expected_* values in ECS are not mandatory, but we want to keep the validations by default to offer guidance to package developers, to use consistent values for the fields that have these recommendations. Though as we did with expected_values in https://github.com/elastic/package-spec/pull/616, we could offer the possibility to override the values, to adjust them to the use case of the package.
Similar to https://github.com/elastic/package-spec/pull/616, allow to define
expected_event_types
as part ofallowed_values
.expected_*
values in ECS are not mandatory, but we want to keep the validations by default to offer guidance to package developers, to use consistent values for the fields that have these recommendations. Though as we did withexpected_values
in https://github.com/elastic/package-spec/pull/616, we could offer the possibility to override the values, to adjust them to the use case of the package.Some previous conversations about this: