In an integration set (in _dev/build/build.yml) to import ECS mappings, the build process will inject ECS's dynamic templates at elasticsearch.index_template.mappings.dynamic_templates in data_stream/<ds_name>/manifest.yml.
However, for transforms, it does not put them into destination_index_template.mappings.dynamic_templates in elasticsearch/transform/<transform_name>/manifest.yml.
The relevant code is here.
This came up while building an IOC expiry transform for OpenCTI. The workaround was to add an explicit external field reference for each ECS field used.
2025-06-11: We do still want the functionality described above. (A different thing done on 2025-06-17: adding the ecs@mappings component template in the index template created during package install by fleet for a transform destination index.)
In an integration set (in
_dev/build/build.yml) to import ECS mappings, the build process will inject ECS's dynamic templates atelasticsearch.index_template.mappings.dynamic_templatesindata_stream/<ds_name>/manifest.yml.However, for transforms, it does not put them into
destination_index_template.mappings.dynamic_templatesinelasticsearch/transform/<transform_name>/manifest.yml.The relevant code is here.
This came up while building an IOC expiry transform for OpenCTI. The workaround was to add an explicit external field reference for each ECS field used.
2025-06-11: We do still want the functionality described above. (A different thing done on 2025-06-17: adding the
ecs@mappingscomponent template in the index template created during package install by fleet for a transform destination index.)