elastic / elastic/integrations

Bump transform destination versions so the `data_stream.namespace: keyword` fix reaches existing installs

Open
#21,249 0 comments 0 reactions 0 assignees View on GitHub
bugfix Team:Security-Service Integrations
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
3d 4h
Merged PRs (30d)
209

Description

Several CDR transforms declare `data_stream.namespace` as `external: ecs` with `type: keyword`, but `elastic-package build` silently ignored that override until v0.125.0 (https://github.com/elastic/elastic-package/pull/3605), which the integrations repo adopted on 2026-06-29. Packages released before that shipped `constant_keyword` in the destination index, and the transform fails as soon as a second namespace writes to it). Later releases have the right mapping, but Fleet only recreates the transform and its destination index template when `_meta.fleet_transform_version` changes, so upgraded installs keep the broken index.

For each transform below, in `elasticsearch/transform//transform.yml`: bump the version suffix on `dest.index` (e.g. `-v1` to `-v2`) and bump `_meta.fleet_transform_version`. Add a `bugfix` changelog entry and bump the package version.

Transforms owned by @elastic/security-service-integrations with the override whose version was last bumped before 2026-06-29:

- `eset_protect/latest_cdr_vuln`
- `google_scc/latest_cdr_misconfigurations`, `google_scc/latest_cdr_vulnerabilities`
- `m365_defender/latest_cdr_vulnerabilities`
- `microsoft_defender_cloud/misconfiguration`, `microsoft_defender_cloud/vulnerability`
- `microsoft_defender_endpoint/latest_cdr_vuln` (also fix `latest_action`, which still declares `constant_keyword` explicitly)
- `prisma_cloud/misconfiguration`, `prisma_cloud/vulnerability`
- `qualys_vmdr/latest_cdr_vulnerabilities`
- `rapid7_insightvm/latest_cdr_vulnerabilities`
- `tenable_io/latest_cdr_vulnerabilities`

Already bumped after 2026-06-29, no action expected but confirm: `aws_securityhub/latest_cdr_vulnerabilities`, `ti_google_threat_intelligence/rule_vuln`, `wiz/latest_cdr_misconfigurations`, `wiz/latest_cdr_vulnerabilities`.

Verify by downloading the built zip from `https://epr.elastic.co/epr//-.zip` and checking `type: keyword` in the transform's built `fields/base-fields.yml`, then upgrading a test install from the previous version and checking `GET /_mapping/field/data_stream.namespace`.

Out of scope here, but @elastic/security-service-integrations owns 51 more transforms that still build `data_stream.namespace` as `constant_keyword` (`external: ecs` with no type override, or explicit). Those need the mapping change plus a bump; but that should be tracked and done separately.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the listed elasticsearch/transform//transform.yml files, their package versions, and changelogs. Build each package and inspect the downloaded epr.elastic.co zip for type: keyword in fields/base-fields.yml, then upgrade a test install and check the destination mapping; done means the requested suffixes, transform versions, bugfix entries, and package bumps are applied and the mapping is keyword.

Written by the indexing model from the issue text.

Assessment

Tech stack
elasticsearch
Domain
databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.