For most datasets inside a package, we know in advance the type and the dataset value. But currently we do not publish it in the fields.yml: https://github.com/elastic/integrations/blob/master/packages/nginx/dataset/access/fields/base-fields.yml#L1 Instead this could look as following:
- name: data_stream.type
type: constant_keyword
description: Data stream type.
value: log
- name: data_stream.dataset
type: constant_keyword
description: Data stream dataset.
value: nginx.access
The benefit of prepopulating is that it would ensure no wrong values get put into it and if incompatible data already exists, Ingest Manager would rollover the data stream when the package is installed.
An alternative idea is that Ingest Manager adds it as all the info already exists in the manifest.
For most datasets inside a package, we know in advance the type and the dataset value. But currently we do not publish it in the fields.yml: https://github.com/elastic/integrations/blob/master/packages/nginx/dataset/access/fields/base-fields.yml#L1 Instead this could look as following:
The benefit of prepopulating is that it would ensure no wrong values get put into it and if incompatible data already exists, Ingest Manager would rollover the data stream when the package is installed.
An alternative idea is that Ingest Manager adds it as all the info already exists in the manifest.