elastic / elastic/elastic-package

Elastic-Packge wizard creates packages that reference logfile inputs but dataset only allow to create filestream

Open Beginner friendly
#3,645 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
72
Forks
141
Avg merge
19h 42m
Merged PRs (30d)
55

Description

**Background**
The logfile (log) input of Elastic-Agent has been deprecated in favor of the filestream input. This is also reflected by the fact that when creating a new dataset, modern versions of elastic-package only allow the creation of filestream inputs.

**Issue**

When creating a new package via the elastic-package create package command, the manifest contain the following line:

```yaml
policy_templates:
- name: sample
title: Sample logs
description: Collect sample logs
inputs:
- type: logfile # <--- This line should be arguably filestream
title: Collect sample logs from instances
description: Collecting sample logs
```

When we create a new package via elastic-package create data-stream command and we select the filestream input and we import the package, we obtain the following surprising result:

Image

Which is unnecessary confusing, especially for new users. If we adjust the value to filestream:

```yaml
policy_templates:
- name: sample
title: Sample logs
description: Collect sample logs
inputs:
- type: filestream # <---- Fixed value
title: Collect sample logs from instances
description: Collecting sample logs
```

We then see the result like this:

Image

**Comment**

I know it's not a bug, but it's still something that can be unnecessarily confusing.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at the implementation of the `elastic-package create package` command and compare its generated manifest with the `create data-stream` flow that offers `filestream`. Update the generated sample input to use `filestream`, then run the relevant command or tests and verify that a newly created package has the expected input type.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, tooling
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.