elastic / elastic/package-spec

[Discuss] Automatically populate base fields

Open
#310 10 comments 0 reactions 0 assignees View on GitHub
discuss Team:Ecosystem
Dominant language
Go
Stars
20
Forks
93
Avg merge
15h 10m
Merged PRs (30d)
12

Description

Related: https://github.com/elastic/integrations/pull/2939#discussion_r839278631

All packages must define base fields (`data_stream.type`, `data_stream.dataset`, `data_stream.namespace`, `event.module`, `event.dataset`, `@timestamp`). Values of these fields are constant for every integration and it doesn't make much sense to keep that information in the package.

The goal of this issue is to discuss the possibility of populating them with Fleet.

Bonus points:

Where should we store [agent.yml](https://github.com/elastic/integrations/blob/main/packages/activemq/data_stream/audit/fields/agent.yml), which also seem to be duplicated across many (all?) packages.

cc @ruflin @joshdover @lalit-satapathy (as you stumped over that issue recently)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.