# Why does OpenSearch create a component template automatically when a detector is created, and how is it used for event analysis?

**URL:** <https://forum.opensearch.org/t/why-does-opensearch-create-a-component-template-automatically-when-a-detector-is-created-and-how-is-it-used-for-event-analysis/27141>\
**Category:** OpenSearch\
**Tags:** discuss, troubleshoot\
**Created:** [September 25, 2025, 4:12pm UTC](https://forum.opensearch.org/t/why-does-opensearch-create-a-component-template-automatically-when-a-detector-is-created-and-how-is-it-used-for-event-analysis/27141 "2025-09-25T16:12:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aravinth](https://avatars.discourse-cdn.com/v4/letter/a/f475e1/32.png) [@Aravinth](https://forum.opensearch.org/u/Aravinth)\
**Post date:** [September 25, 2025, 4:12pm UTC](https://forum.opensearch.org/t/why-does-opensearch-create-a-component-template-automatically-when-a-detector-is-created-and-how-is-it-used-for-event-analysis/27141/1 "2025-09-25T16:12:23Z")

</div>

**Describe the issue** :  
While working with ECS field mappings and index templates, I noticed that creating a detector automatically generates a component template based on the index mapping. However, this component template often has empty mappings, which prevents detections from triggering. But I have added the ECS mapping to the index template.

In contrast, when I manually map the fields (especially ECS-compliant ones) and then create a detector for the same index, the component template is correctly populated, and detections start working as expected.

I’m trying to understand:

- Why OpenSearch creates a component template during detector creation.

- How this template is used by the detector to analyze incoming events.

- Why detections fail when the auto-generated component template lacks proper mappings.

Any insights or best practices would be appreciated!

**Configuration** :

1. **Create an index template** for a specific index pattern.
2. **Add ECS field mappings directly** within the index template (not using a separate component template).
3. **Create a detector** and point it to the index that uses the above index template.
4. **Do not manually add any field mappings** during the detector creation process.
5. **After detector creation** , verify that the detector recognizes the ECS field mappings from the index.
6. **Observe that a component template is automatically created** by the detector based on the index configuration.
7. **Check the auto-generated component template** and notice that it contains **no field mappings**.

**Relevant Logs or Screenshots** :

**GET \_plugins/\_security\_analytics/mappings?index\_name=test01**

```json
{
  "test01": {
    "mappings": {
      "properties": {
        "winlog": {
          "properties": {
            "event_id": {
              "type": "alias",
              "path": "eventName"
            }
          }
        },
        "timestamp": {
          "type": "alias",
          "path": "time"
        },
        "process": {
          "properties": {
            "command_line": {
              "type": "alias",
              "path": "log.attributes.CommandLine"
            }
          }
        }
      }
    }
  }
}

```

 ![Screenshot 2025-09-25 at 9.41.37 PM](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/8/89483d5b3eaa459fbe1e34664266ac473133cf01.png)

 ![Screenshot 2025-09-25 at 9.41.04 PM](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/3cce880fe67e3813ebb1123840e235c7e96d0c3b.png)

 ![Screenshot 2025-09-25 at 9.41.27 PM](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/a/a023dcec7bc61763da63fe81dc4489b6ad9746ef.png)

---

<div class="post-metadata">

**Author:** ![Leeroy](https://avatars.discourse-cdn.com/v4/letter/l/eb9ed0/32.png) [@Leeroy](https://forum.opensearch.org/u/Leeroy)\
**Post date:** [December 18, 2025, 12:24pm UTC](https://forum.opensearch.org/t/why-does-opensearch-create-a-component-template-automatically-when-a-detector-is-created-and-how-is-it-used-for-event-analysis/27141/3 "2025-12-18T12:24:26Z")

</div>

Hi @Aravinth ,

That is a good question, A component template is a reusable building block that defines settings, mappings, and aliases and can be shared across multiple index templates.

I done some digging and I do not find anything around why they’re created automatically for detectors other than to ensure mappings.

I do think this topic needs further documentation and be a good one to report here - [GitHub · Where software is built](https://github.com/opensearch-project/documentation-website/issues) .

More on component templates can be found here

> **[Component template APIs](https://docs.opensearch.org/latest/api-reference/index-apis/component-template/)**
>
> Component template APIs

Leeroy.