From 553f0af9e01a0d61d26deacb29cd3b6d1e753918 Mon Sep 17 00:00:00 2001
From: Stijn Holzhauer <stijn.holzhauer@elastic.co>
Date: Mon, 1 Dec 2025 15:59:20 +0100
Subject: [PATCH 1/4] adding sku and cost_type to billing data for node
 granularity

---
 .../elasticsearch/ingest_pipeline/billing.yml | 61 +++++++++++--------
 .../billing_cluster_cost/fields/fields.yml    |  6 ++
 .../billing_cluster_cost/transform.yml        |  3 +
 3 files changed, 45 insertions(+), 25 deletions(-)

diff --git a/packages/chargeback/elasticsearch/ingest_pipeline/billing.yml b/packages/chargeback/elasticsearch/ingest_pipeline/billing.yml
index efba5b320d8..75f77da57de 100644
--- a/packages/chargeback/elasticsearch/ingest_pipeline/billing.yml
+++ b/packages/chargeback/elasticsearch/ingest_pipeline/billing.yml
@@ -1,27 +1,38 @@
 ---
-description: 'Chargeback: Set composite_key from @timestamp and deployment_id.'
+description: "Chargeback: Set composite_key from @timestamp and deployment_id."
 processors:
-  - script:
-      ignore_failure: true
-      lang: painless
-      source: |
-        if (ctx['@timestamp'] != null) {
-            ctx.composite_key = ZonedDateTime.parse(ctx['@timestamp']).toLocalDate().toString() + '_' + ctx.deployment_id;
-        }
-      tag: ess_billing
-  - pipeline:
-      description: '[Fleet] Global pipeline for all data streams'
-      ignore_missing_pipeline: true
-      name: global@custom
-  - pipeline:
-      description: '[Fleet] Pipeline for all data streams of type `metrics`'
-      ignore_missing_pipeline: true
-      name: metrics@custom
-  - pipeline:
-      description: '[Fleet] Pipeline for all data streams of type `metrics` defined by the `chargeback` integration'
-      ignore_missing_pipeline: true
-      name: metrics-chargeback.integration@custom
-  - pipeline:
-      description: '[Fleet] Pipeline for the `chargeback.billing` dataset'
-      ignore_missing_pipeline: true
-      name: metrics-chargeback.billing@custom
+    - script:
+        ignore_failure: true
+        lang: painless
+        source: |
+            if (ctx['@timestamp'] != null) {
+                ctx.composite_key = ZonedDateTime.parse(ctx['@timestamp']).toLocalDate().toString() + '_' + ctx.deployment_id;
+            }
+        tag: ess_billing
+    - grok:
+        field: sku
+        ignore_failure: true
+        patterns:
+          - '%{DATA}.es.%{WORD:cost_type}'
+          - '%{DATA}-%{DATA}.%{WORD:cost_type}'
+        description: retrieve a human readable cost type from the sku field
+    - set:
+        field: cost_type
+        value: 'datahot/datacontent'
+        if: ctx.cost_type == 'datahot'
+    - pipeline:
+        description: "[Fleet] Global pipeline for all data streams"
+        ignore_missing_pipeline: true
+        name: global@custom
+    - pipeline:
+        description: "[Fleet] Pipeline for all data streams of type `metrics`"
+        ignore_missing_pipeline: true
+        name: metrics@custom
+    - pipeline:
+        description: "[Fleet] Pipeline for all data streams of type `metrics` defined by the `chargeback` integration"
+        ignore_missing_pipeline: true
+        name: metrics-chargeback.integration@custom
+    - pipeline:
+        description: "[Fleet] Pipeline for the `chargeback.billing` dataset"
+        ignore_missing_pipeline: true
+        name: metrics-chargeback.billing@custom
diff --git a/packages/chargeback/elasticsearch/transform/billing_cluster_cost/fields/fields.yml b/packages/chargeback/elasticsearch/transform/billing_cluster_cost/fields/fields.yml
index ca91ffec28c..063df0b2a7a 100644
--- a/packages/chargeback/elasticsearch/transform/billing_cluster_cost/fields/fields.yml
+++ b/packages/chargeback/elasticsearch/transform/billing_cluster_cost/fields/fields.yml
@@ -13,3 +13,9 @@
 - name: composite_key
   type: keyword
   description: Composite key used for billing attribution (set by ingest pipeline) consisting of date and deployment ID.
+- name: sku
+  type: keyword
+  description: Component where the ecu is being spend
+- name: cost_type
+  type: keyword
+  description: Component where the ecu is being spent, derived from SKU field.
\ No newline at end of file
diff --git a/packages/chargeback/elasticsearch/transform/billing_cluster_cost/transform.yml b/packages/chargeback/elasticsearch/transform/billing_cluster_cost/transform.yml
index f9866baaa58..74c2bb1db7a 100644
--- a/packages/chargeback/elasticsearch/transform/billing_cluster_cost/transform.yml
+++ b/packages/chargeback/elasticsearch/transform/billing_cluster_cost/transform.yml
@@ -26,6 +26,9 @@ pivot:
     deployment_name:
       terms:
         field: ess.billing.deployment_name
+    sku:
+      terms:
+        field: ess.billing.sku
   aggregations:
     total_ecu:
       sum:

From f731eca3938ef45488100173333d3cb91791fcab Mon Sep 17 00:00:00 2001
From: Stijn Holzhauer <stijn.holzhauer@elastic.co>
Date: Mon, 1 Dec 2025 20:17:57 +0100
Subject: [PATCH 2/4] working on sku with pipeline to do parsing

---
 packages/chargeback/changelog.yml             |  5 +++++
 .../elasticsearch/ingest_pipeline/billing.yml | 19 +++++++++++++++++--
 .../billing_cluster_cost/transform.yml        |  4 ++--
 .../transform.yml                             |  2 +-
 .../transform.yml                             |  2 +-
 .../transform.yml                             |  2 +-
 .../cluster_tier_contribution/transform.yml   |  2 +-
 packages/chargeback/manifest.yml              |  4 ++--
 packages/chargeback/pre-setup.sh              |  2 +-
 9 files changed, 31 insertions(+), 11 deletions(-)

diff --git a/packages/chargeback/changelog.yml b/packages/chargeback/changelog.yml
index a0e18a4a6b6..a207f509f97 100644
--- a/packages/chargeback/changelog.yml
+++ b/packages/chargeback/changelog.yml
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: 0.3.0
+  changes:
+    - description: "Providing insight on node types and their ECU usage."
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/14545 
 - version: 0.2.3
   changes:
     - description: "Adding deployment filter, dataview and moving config portion to bottom of dashboard for better usability."
diff --git a/packages/chargeback/elasticsearch/ingest_pipeline/billing.yml b/packages/chargeback/elasticsearch/ingest_pipeline/billing.yml
index 75f77da57de..4ba9943aac0 100644
--- a/packages/chargeback/elasticsearch/ingest_pipeline/billing.yml
+++ b/packages/chargeback/elasticsearch/ingest_pipeline/billing.yml
@@ -9,13 +9,28 @@ processors:
                 ctx.composite_key = ZonedDateTime.parse(ctx['@timestamp']).toLocalDate().toString() + '_' + ctx.deployment_id;
             }
         tag: ess_billing
+    - set:
+        field: cost_type
+        value: 'data-transfer'
+        if: ctx.sku =~ /^(aws|gcp|azure).data-transfer.*/
+    - set:
+        field: cost_type
+        value: 'snapshots'
+        if: ctx.sku =~ /^(aws|gcp|azure).snapshot-storage&/
+    - set:
+        field: cost_type
+        value: 'inference'
+        if: ctx.sku == 'global.inference-chat-input'
     - grok:
         field: sku
         ignore_failure: true
         patterns:
-          - '%{DATA}.es.%{WORD:cost_type}'
-          - '%{DATA}-%{DATA}.%{WORD:cost_type}'
+            - "%{WORD}.es.%{WORD:cost_type}.%{GREEDYDATA}"
+            - "%{WORD}.%{DATA:cost_type}-vcu_%{GREEDYDATA}"
+            - "%{WORD}.%{WORD:cost_type}.%{GREEDYDATA}"
+            - "%{WORD}.%{DATA:cost_type}.%{GREEDYDATA}"
         description: retrieve a human readable cost type from the sku field
+        if: ctx.cost_type == null
     - set:
         field: cost_type
         value: 'datahot/datacontent'
diff --git a/packages/chargeback/elasticsearch/transform/billing_cluster_cost/transform.yml b/packages/chargeback/elasticsearch/transform/billing_cluster_cost/transform.yml
index 74c2bb1db7a..5b381dcfe5c 100644
--- a/packages/chargeback/elasticsearch/transform/billing_cluster_cost/transform.yml
+++ b/packages/chargeback/elasticsearch/transform/billing_cluster_cost/transform.yml
@@ -8,7 +8,7 @@ source:
         gt: 0
 dest:
   index: billing_cluster_cost_lookup
-  pipeline: 0.2.3-billing
+  pipeline: 0.3.0-billing
 frequency: 60m
 sync:
   time:
@@ -42,4 +42,4 @@ _meta:
   run_as_kibana_system: false
   # Bump this version to delete, reinstall, and restart the transform during package.
   # Version bump is needed if there is any code change in transform.
-  fleet_transform_version: 0.2.1
+  fleet_transform_version: 0.3.0
diff --git a/packages/chargeback/elasticsearch/transform/cluster_datastream_contribution/transform.yml b/packages/chargeback/elasticsearch/transform/cluster_datastream_contribution/transform.yml
index 105306368bf..9467f51e925 100644
--- a/packages/chargeback/elasticsearch/transform/cluster_datastream_contribution/transform.yml
+++ b/packages/chargeback/elasticsearch/transform/cluster_datastream_contribution/transform.yml
@@ -4,7 +4,7 @@ source:
     - monitoring-indices # Dependency: ES Integration added, but not neceserily installed. Need the output of the transform only.
 dest:
   index: cluster_datastream_contribution_lookup
-  pipeline: 0.2.3-usage
+  pipeline: 0.3.0-usage
 frequency: 60m
 sync:
   time:
diff --git a/packages/chargeback/elasticsearch/transform/cluster_deployment_contribution/transform.yml b/packages/chargeback/elasticsearch/transform/cluster_deployment_contribution/transform.yml
index 992250750d7..b492923e587 100644
--- a/packages/chargeback/elasticsearch/transform/cluster_deployment_contribution/transform.yml
+++ b/packages/chargeback/elasticsearch/transform/cluster_deployment_contribution/transform.yml
@@ -4,7 +4,7 @@ source:
     - monitoring-indices # Dependency: ES Integration added, but not neceserily installed. Need the output of the transform only.
 dest:
   index: cluster_deployment_contribution_lookup
-  pipeline: 0.2.3-usage
+  pipeline: 0.3.0-usage
 frequency: 60m
 sync:
   time:
diff --git a/packages/chargeback/elasticsearch/transform/cluster_tier_and_ds_contribution/transform.yml b/packages/chargeback/elasticsearch/transform/cluster_tier_and_ds_contribution/transform.yml
index 99d42079237..44656f2cc91 100644
--- a/packages/chargeback/elasticsearch/transform/cluster_tier_and_ds_contribution/transform.yml
+++ b/packages/chargeback/elasticsearch/transform/cluster_tier_and_ds_contribution/transform.yml
@@ -4,7 +4,7 @@ source:
     - monitoring-indices # Dependency: ES Integration added, but not neceserily installed. Need the output of the transform only.
 dest:
   index: cluster_tier_and_datastream_contribution_lookup
-  pipeline: 0.2.3-usage
+  pipeline: 0.3.0-usage
 frequency: 60m
 sync:
   time:
diff --git a/packages/chargeback/elasticsearch/transform/cluster_tier_contribution/transform.yml b/packages/chargeback/elasticsearch/transform/cluster_tier_contribution/transform.yml
index 735e7b61f74..ed85acde130 100644
--- a/packages/chargeback/elasticsearch/transform/cluster_tier_contribution/transform.yml
+++ b/packages/chargeback/elasticsearch/transform/cluster_tier_contribution/transform.yml
@@ -4,7 +4,7 @@ source:
     - monitoring-indices # Dependency: ES Integration added, but not neceserily installed. Need the output of the transform only.
 dest:
   index: cluster_tier_contribution_lookup
-  pipeline: 0.2.3-usage
+  pipeline: 0.3.0-usage
 frequency: 60m
 sync:
   time:
diff --git a/packages/chargeback/manifest.yml b/packages/chargeback/manifest.yml
index 67d3d9028de..4c364070c36 100644
--- a/packages/chargeback/manifest.yml
+++ b/packages/chargeback/manifest.yml
@@ -1,7 +1,7 @@
 format_version: 3.4.0
 name: chargeback
 title: "Chargeback"
-version: 0.2.3
+version: 0.3.0
 description: "This package calculates chargeback based on billing and consumption data"
 type: integration
 categories:
@@ -9,7 +9,7 @@ categories:
   - custom
 conditions:
   kibana:
-    version: "9.2.0"
+    version: "^9.2.0"
   elastic:
     subscription: "basic"
 screenshots:
diff --git a/packages/chargeback/pre-setup.sh b/packages/chargeback/pre-setup.sh
index a93638e96f4..dbd6400d482 100644
--- a/packages/chargeback/pre-setup.sh
+++ b/packages/chargeback/pre-setup.sh
@@ -10,7 +10,7 @@ PUT chargeback_conf_lookup
   "mappings": {
     "_meta": {
       "managed": true,
-      "package": { "name": "chargeback", "version": "0.2.3" }
+      "package": { "name": "chargeback", "version": "0.3.0" }
     },
     "properties": {
       "config_join_key": { "type": "keyword" },

From c31e8f0d8f890aff334eba7cb7f4361d829c7370 Mon Sep 17 00:00:00 2001
From: Stijn Holzhauer <stijn.holzhauer@elastic.co>
Date: Mon, 1 Dec 2025 20:25:37 +0100
Subject: [PATCH 3/4] downplaying version

---
 packages/chargeback/changelog.yml                             | 4 ++--
 .../transform/billing_cluster_cost/transform.yml              | 2 +-
 .../transform/cluster_datastream_contribution/transform.yml   | 2 +-
 .../transform/cluster_deployment_contribution/transform.yml   | 2 +-
 .../transform/cluster_tier_and_ds_contribution/transform.yml  | 2 +-
 .../transform/cluster_tier_contribution/transform.yml         | 2 +-
 packages/chargeback/manifest.yml                              | 2 +-
 packages/chargeback/pre-setup.sh                              | 2 +-
 8 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/packages/chargeback/changelog.yml b/packages/chargeback/changelog.yml
index a207f509f97..41e796f1698 100644
--- a/packages/chargeback/changelog.yml
+++ b/packages/chargeback/changelog.yml
@@ -1,7 +1,7 @@
 # newer versions go on top
-- version: 0.3.0
+- version: 0.2.4
   changes:
-    - description: "Providing insight on node types and their ECU usage."
+    - description: "Adding sku and cost_type to the billing_cluster_cost_lookup for future utilization"
       type: enhancement
       link: https://github.com/elastic/integrations/pull/14545 
 - version: 0.2.3
diff --git a/packages/chargeback/elasticsearch/transform/billing_cluster_cost/transform.yml b/packages/chargeback/elasticsearch/transform/billing_cluster_cost/transform.yml
index 5b381dcfe5c..cc15e49d9c0 100644
--- a/packages/chargeback/elasticsearch/transform/billing_cluster_cost/transform.yml
+++ b/packages/chargeback/elasticsearch/transform/billing_cluster_cost/transform.yml
@@ -8,7 +8,7 @@ source:
         gt: 0
 dest:
   index: billing_cluster_cost_lookup
-  pipeline: 0.3.0-billing
+  pipeline: 0.2.4-billing
 frequency: 60m
 sync:
   time:
diff --git a/packages/chargeback/elasticsearch/transform/cluster_datastream_contribution/transform.yml b/packages/chargeback/elasticsearch/transform/cluster_datastream_contribution/transform.yml
index 9467f51e925..5cc0d150ce1 100644
--- a/packages/chargeback/elasticsearch/transform/cluster_datastream_contribution/transform.yml
+++ b/packages/chargeback/elasticsearch/transform/cluster_datastream_contribution/transform.yml
@@ -4,7 +4,7 @@ source:
     - monitoring-indices # Dependency: ES Integration added, but not neceserily installed. Need the output of the transform only.
 dest:
   index: cluster_datastream_contribution_lookup
-  pipeline: 0.3.0-usage
+  pipeline: 0.2.4-usage
 frequency: 60m
 sync:
   time:
diff --git a/packages/chargeback/elasticsearch/transform/cluster_deployment_contribution/transform.yml b/packages/chargeback/elasticsearch/transform/cluster_deployment_contribution/transform.yml
index b492923e587..ddcb815db24 100644
--- a/packages/chargeback/elasticsearch/transform/cluster_deployment_contribution/transform.yml
+++ b/packages/chargeback/elasticsearch/transform/cluster_deployment_contribution/transform.yml
@@ -4,7 +4,7 @@ source:
     - monitoring-indices # Dependency: ES Integration added, but not neceserily installed. Need the output of the transform only.
 dest:
   index: cluster_deployment_contribution_lookup
-  pipeline: 0.3.0-usage
+  pipeline: 0.2.4-usage
 frequency: 60m
 sync:
   time:
diff --git a/packages/chargeback/elasticsearch/transform/cluster_tier_and_ds_contribution/transform.yml b/packages/chargeback/elasticsearch/transform/cluster_tier_and_ds_contribution/transform.yml
index 44656f2cc91..33a2052060c 100644
--- a/packages/chargeback/elasticsearch/transform/cluster_tier_and_ds_contribution/transform.yml
+++ b/packages/chargeback/elasticsearch/transform/cluster_tier_and_ds_contribution/transform.yml
@@ -4,7 +4,7 @@ source:
     - monitoring-indices # Dependency: ES Integration added, but not neceserily installed. Need the output of the transform only.
 dest:
   index: cluster_tier_and_datastream_contribution_lookup
-  pipeline: 0.3.0-usage
+  pipeline: 0.2.4-usage
 frequency: 60m
 sync:
   time:
diff --git a/packages/chargeback/elasticsearch/transform/cluster_tier_contribution/transform.yml b/packages/chargeback/elasticsearch/transform/cluster_tier_contribution/transform.yml
index ed85acde130..7cb7ddcc0c7 100644
--- a/packages/chargeback/elasticsearch/transform/cluster_tier_contribution/transform.yml
+++ b/packages/chargeback/elasticsearch/transform/cluster_tier_contribution/transform.yml
@@ -4,7 +4,7 @@ source:
     - monitoring-indices # Dependency: ES Integration added, but not neceserily installed. Need the output of the transform only.
 dest:
   index: cluster_tier_contribution_lookup
-  pipeline: 0.3.0-usage
+  pipeline: 0.2.4-usage
 frequency: 60m
 sync:
   time:
diff --git a/packages/chargeback/manifest.yml b/packages/chargeback/manifest.yml
index 4c364070c36..f17a4be74a1 100644
--- a/packages/chargeback/manifest.yml
+++ b/packages/chargeback/manifest.yml
@@ -1,7 +1,7 @@
 format_version: 3.4.0
 name: chargeback
 title: "Chargeback"
-version: 0.3.0
+version: 0.2.4
 description: "This package calculates chargeback based on billing and consumption data"
 type: integration
 categories:
diff --git a/packages/chargeback/pre-setup.sh b/packages/chargeback/pre-setup.sh
index dbd6400d482..8d5a3bb9581 100644
--- a/packages/chargeback/pre-setup.sh
+++ b/packages/chargeback/pre-setup.sh
@@ -10,7 +10,7 @@ PUT chargeback_conf_lookup
   "mappings": {
     "_meta": {
       "managed": true,
-      "package": { "name": "chargeback", "version": "0.3.0" }
+      "package": { "name": "chargeback", "version": "0.2.4" }
     },
     "properties": {
       "config_join_key": { "type": "keyword" },

From 36e835c0936fb7d49a51517db41894eee8b89b52 Mon Sep 17 00:00:00 2001
From: Stijn Holzhauer <stijn.holzhauer@elastic.co>
Date: Mon, 1 Dec 2025 20:27:19 +0100
Subject: [PATCH 4/4] transform

---
 .../elasticsearch/transform/billing_cluster_cost/transform.yml  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/packages/chargeback/elasticsearch/transform/billing_cluster_cost/transform.yml b/packages/chargeback/elasticsearch/transform/billing_cluster_cost/transform.yml
index cc15e49d9c0..172a3d849d0 100644
--- a/packages/chargeback/elasticsearch/transform/billing_cluster_cost/transform.yml
+++ b/packages/chargeback/elasticsearch/transform/billing_cluster_cost/transform.yml
@@ -42,4 +42,4 @@ _meta:
   run_as_kibana_system: false
   # Bump this version to delete, reinstall, and restart the transform during package.
   # Version bump is needed if there is any code change in transform.
-  fleet_transform_version: 0.3.0
+  fleet_transform_version: 0.2.4