While an explicit limit specified in the elasticsearch config of the datastream manifest of the package is respected, in order to avoid breaking existing integrations, the limit of 10,000 is kept if there are more than 500 fields explicitly specified as part of the datastream in the package.
This heuristic should eventually be removed in a safe way:
Create a new breaking spec version for elastic package
In the fleet code, check for the spec version - if it's using a version higher than the newly cut version, do not apply the heuristic
In elastic-package, add a check that validates statically that the 1000 field limit is not broken if no explicit field limit is set
With https://github.com/elastic/kibana/pull/178398, the default field limit for data streams created via fleet was limited to 1000 from the previous default of 10,000.
While an explicit limit specified in the
elasticsearch
config of the datastream manifest of the package is respected, in order to avoid breaking existing integrations, the limit of 10,000 is kept if there are more than 500 fields explicitly specified as part of the datastream in the package.This heuristic should eventually be removed in a safe way: