elastic / elastic/integrations

[System]: Request for Logs and Metrics wide component template

Open
#18,181 0 comments 0 reactions 0 assignees View on GitHub
Integration:system needs:triage Team:Obs-InfraObs
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

### Integration Name

System [system]

### Dataset Name

system.core

### Integration Version

2.13.0

### Agent Version

9.3.0

### OS Version and Architecture

Redhat

### User Goal

I would like to see a component template for example `logs-system@custom` and `metrics-system@custom` added to the underlying system index templates. Currently there is a system@custom component template which is used by both `metrics-system.*` and `logs-system.*`. We are looking at for example set a ILM policy on for `system-metrics.*`which would also set downsample etc. While logs-system.* would see other retentions and it would also not be necessary to set downsample for logs.

So for example adding metrics-system@custom as seen below to the index templates.
```
"composed_of": [
"metrics@tsdb-settings",
"metrics-system.core@package",
"metrics@custom",
"system@custom",
"metrics-system@custom", // New feature proposed
"metrics-system.core@custom",
"ecs@mappings",
".fleet_globals-1",
".fleet_agent_id_verification-1"
],
```

Adding this would add an intermediate step between all system and the full dataset splitted between logs and metrics. For metrics there is 13 component templates to modify to modify the ILM Policies, which is doable but tedious. :)

### Existing Features

```
PUT _index_template/metrics-system.core
{
"priority": 200,
"template": {
"mappings": {
"_meta": {
"package": {
"name": "system"
},
"managed_by": "fleet",
"managed": true
}
},
"settings": {
"index": {
"mode": "time_series"
}
}
},
"index_patterns": [
"metrics-system.core-*"
],
"data_stream": {
"hidden": false,
"allow_custom_routing": false
},
"composed_of": [
"metrics@tsdb-settings",
"metrics-system.core@package",
"metrics@custom",
"system@custom",
"metrics-system.core@custom",
"ecs@mappings",
".fleet_globals-1",
".fleet_agent_id_verification-1"
],
"ignore_missing_component_templates": [
"metrics@custom",
"system@custom",
"metrics-system.core@custom"
],
"_meta": {
"package": {
"name": "system"
},
"managed_by": "fleet",
"managed": true
}
}
```

### What did you see?

N/A

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.