Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Elastic Agent] Remove dynamic: false from index templates #9844

Open
kpollich opened this issue May 13, 2024 · 0 comments
Open

[Elastic Agent] Remove dynamic: false from index templates #9844

kpollich opened this issue May 13, 2024 · 0 comments
Labels
Team:Ecosystem Label for the Packages Ecosystem team technical-debt

Comments

@kpollich
Copy link
Member

Previously, we set dynamic: false in the mappings for the Elastic Agent integration's data streams, e.g.

title: Elastic Agent
dataset: elastic_agent.filebeat
type: logs
elasticsearch:
index_template:
mappings:
dynamic: false

This was, at the time, a decision made to prevent an explosion of fields early in Agent/Fleet's product lifecycle. Today, we have mechanisms like dynamic field limits, and can rely on ECS templates for much of the field mappings for logging data streams.

We should explore removing dynamic: false from the Elastic Agent integration's data stream mappings as an act of technical debt cleanup.

@kpollich kpollich added Team:Ecosystem Label for the Packages Ecosystem team technical-debt labels May 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Team:Ecosystem Label for the Packages Ecosystem team technical-debt
Projects
None yet
Development

No branches or pull requests

1 participant