elastic / elastic/integrations
[network_traffic] Remove original (non-ECS) mappings and map_to_ecs option
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 225
Description
This issue tracks the work required to remove all legacy (non-ECS) field mappings and the user-facing option to select mapping behavior (map_to_ecs) from the Network Packet Capture (NPC) integration package.
### Scope of Work
1. **Remove unused non-ECS mappings:**
- Identify and remove all non-ECS field definitions (e.g., root-level protocol fields, `resource`, etc.) from the NPC datastreams and ingest pipelines.
- Review the compatibility pipelines added in [#8622](https://github.com/elastic/integrations/pull/8622) to guide which field definitions should be removed.
2. **Remove the map_to_ecs configuration option:**
- Remove the `map_to_ecs` config variable from integration configuration.
- Remove references to `map_to_ecs` in all `*.yml.hbs` files and the documentation.
- Update the README and other relevant docs to eliminate documentation for the mapping choice.
3. **Major version bump:**
- Increment the major version of the NPC integration to reflect this breaking change.
4. **Upgrade experience:**
- Verify that users are prompted in Kibana/Fleet UI to acknowledge the breaking changes before upgrading (coordinate with Fleet team if required).
### Related issues
- Relates #8185 (this task is stage 4 of the phased removal of these fields)
Contributor guide
Assessment
This issue has not been assessed yet.