[Fleet] experimental toggles for doc-value-only

[juliaElastic]

Summary

Closes #144357

WIP. Review can be started, but still requires a lot of testing and fixing the issue below.

How to test locally:

• Turn on experimentalDataStreamSettings feature flag
• Go to Add integration, System integration
• On the first data stream, turn on the Doc value only switches, Save
• The mapping changes are visible under Stack Management / Index Management / Component Templates e.g. logs-system.auth@package
• The numeric switch sets index:false on all numeric field mappings (long, double, etc.)
• The other switch sets index:false on all other field type mappings that support it (keyword, ip, date, etc.)
• The new mappings will take effect after rollover

What works:

• When turning the new doc-value-only numeric and other checkboxes on or off, the corresponding mapping changes are done in the component template
• The logic also reads the package spec's template and preserves the index:false values regardless of the switch (tested manually by setting @timestamp field to index:false in the template, there is also the original field in logs-system.auth@package stream that is set to index:false in the package by default.

"original": {
    "index": false,
    "doc_values": false,
    "type": "keyword"
},

Pending:

• Add/update unit and integration tests to verify the mapping change logic - DONE
• Manual testing (turning the switches on/off, create/update package policy, upgrade package) - DONE
• Clarify TODOs in the code about the supported types - DONE
• Hitting an issue when turning on doc-value-only for "other" types (keyword, date, etc.). Could be that one of the fields doesn't support index:false setting. Didn't experience this when turning on only the numeric types. - FIXED

illegal_argument_exception: [illegal_argument_exception] Reason: updating component template [logs-system.auth@package] results in invalid composable template [logs-system.auth] after templates are merged

EDIT: found the root cause of this: Caused by: java.lang.IllegalArgumentException: data stream timestamp field [@timestamp] is not indexed

Checklist

Delete any items that are not applicable to this PR.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Unit or functional tests were updated or added to match the most common scenarios

[nchaulet]

@juliaElastic should we look at experimental feature when we install the package as we do for synthetic or tsdb so the experimental feature is keeped after a package upgrade?

[juliaElastic]

should we look at experimental feature when we install the package as we do for synthetic or tsdb so the experimental feature is keeped after a package upgrade?

@nchaulet yeah, I think that piece is missing, I didn't have a chance to test the package upgrade scenario yet

EDIT: this is done, added the logic to the package install flow as well.
Testing steps

• force install an older system package
• add a package policy with doc-values-only flags enabled
• upgrade the package
• check that the numeric/other field mappings still have the index:false setting

[pgayvallet]

We're trying to limit mapping additions to what's strictly necessary. Sometimes, developers aren't aware that defining your field in mappings is only required if you need to query against them. Rest of the time, using dynamic: false is sufficient.

So I need to ask: are these new properties used for querying? Is there any value defining them in the mappings?

[juliaElastic]

I think we don't need to query on these fields. @joshdover @ruflin Could you confirm?

[joshdover]

I can't think of any reason we'd be querying on these right now in the application.

[juliaElastic]

@pgayvallet updated with dynamic:false

[ruflin]

++. If we ever have to query on it, we could use a runtime as the total number of these docs will be reasonable small.

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[juliaElastic]

@elasticmachine merge upstream

[kpollich]

Code LGTM, one question though

The logic also reads the package spec's template and preserves the index:false values regardless of the switch (tested manually by setting @timestamp field to index:false in the template, there is also the original field in logs-system.auth@package stream that is set to index:false in the package by default.

Should the switch be toggle-able at all if index: false is present in the package spec, or should it be in a disabled state with a tooltip?

[kpollich]

Thanks for creating this separate module to organize these helper utilities.

[juliaElastic]

Should the switch be toggle-able at all if index: false is present in the package spec, or should it be in a disabled state with a tooltip?

So the switch refers to all numeric (or other) type fields in the package spec, while index:false is a setting per field. So unless all numeric (or other) type fields have this setting, we can't disable the switch.

[nchaulet]

LGTM 🚀

[kibana-ci]

💚 Build Succeeded

• Buildkite Build
• Commit: 451b9be

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
fleet	921.6KB	922.6KB	+1.0KB

History

• 💚 Build #102226 succeeded 561accf
• 💔 Build #102138 failed d4b456b
• 💔 Build #102056 failed 16deee0
• 💔 Build #101450 failed 2536f3d
• 💚 Build #101392 succeeded 6cfb5d2
• 💔 Build #101374 failed ed6a251

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @juliaElastic