Skip to content

[ML] Transforms: Wizard should "alert" me when using a data view with @timestamp instead of event.ingested #152451

Open

Description

Describe the feature:

As the title says. We highly recommend to use event.ingested, to not miss any documents. https://www.elastic.co/guide/en/elasticsearch/reference/current/transform-checkpoints.html#sync-field-ingest-timestamp

Still when using a data view that uses @timestamp you can miss documents and not get any information about it. Would it be possible to leverage the create data view on the fly without saving that is now available in Lens and Discover and base the transform upon that?

Screenshot 2023-03-01 at 13 19 03

Even better would be, I select logs, transform alerts me about @timestamp, I can click ignore, change to event.ingested and the transform creates a temp data view for event.ingested, without me noticing anything.

Of course, that would require some kind of logic for the transform to verify that the event.ingested field is populated.

Describe a specific use case for the feature:
Ux improvements.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions