Elasticsearch 9.x

[kuseman]

The datastreams mappings/indextemplates has changed quite a bit since 8 which means no indexed queries can be made since that is built support for this (truth with modification, it works if targeting a speciic index/aliss but not asterisk * indices)

The structure in 9 is:

/_index_template/ now returns an array of composed_of which contains names of componet templates which
can be reached at /_component_template where the mappings are present.

It also needs som dynamic_template support ie.:

"dynamic_templates" : [
            {
              "ecs_timestamp" : {
                "mapping" : {
                  "ignore_malformed" : false,
                  "type" : "date"
                },
                "match" : "@timestamp"
              }
            },

here we need to parse the "match" etc.

Needs some investigations