Description
Describe the feature:
As the title says. We highly recommend to use event.ingested, to not miss any documents. https://www.elastic.co/guide/en/elasticsearch/reference/current/transform-checkpoints.html#sync-field-ingest-timestamp
Still when using a data view that uses @timestamp
you can miss documents and not get any information about it. Would it be possible to leverage the create data view on the fly without saving
that is now available in Lens and Discover and base the transform upon that?
Even better would be, I select logs
, transform alerts me about @timestamp
, I can click ignore, change to event.ingested
and the transform creates a temp data view for event.ingested, without me noticing anything.
Of course, that would require some kind of logic for the transform to verify that the event.ingested field is populated.
Describe a specific use case for the feature:
Ux improvements.