[Logs+] Adding ECS dynamic templates

docs/changelog/96171.yaml

@@ -0,0 +1,6 @@
+pr: 96171
+summary: "Adding ECS dynamic mappings component and applying it to logs data streams by default"
+area: Data streams
+type: enhancement
+issues:
+ - 95538

modules/data-streams/src/yamlRestTest/resources/rest-api-spec/test/data_stream/210_logs_custom_mappings.yml

@@ -13,6 +13,10 @@
  properties:
  numeric_field:
  type: integer
+ socket:
+ properties:
+ ip:
+ type: keyword
 
  - do:
  indices.create_data_stream:
@@ -35,3 +39,33 @@
  index: $idx0name
  # verify that the new field from the custom component template is applied
  - match: { .$idx0name.mappings.properties.numeric_field.type: "integer" }
+
+ - do:
+ index:
+ index: logs-generic-default
+ refresh: true
+ body:
+ test: 'doc-with-ip'
+ socket:
+ ip: 127.0.0.1
+ - match: {result: "created"}
+
+ - do:
+ search:
+ index: logs-generic-default
+ body:
+ query:
+ term:
+ test:
+ value: 'doc-with-ip'
+ fields:
+ - field: 'socket.ip'
+ - length: { hits.hits: 1 }
+ - match: { hits.hits.0._source.socket.ip: '127.0.0.1' }
+
+ - do:
+ indices.get_mapping:
+ index: $idx0name
+ # test overriding of ECS dynamic template
+ - match: { .$idx0name.mappings.properties.socket.properties.ip.type: "keyword" }
+