Forbid - in namespace in reroute processor

[carsonip]

- character is not allowed in ECS data_stream.namespace spec.

Fixes #112936

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?
• If submitting code, have you built your formula locally prior to submission with gradle check?
• If submitting code, is your pull request against main? Unless there is a good reason otherwise, we prefer pull requests against main and will backport as needed.
• If submitting code, have you checked that your submission is for an OS and architecture that we support?
• If you are submitting this code for a class then read our policy for that.

[carsonip]

Not sure if "bug" is the best description. This is going to break use cases where people are using non-compliant namespace with - in it.

[carsonip]

@mattc58 should it be something other than "bug"?

[elasticsearchmachine]

Pinging @elastic/es-data-management (Team:Data Management)

[mattc58]

Thanks @carsonip. Wouldn't this be a breaking change though? If a user has successfully used this in pipelines to create namespaces with the - character wouldn't this now break them?

[carsonip]

Thanks @carsonip. Wouldn't this be a breaking change though? If a user has successfully used this in pipelines to create namespaces with the - character wouldn't this now break them?

Correct. That is also why I left the above comment about breaking use cases where people rely on the bug.

There are 2 parts to this change, one part at factory and another at runtime. The factory part does worry me a bit as valid processor will become invalid on upgrade. I don't know whether it will fail the upgrade, stop ingestion, or make ES fail to start. (If you actually have the answer to that, I'll be interested to know.) Now that I think more about the implications, I'm more inclined to ship it in 9.0 with no backports.

On the apm-server end, we are likely going to ship it as a bugfix in 8.16 where we change from no sanitization to replacing all invalid chars, but the impact surface will be limited to use cases where user specifically configured data stream routing attributes in OpenTelemetry (see elastic/apm-server#14043), and it will just index documents to a different data stream at max.

[carsonip]

Would be good to get @felixbarny 's eyes on this as it is initially written explicitly in a way that allows - in namespace but not dataset.

[carsonip]

Closing this PR as we may approach the issue #112936 with an opposite fix.