elastic / package-spec

EPR package specifications
Other
17 stars 70 forks source link

[Change Proposal] Allow to define expected_event_types #770

Open jsoriano opened 2 months ago

jsoriano commented 2 months ago

Similar to https://github.com/elastic/package-spec/pull/616, allow to define expected_event_types as part of allowed_values.

expected_* values in ECS are not mandatory, but we want to keep the validations by default to offer guidance to package developers, to use consistent values for the fields that have these recommendations. Though as we did with expected_values in https://github.com/elastic/package-spec/pull/616, we could offer the possibility to override the values, to adjust them to the use case of the package.

Some previous conversations about this: