Multiple ways to do that were investigated in the past. The most generic is probably to install an ingest pipeline for `logs-*-*` data streams during setup. This is currently not possible in Elasticsearch, so this task should begin with investigation of the feasibility of this option. If we can add this capability natively to Elasticsearch, we will be able to benefit from it for other things we plan to do through ingest pipelines later on, like automatic detection of JSON inputs and rerouting (to enable automatic dataset separation, for example based on automatically discovered services).
x-pack/plugin/stack/src/main/java/org/elasticsearch/xpack/stack/StackTemplateRegistry.java
}
    private static final Map<String, ComposableIndexTemplate> COMPOSABLE_INDEX_TEMPLATE_CONFIGS = parseComposableTemplates(
        new IndexTemplateConfig(LOGS_INDEX_TEMPLATE_NAME, "/logs-template.json", REGISTRY_VERSION, TEMPLATE_VERSION_VARIABLE),
        new IndexTemplateConfig(METRICS_INDEX_TEMPLATE_NAME, "/metrics-template.json", REGISTRY_VERSION, TEMPLATE_VERSION_VARIABLE),
        new IndexTemplateConfig(SYNTHETICS_INDEX_TEMPLATE_NAME, "/synthetics-template.json", REGISTRY_VERSION, TEMPLATE_VERSION_VARIABLE)
    );
    @Override
    protected Map<String, ComposableIndexTemplate> getComposableTemplateConfigs() {
        if (stackTemplateEnabled) {
            return COMPOSABLE_INDEX_TEMPLATE_CONFIGS;
        } else {
            return Map.of();
        }
    }
    @Override
    protected String getOrigin() {
        return ClientHelper.STACK_ORIGIN;
    }
    @Override
    protected boolean requiresMasterNode() {
        
        
        
        
        
        
        return true;
    }
}