In an integration set (in _dev/build/build.yml) to import ECS mappings, the build process will inject ECS's dynamic templates at elasticsearch.index_template.mappings.dynamic_templates in data_stream/<ds_name>/manifest.yml.

However, for transforms, it does not put them into destination_index_template.mappings.dynamic_templates in elasticsearch/transform/<transform_name>/manifest.yml.

The relevant code is here.

This came up while building an IOC expiry transform for OpenCTI. The workaround was to add an explicit external field reference for each ECS field used.