elastic / elastic/integrations
Bump transform destination versions so the `data_stream.namespace: keyword` fix reaches existing installs
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 3d 4h
- Merged PRs (30d)
- 209
Description
Several CDR transforms declare `data_stream.namespace` as `external: ecs` with `type: keyword`, but `elastic-package build` silently ignored that override until v0.125.0 (https://github.com/elastic/elastic-package/pull/3605), which the integrations repo adopted on 2026-06-29. Packages released before that shipped `constant_keyword` in the destination index, and the transform fails as soon as a second namespace writes to it). Later releases have the right mapping, but Fleet only recreates the transform and its destination index template when `_meta.fleet_transform_version` changes, so upgraded installs keep the broken index.
For each transform below, in `elasticsearch/transform//transform.yml`: bump the version suffix on `dest.index` (e.g. `-v1` to `-v2`) and bump `_meta.fleet_transform_version`. Add a `bugfix` changelog entry and bump the package version.
Transforms owned by @elastic/security-service-integrations with the override whose version was last bumped before 2026-06-29:
- `eset_protect/latest_cdr_vuln`
- `google_scc/latest_cdr_misconfigurations`, `google_scc/latest_cdr_vulnerabilities`
- `m365_defender/latest_cdr_vulnerabilities`
- `microsoft_defender_cloud/misconfiguration`, `microsoft_defender_cloud/vulnerability`
- `microsoft_defender_endpoint/latest_cdr_vuln` (also fix `latest_action`, which still declares `constant_keyword` explicitly)
- `prisma_cloud/misconfiguration`, `prisma_cloud/vulnerability`
- `qualys_vmdr/latest_cdr_vulnerabilities`
- `rapid7_insightvm/latest_cdr_vulnerabilities`
- `tenable_io/latest_cdr_vulnerabilities`
Already bumped after 2026-06-29, no action expected but confirm: `aws_securityhub/latest_cdr_vulnerabilities`, `ti_google_threat_intelligence/rule_vuln`, `wiz/latest_cdr_misconfigurations`, `wiz/latest_cdr_vulnerabilities`.
Verify by downloading the built zip from `https://epr.elastic.co/epr//-.zip` and checking `type: keyword` in the transform's built `fields/base-fields.yml`, then upgrading a test install from the previous version and checking `GET /_mapping/field/data_stream.namespace`.
Out of scope here, but @elastic/security-service-integrations owns 51 more transforms that still build `data_stream.namespace` as `constant_keyword` (`external: ecs` with no type override, or explicit). Those need the mapping change plus a bump; but that should be tracked and done separately.
Contributor guide
Research direction
Start by reviewing the listed elasticsearch/transform//transform.yml files, their package versions, and changelogs. Build each package and inspect the downloaded epr.elastic.co zip for type: keyword in fields/base-fields.yml, then upgrade a test install and check the destination mapping; done means the requested suffixes, transform versions, bugfix entries, and package bumps are applied and the mapping is keyword.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- elasticsearch
- Domain
- databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100