Skip to content

[Fleet] Adjust index templates for "otelcol" inputs #232628

@jsoriano

Description

@jsoriano

Elasticsearch includes some index and component templates intended for OTel data. Users can start sending data to data streams that will use this OTel templates if they match with patterns such as logs-*.otel-* or metrics-*.otel-*.

For packages, the created index templates should also include these component templates, but also the usual component templates used for fleet, that allow custom processing as well as some default logic.

So index templates created for data streams of otelcol inputs have these requirements:

  • As a convention, they must contain the otel suffix at the end of their dataset, so they would look like logs-*.otel-* or metrics-*.otel-* The Elasticsearch exporter adds this suffix, we still need to update the index pattern.
  • They should include the same component templates included in the default templates for OTel, that can be found here.
  • In addition they should contain @package and @custom templates included in current packages, so package developers and users can still customize mappings or pipelines.
  • Fleet final pipeline should also be called, to support some common features like event.ingested, preserve_original_event and so on.

This will affect data streams of packages using the special otelcol input, supported since #227673.

Metadata

Metadata

Assignees

Labels

Team:FleetTeam label for Observability Data Collection Fleet team

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions