11**: We do still want the functionality described above. (A different thing done on 2025-06-17: adding the `ecs@mappings` component template in the index template created during package install by fleet for a transform destination index.)

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in internal/builder/dynamic_mappings.go at the referenced dynamic-mappings logic, then compare how ECS dynamic templates are injected for data_stream//manifest.yml and transform destinations. Confirm the expected transform manifest path and make sure destination_index_template.mappings.dynamic_templates receives the ECS mappings. Done means transforms built from an integration set contain the same ECS dynamic templates as data streams.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
build-system, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.