Elasticsearch is introducing v2 of index templates. To understand the motivation for this change and it's details, see: elastic/elasticsearch#53101.

In 7.x (once elastic/elasticsearch#55411 is merged), Elasticsearch indexing APIs will accept an optional query string parameter: prefer_v2_templates. In 7.x, the default value for this parameter will be false, indicating that v1 templates should be used. In 8.0, the default value will change to true, indicating that v2 templates should be used.

This issue is to track changes needed in Beats to work with v2 templates. Concretely:

• For 7.x Beats:

  • If the Beat is operating standalone (i.e. not managed via Fleet + Agent), it is responsible for creating the index template (v1) in Elasticsearch. As such, indexing calls from such Beats should pass prefer_v2_templates=false in indexing requests to Elasticsearch.
  • If the Beat is being managed by Fleet, then the Beat is not responsible for creating the index template in Elasticsearch. It assumes (maybe checks?) the index template has been created before indexing it's events. Further, Fleet will create v2 index templates. So such Beats should pass prefer_v2_templates=true in indexing requests to Elasticsearch.

• Starting 8.0.0, Beats will use v2 index templates, either ones they create on their own (in standalone mode) or because Fleet created them beforehand. So such Beats should pass prefer_v2_templates=true in indexing requests to Elasticsearch.

Related: #17829