Defining @timestamp with an external: ecs definition fails linting. For example:
# fields/ecs.yml
- external: ecs
name: '@timestamp'
It seems that all packages currently have an @timestamp defined in their base-fields.yml and do not use the ECS definition. When you remove that definition and try to rely on the ECS definition lint fails.
Lint the package
Error: linting package failed: found 2 validation errors:
1. expected type "date" for required field "@timestamp", found "" in "/Users/akroh/code/elastic/integrations/packages/crowdstrike/data_stream/falcon/fields/ecs.yml"
2. expected type "date" for required field "@timestamp", found "" in "/Users/akroh/code/elastic/integrations/packages/crowdstrike/data_stream/fdr/fields/ecs.yml"
Defining
@timestampwith anexternal: ecsdefinition fails linting. For example:It seems that all packages currently have an
@timestampdefined in theirbase-fields.ymland do not use the ECS definition. When you remove that definition and try to rely on the ECS definitionlintfails.