Too Many Transforms Automatically Recreated

Elastic Stack Elasticsearch
1

Elasticsearch cluster (version 8.17.0) I see numerous transforms are being created automatically. Even when I delete these transforms, they are recreated immediately.

image
image1719×598 72.4 KB

The transforms follow a naming pattern like:

  • entities-v1-latest-builtin_containers_from_ecs_data
  • entities-v1-latest-builtin_kubernetes_cluster_ecs
  • entities-v1-latest-builtin_hosts_from_ecs_data

All of them are in continuous mode and are managed.

I suspect these transforms might be related to Entity Analytics , but I am unsure.

  • These transforms are part of which built-in features?
  • Is there a way to disable or prevent their recreation?

thanks

2

I've been trying to pare down my cloud cluster and have been messing around with these transforms quite a bit. I think because the feature is in beta it is not very well documented. These transforms are created when you enable the Elastic Entity Model. I would like more documentation on what each one does, because I certainly want to use the framework but probably don't need everything that's going on with these.
For example, most of the kubernetes transforms seem to be using metrics-kubernetes* or metrics-otel as their source index. We don't have any kubernetes clusters and will have no data in these indices, but if I turn it off it breaks the inventory screen and it simply asks to be enabled again. These transforms should be documented and potentially give the option to turn on/off specific resources.