ecs-field-mappings

To define ECS field mappings, populate ecs.yml with ECS field references and set the external: ecs flag. This ensures your data streams align correctly with the ECS schema during package development.

elastic-package lint fails when ecs.yml has incorrect field types, improper nesting for nested fields, or missing external: ecs declarations. Validate your data stream mappings against the ECS schema to resolve these failures.

Configuring data_stream.* routing constants in ecs.yml requires choosing appropriate field types like constant_keyword. This ensures proper ECS categorization and routing for your data pipelines.

You need to use external: ecs in ecs.yml whenever you reference standard ECS fields. This flag enforces schema conformity and allows elastic-package validation to verify field types and coverage.

elastic-package provides the lint and test validation needed to verify data stream schemas against ECS references. Without it, you cannot automatically enforce ECS field coverage and schema conformity.