[Stack Management] Component Template edit adds settings which were not originally present

[lucabelluccini]

Kibana version: 8.14, 8.15 but also previous versions are affected

Describe the bug:

When editing a component_template, the mapping gets updated with some settings which were not originally present.

This is made worse by the fact some of those settings are not visible to the user through the wizard as they're hidden behind some tabs.

Example: Date formats under Advanced settings

This flow is particularly used by people using Fleet Integrations when they want to customize the @custom component templates. We also see options like _source set to enabled which can generate "big" problems on the next rollover if the data stream using the component template is supposed to be LogsDB or TSDB (as they might use synthetic source).

Steps to reproduce:

I'm using logs-apm.app@custom as an example.

1. Start a deployment in ESS
2. Go on Kibana Development Console and run GET /_component_template/logs-apm.app@custom. You'll get:

   {
     "component_templates": [
       {
         "name": "logs-apm.app@custom",
         "component_template": {
           "template": {
             "settings": {}
           },
           "_meta": {
             "package": {
               "name": "apm"
             },
             "managed_by": "fleet",
             "managed": true
           }
         }
       }
     ]
   }

3. Go to /app/management/data/index_management/indices.
4. Go to Component Templates and pick logs-apm.app@custom
5. Go on Manage > Edit
6. Just go to Next through the wizard, then Save
7. Go on Kibana Development Console and run GET /_component_template/logs-apm.app@custom. You'll get:

   {
     "component_templates": [
       {
         "name": "logs-apm.app@custom",
         "component_template": {
           "template": {
             "mappings": {
               "_routing": {
                 "required": false
               },
               "numeric_detection": false,
               "dynamic_date_formats": [
                 "strict_date_optional_time",
                 "yyyy/MM/dd HH:mm:ss Z||yyyy/MM/dd Z"
               ],
               "dynamic": true,
               "_source": {
                 "excludes": [],
                 "includes": [],
                 "enabled": true
               },
               "date_detection": true,
               "subobjects": true
             }
           },
           "_meta": {
             "package": {
               "name": "apm"
             },
             "managed_by": "fleet",
             "managed": true
           }
         }
       }
     ]
   }

Expected behavior:

• Going through the edit with no modifications we should end up having exactly the same behavior.
• Adding fields should not trigger any _source change behind the scenes
• Would be nice to do a dry-run check to validate editing the component template would still allow rollovers on all the data streams using it. I think this is not possible now but would be a good enhancement. I think we should open a separate issue for it.

[elasticmachine]

Pinging @elastic/kibana-management (Team:Kibana Management)

[alisonelizabeth]

Hi @lucabelluccini

This is a known issue unfortunately, see: https://github.com/elastic/kibana/issues/106006

Given the impact when used with logsdb and tsdb, we are discussing what our best options are to address.