elastic / elastic/integrations

[network_traffic] Remove original (non-ECS) mappings and map_to_ecs option

Open
#14,595 2 comments 0 reactions 1 assignee Claimed by @efd6 View on GitHub
breaking change Integration:network_traffic Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

This issue tracks the work required to remove all legacy (non-ECS) field mappings and the user-facing option to select mapping behavior (map_to_ecs) from the Network Packet Capture (NPC) integration package.

### Scope of Work

1. **Remove unused non-ECS mappings:**
- Identify and remove all non-ECS field definitions (e.g., root-level protocol fields, `resource`, etc.) from the NPC datastreams and ingest pipelines.
- Review the compatibility pipelines added in [#8622](https://github.com/elastic/integrations/pull/8622) to guide which field definitions should be removed.

2. **Remove the map_to_ecs configuration option:**
- Remove the `map_to_ecs` config variable from integration configuration.
- Remove references to `map_to_ecs` in all `*.yml.hbs` files and the documentation.
- Update the README and other relevant docs to eliminate documentation for the mapping choice.

3. **Major version bump:**
- Increment the major version of the NPC integration to reflect this breaking change.

4. **Upgrade experience:**
- Verify that users are prompted in Kibana/Fleet UI to acknowledge the breaking changes before upgrading (coordinate with Fleet team if required).

### Related issues

- Relates #8185 (this task is stage 4 of the phased removal of these fields)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.