Why does OpenSearch create a component template automatically when a detector is created, and how is it used for event analysis?

[Aravinth]

Describe the issue:
While working with ECS field mappings and index templates, I noticed that creating a detector automatically generates a component template based on the index mapping. However, this component template often has empty mappings, which prevents detections from triggering. But I have added the ECS mapping to the index template.

In contrast, when I manually map the fields (especially ECS-compliant ones) and then create a detector for the same index, the component template is correctly populated, and detections start working as expected.

I’m trying to understand:

• Why OpenSearch creates a component template during detector creation.

• How this template is used by the detector to analyze incoming events.

• Why detections fail when the auto-generated component template lacks proper mappings.

Any insights or best practices would be appreciated!

Configuration:

1. Create an index template for a specific index pattern.
2. Add ECS field mappings directly within the index template (not using a separate component template).
3. Create a detector and point it to the index that uses the above index template.
4. Do not manually add any field mappings during the detector creation process.
5. After detector creation, verify that the detector recognizes the ECS field mappings from the index.
6. Observe that a component template is automatically created by the detector based on the index configuration.
7. Check the auto-generated component template and notice that it contains no field mappings.

Relevant Logs or Screenshots:

GET _plugins/_security_analytics/mappings?index_name=test01

{
  "test01": {
    "mappings": {
      "properties": {
        "winlog": {
          "properties": {
            "event_id": {
              "type": "alias",
              "path": "eventName"
            }
          }
        },
        "timestamp": {
          "type": "alias",
          "path": "time"
        },
        "process": {
          "properties": {
            "command_line": {
              "type": "alias",
              "path": "log.attributes.CommandLine"
            }
          }
        }
      }
    }
  }
}

[Leeroy]

Hi @Aravinth ,

That is a good question, A component template is a reusable building block that defines settings, mappings, and aliases and can be shared across multiple index templates.

I done some digging and I do not find anything around why they’re created automatically for detectors other than to ensure mappings.

I do think this topic needs further documentation and be a good one to report here - GitHub · Where software is built .

More on component templates can be found here

Component template APIs

Leeroy.