elastic / elastic/elastic-package

Input packages: registry index template uses dash pattern, not dotted datastream

Open
#3,396 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
72
Forks
141
Avg merge
19h 42m
Merged PRs (30d)
55

Description

## Summary
Input-only packages (e.g., winlog, filestream, unifiedlogs) get an auto-generated index template pattern `logs--*` from the registry, but the datastream names are `logs-.-*`. This causes the package template to miss and fall back to `logs-*`.

## Impact
- Ingest pipelines/mappings from the package are not applied; the catch-all template wins.
- Adding `data_stream.dataset` in the package does not change the generated pattern.

## Evidence
- elastic/integrations issue: https://github.com/elastic/integrations/issues/15295
- Fix PR on integrations side (workaround via explicit template overrides): https://github.com/elastic/integrations/pull/17924

## Expected
For input packages, the registry-generated index template should include dotted patterns (e.g., `logs-.*-*`), or otherwise match the datastream name that includes the dataset segment.

## Workaround
Explicitly ship an index_template in the input package covering both `logs--*` and `logs-.*-*` (done in PR 17924), but this should be fixed in the generator so all input packages benefit by default.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing how elastic-package generates registry index templates for input-only packages, then compare the generated pattern with datastream names containing a dataset segment. Use the winlog, filestream, or unifiedlogs examples and the integrations issue and workaround PR as behavioral references. Done means generated templates match dotted datastream names by default without requiring explicit package overrides.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.