Dynamic Mappings set to false on index templates despite showing true in the UI

[CarsonHrusovsky]

Elasticsearch Version

8.16.1

Installed Plugins

No response

Java Version

23.0.0.0

OS Version

Windows Server 2019 1809

Problem Description

I first noticed this in the logs-endpoint.events.process index template (but I doubt this is just an endpoint issue). Within the Managed Index Template, dynamic mappings is set to "false". Before updating to 8.16.1 this was set to "true" and has thus broken our dynamic mappings we were relying on. Regardless of this - the true issue is the fact that mappings are set to false in this template despite this clearly showing when investigating the UI.

"mappings": { "dynamic": "false", "_meta": { "managed_by": "fleet", "managed": true, "package": { "name": "endpoint" } },

If I were to toggle this off and then on again, the preview will show this.

"mappings": { "dynamic": "true", "_meta": { "managed_by": "fleet", "managed": true, "package": { "name": "endpoint" } },

This seems like a bug. Additionally, the replacement of dynamic mappings from 'true' to 'false' here is very frustrating as dynamic mappings is configured for this index template under the ecs@mappings component template, but isn't enabled by default.

Steps to Reproduce

My steps to recreate was to update to 8.16.1 from 8.15.2. I would guess this is default behavior for this index template - but I am not without a doubt sure of this.

Logs (if relevant)

No response

[nicpenning]

Related: #150395 ?

[PeteGillinElastic]

Thanks for the report. It sounds like the first issue here is that the kibana UI is showing dynamic mappings as enabled, when the API shows them as disabled. That seems like a kibana issue rather than an elasticsearch issue, so I'm going to transfer this to the kibana repo for them to investigate. (If there is an ES issue then the kibana team will obviously report that to us.)

[nicpenning]

Should the managed templates for this and other elastic Defend integrations be set to dynamic mapping: true? It is concerning if something is forcing these to be dynamic mapping off.