We merged basic transforms support in #307, but there are several outstanding and related problems that remain to be solved.

Short-term - hard blockers for next security packages

• Add transform to spec #307
• [Fleet] Implement new transform installation mechanism kibana#134321
  • This implements the package-spec definition above so transforms in packages can actually be installed. Until this is finished, packages can contain transforms, but they will not be installed.
• [Fleet] Support installing transforms without granting kibana_system index privileges kibana#137278
  • kibana_system is currently used to install all transforms. This is necessary in the Endpoint case where the package must be upgraded along with Kibana. CSP may need this too.
  • The problem with this is that it requires kibana_system to be granted read/write privileges to transform src/dest indices

Medium-term - likely not hard blockers for next security packages

• Better upgrade strategy for transforms
  • Rebuilding transform destination indices can be very expensive, but is necessary in some cases
  • Should avoid it in obvious upgrade scenarios (eg. a visualization was updated)
  • Updating the frequency or delay is supported by the transform API, Fleet could leverage this to avoid re-building transforms unnecessarily so.
  • Will definitely need to destroy and re-create a transform when the aggregation or fields have changed. This could be improved, but likely lower priority at this time.
• [Discuss] Support stored scripts in Fleet packages #202

Long-term

• Space-specific transforms #460
• Enforce the data stream naming convention for transform src and dest indices