Add more disallowed characters, require lower case

Author: felixbarny

spec/spec.json

@@ -73,6 +73,14 @@
             "required": false,
             "url": "https://www.elastic.co/guide/en/ecs/current/ecs-event.html",
             "default": "${service.name}.log OR ${service.name}.${appender.name}",
+            "sanitization": {
+                "value": {
+                    "replacements": ["\\", "/", "*", "?", "\"", "<", ">", "|", " ", ",", "#", ":", "-"],
+                    "substitute": "_",
+                    "max_chars": 100,
+                    "lower_case": true
+                }
+            },
             "comment": [
                 "Configurable by users.",
                 "If the user manually configures the service name,",
@@ -84,29 +92,28 @@
                 "",
                 "The field helps to filter for different log streams from the same pod, for example and is required for log anomaly detection.",
                 "",
-                "Should have the same value as `data_stream.dataset`.",
-                "",
-                "In 8.0, `event.dataset` will be removed in favor of `data_stream.dataset`."
+                "Must be in sync with `data_stream.dataset`."
             ]
         },
         "data_stream.dataset": {
             "type": "string",
             "required": false,
-            "url": "https://github.com/elastic/ecs/pull/1145",
+            "url": "https://github.com/elastic/ecs/blob/master/rfcs/text/0009-data_stream-fields.md",
             "default": "${service.name}.log OR ${service.name}.${appender.name}",
             "sanitization": {
                 "value": {
-                    "replacements": ["\\", "/", "*", "?", "\"", "<", ">", "|", " ", "-"],
+                    "replacements": ["\\", "/", "*", "?", "\"", "<", ">", "|", " ", ",", "#", ":", "-"],
                     "substitute": "_",
-                    "max_chars": 100
+                    "max_chars": 100,
+                    "lower_case": true
                 }
             },
             "comment": [
                 "Configurable by users.",
                 "Influences which data stream the logs will be stored in (`logs-{data_stream.dataset}-{data_stream.namespace}`)",
                 "If unspecified, Filebeat will set the value to `generic`.",
                 "",
-                "Should have the same value as `event.dataset`."
+                "Must be in sync with `event.dataset`."
             ]
         },
         "data_stream.namespace": {
@@ -116,17 +123,18 @@
             "default": null,
             "sanitization": {
                 "value": {
-                    "replacements": ["\\", "/", "*", "?", "\"", "<", ">", "|", " "],
+                    "replacements": ["\\", "/", "*", "?", "\"", "<", ">", "|", " ", ",", "#", ":"],
                     "substitute": "_",
-                    "max_chars": 100
+                    "max_chars": 100,
+                    "lower_case": true
                 }
             },
             "comment": [
                 "Configurable by users.",
                 "Influences which data stream the logs will be stored in (`logs-{data_stream.dataset}-{data_stream.namespace}`)",
                 "If unspecified, Filebeat will set the value to `default`.",
                 "",
-                "Should have the same value as `event.dataset`."
+                "Must be in sync with `data_stream.dataset`."
             ]
         },
         "process.thread.name": {