[aws_logs] Remove fixed value from event.dataset mapping

[zmoog]

Proposed commit message

Remove the constant value logs-aws_logs.generic from the event.dataset mapping.

Context

The Custom AWS Logs integration is an integration package, so it doesn't automatically create a new index template for each installation, as input packages do.

To overcome this single index template limit, users manually clone the logs-aws_logs.generic index template (for more context, see the comment) and adapt it for a custom dataset.

Unfortunately, all index template clones reference the same logs-aws_logs.generic@package component template that maps event.dataset as constant_keyword with a constant value of logs-aws_logs.generic. This means data streams created from the cloned index templates reject documents with event.dataset values other than logs-aws_logs.generic.

Changes

In this PR I removed the fixed value, but we have at least two options:

• We can keep the event.dataset mapping as constant_keyword without the fixed value to logs-aws_logs.generic.
• Change the mapping to keyword to align with ECS https://www.elastic.co/docs/reference/ecs/ecs-event#field-event-dataset to give users more flexibility.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

• Install the Custom AWS Logs integration using aws_logs.custom as custom dataset.
• Clone the logs-aws_logs.generic index template as logs-aws_logs.custom, setting the new index pattern as logs-aws_logs.custom-*.
• Try to index a document in the Dev Tools using the following request:

POST logs-aws_logs.custom-default/_doc
{
  "@timestamp": "2025-10-01T13:39:29+02:00",
  "whatever": "yeah",
  "event": {
    "dataset": "aws_logs.custom"
  }
}

ES should index the document successfully.

Related issues

• Relates [Custom AWS Logs] The field event.dataset should not be mapped as constant_keyword. #13433 (see comment)

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 30327ac

History

• 💚 Build #32150 succeeded f6b86ba

cc @zmoog

[elastic-vault-github-plugin-prod]

Package aws_logs - 1.8.3 containing this change is available at https://epr.elastic.co/package/aws_logs/1.8.3/