Add ability to detect if index-pattern implements ECS

[thomasneirynck]

It would be useful if we could determine if an index-pattern implements ECS.

This is especially relevant because ECS has tighter semantics on some of the fields.

e.g. in ECS (https://www.elastic.co/guide/en/ecs/current/ecs-geo.html), the *.geo.country_iso_code and *.geo.region_iso_code fields contain iso-3166-1 and iso-3166-2 identifiers respectively. The UX can use these for initializing configurations for maps with countries or provinces/states/... without requiring the user to manually configure this.

[elasticmachine]

Pinging @elastic/kibana-app-arch (Team:AppArch)

[mattkime]

This definitely sounds like something index patterns should help with.

Index pattern content is very closely tied to the _field_caps api call. It would be helpful if the info we needed somehow fit into its results. It certainly should be available somewhere in ES since index pattern lists need to be regenerated.

Maybe we can figure out how this might work and take a guess at the effort level. Then we can place it on the roadmap.

[thomasneirynck]

thanks @mattkime ,happy to help evaluate this. Maps would have an immediate use for it. We're adding more&more layer-templates to Maps (e.g. SIEM, APM, ...), which aim to "auto-magically" configure layers requiring the least manual intervention. The latest example is where this would be useful would be here #69699

[thomasneirynck]

Maps introduced a utility that added some heuristic for the geo-field names #94969, to determine if they match ECS-geo-field names.

[elasticmachine]

Pinging @elastic/kibana-data-discovery (Team:DataDiscovery)

[kertal]

Quick chat of @jughosta with @kertal: "When users create data views, they could get more insights about the targeted indices, if they contain ECS data and maybe about the fields, it's about preventing unexpected errors when there are field conflicts"

[kertal]

@thomasneirynck do you have some updates about ECS related topics and the usage in Kibana?

[kertal]

@mattkime to add detection seems to be a low hanging fruit when fields are available (the data view ain't lazy), it just needs to check for the ecs.version field

[kertal]

Closing this because it's not planned to be resolved in the foreseeable future. It will be tracked in our Icebox and will be re-opened if our priorities change. Feel free to re-open if you think it should be melted sooner.