Relates #1229
Follows #2206

In order to try to be agnostic to the structure of the documents ingested to run the validation in system tests. It would be helpful to run validations comparing the mapping definitions instead.

Use the mappings found in the preview template or in the data stream API to validate the runtime fields present in the hits returned by Elasticsearch as part of the system tests.

# preview mappings API POST /_index_template/_simulate/<index_template_name> # Example POST /_index_template/_simulate/logs-microsoft_dhcp.log # actual data stream mappings API GET /<data_stream_test>/_mapping/ 

Related documentation about runtime fields:
https://www.elastic.co/guide/en/elasticsearch/reference/current/runtime-mapping-fields.html

For now, the errors that could be raised as part of this validation should not make fail the validation process, therefore:

• Ignore at this step mappings not found in the preview, to be done in the next step.
• Enable via environment variable this mapping or show just just warning messages.

To be tested:

• Run these validations in stack 7.x
• Run these validations in stack 8.x
• Run these validations in input and integration packages.
• Run these validations in Stacks with LogsDB enabled (synthetics).