User guide content is outdated for index pattern/namespace.

[dikshachauhan-qasource]

Description: User guide content is outdated for index pattern/namespace.

As per comment at #79818Comment, information related to index creation for namespace needs to be updated at the below referral links.

• https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-create-index.html#indices-create-api-path-params
• Reference yml section on page: https://www.elastic.co/guide/en/fleet/7.10/elastic-agent-configuration.html

Further, we have noticed that same out-dated information is provided in elastic-agent.yml files when extracted and downloaded from elastic-agent packages[includes all packages].

Artifact link: https://snapshots.elastic.co/7.10.2-31a765b2/downloads/beats/elastic-agent/elastic-agent-7.10.2-SNAPSHOT-windows-x86_64.zip

Please refer attached screenshot.

Reference ticket Id:
elastic/kibana#79818 (comment)

Actual Result
Information at user guide and elastic-agent.yml is out-dated.

Expected Result
User guides should be updated with latest information applicable for valid index namespace creation.

What's working

• As per information provided at above mentioned comment, we are able to create namespace as per rules.
• Proper validation message is displayed for incorrect entries.

What's not working
Also currently, we are able to create namespace for policies and integrations using below points from referral guide.
[Link: https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-create-index.html#indices-create-api-path-params]

Cannot start with -, _, +

• Able to create namespace starting with _ and + symbols

Cannot be . or ..

• Able to create namespace starting with . and ..

Names starting with . are deprecated, except for hidden indices and internal indices managed by plugins

• Able to create namespace starting with .

Here, could you please confirm us expected behavior on our above observations.

[manishgupta-qasource]

Reviewed & Assigned to @jmikell821

[EricDavisX]

@dedemorton is this on the Ingest side for us to update, I think?

[dedemorton]

@EricDavisX Yes, it is. This issue seems to impact the Elastic Agent and Elasticsearch docs, not the security docs. With all the cross-team work that's happening right now, though, it's understandable that folks might not know where to open issues. The agent docs live in the observability-docs repo right now. @jmikell821 Should we just transfer this issue to observability-docs?

[debadair]

I just verified that the documented limitations are correct. You cannot create an Elasticsearch index with a name that starts with _ or +, or name your index . or .. You can still create indices that begin with a dot, but that is deprecated and will be disallowed in the future.

[dedemorton]

So it sounds like the Elasticsearch docs are good, but that we need to update the docs in the Elastic Agent YAML file. Since the Elastic Agent source currently lives in the Beats repo, I will transfer this issue to that repo (and not observability-docs as I stated previously).

I don't think we want the YAML to repeat all the Elasticsearch index naming restrictions plus the agent namespace restrictions. We just need to mention the restrictions that are added for agent. Deb suggested: Must conform to the naming conventions for Elasticsearch indices and cannot exceed 100 bytes.

[elasticmachine]

Pinging @elastic/obs-docs (Team:Docs)