[Fleet] fix content package task interval config

[juliaElastic]

Summary

Follow up for https://github.com/elastic/ingest-dev/issues/5685

Fix fleet config to change auto install content packages task interval:

# enable feature flag
xpack.fleet.enableExperimental: ['enableAutoInstallContentPackages']

# change interval
xpack.fleet.autoInstallContentPackages.taskInterval: 15s

Also use prerelease flag from settings to be able to test auto install prerelease content package like system_otel:

Added discovery.datasets field to system_otel package to test with, but for some reason the datasets values are not showing up in the EPR response (PR)
Tested with the package built locally and starting a local registry:
system_otel-0.2.0.zip

Update: this now works, had to pull the latest registry docker image

# start local registry
docker run -v /Users/juliabardi/kibana/x-pack/platform/test/fleet_api_integration/apis/fixtures/package_registry_config.yml:/package-registry/config.yml -v /Users/juliabardi/kibana/x-pack/platform/test/fleet_api_integration/apis/fixtures/test_packages:/packages/test-packages -v /Users/juliabardi/kibana/x-pack/platform/test/fleet_api_integration/apis/fixtures/package_verification/packages/zips:/packages/signed-test-packages -p 12345:8080 docker.elastic.co/package-registry/distribution:lite

# use local registry in kibana config
xpack.fleet.registryUrl: http://localhost:12345

http://localhost:12345/search?prerelease=true&type=content&spec.min=2.3&spec.max=3.4&discovery=datasets:hostmetricsreceiver.otel

[
{
name: "system_otel",
title: "System OpenTelemetry Assets",
version: "0.2.0",
release: "beta",
description: "Dashboards for the OpenTelemetry data collected with the `hostmetrics` receiver.",
type: "content",
...
discovery: {
datasets: [
{
name: "hostmetricsreceiver.otel"
}
]
}
}
]

Generated some otel data by following the instructions in OpenTelemetry integration in a multipass VM:

arch=$(if ([[ $(arch) == "arm" || $(arch) == "aarch64" ]]); then echo "arm64"; else echo $(arch); fi)
curl --output elastic-distro-9.1.0-linux-$arch.tar.gz --url https://artifacts.elastic.co/downloads/beats/elastic-agent/elastic-agent-9.1.0-linux-$arch.tar.gz --proto '=https' --tlsv1.2 -fL && mkdir -p elastic-distro-9.1.0-linux-$arch && tar -xvf elastic-distro-9.1.0-linux-$arch.tar.gz -C "elastic-distro-9.1.0-linux-$arch" --strip-components=1 && cd elastic-distro-9.1.0-linux-$arch
rm ./otel.yml && cp ./otel_samples/platformlogs_hostmetrics.yml ./otel.yml && mkdir -p ./data/otelcol && sed -i 's#\${env:STORAGE_DIR}#'"$PWD"/data/otelcol'#g' ./otel.yml && sed -i 's#\${env:ELASTIC_ENDPOINT}#http://192.168.64.1:9200#g' ./otel.yml && sed -i 's/\${env:ELASTIC_API_KEY}/NEdfc2RKZ0JobV8xTXQxMjk0cUY6XzliVWIzSDRYZVBFSU9Ea05FTFdJdw==/g' ./otel.yml

And updating pipelines:

vim otel.yml 

service:
  extensions: [file_storage]
  pipelines:
    metrics/hostmetrics:
receivers: [hostmetrics/system]
processors: [resourcedetection, attributes/dataset, resource/process]
exporters: [elasticsearch/otel]

# start collector
 sudo ./otelcol --config otel.yml

For some reason the ES|QL query in the task doesn't return the hostmetricsreceiver.otel dataset, but is returned when running the same query in dev tools. Might be a permission issue.

FROM logs-*,metrics-*,traces-*
| KEEP @timestamp, data_stream.dataset | WHERE @timestamp > NOW() - 15 minutes 
| STATS COUNT(*) BY data_stream.dataset 

{
  "took": 6,
  "is_partial": false,
  "documents_found": 5752,
  "values_loaded": 5752,
      "columns": [
    {
      "name": "COUNT(*)",
      "type": "long"
    },
    {
      "name": "data_stream.dataset",
      "type": "keyword"
    }
  ],
  "values": [
    [
      115,
      "elastic_agent"
    ],
    [
      27,
      "elastic_agent.filebeat"
    ],
    [
      3,
      "elastic_agent.status_change"
    ],
    [
      1696,
      "elastic_agent.metricbeat"
    ],
    [
      3336,
      "elastic_agent.fleet_server"
    ],
    [
      271,
      "fleet_server.agent_versions"
    ],
    [
      271,
      "fleet_server.agent_status"
    ]
  ]
}

Update: Yes, it seems kibana_system didn't have privileges to read the integration data streams.
Tested locally by adding read access, and now the query returns the expected results and installs the otel content package.
I'll create a pr to the elasticsearch repo. Here it is: elastic/elasticsearch#132400

# checkout ES pr, start es from source
yarn es source --license trial -E xpack.security.authc.api_key.enabled=true -E xpack.security.authc.token.enabled=true  --source-path=/Users/juliabardi/elasticsearch  -E path.data=/tmp/es-data -E xpack.ml.enabled=false -E http.host=0.0.0.0

# kibana logs that run the task
[2025-08-04T15:51:43.748+02:00][DEBUG][plugins.fleet.fleet:auto-install-content-packages-task:1.0.1] [AutoInstallContentPackagesTask] Found datasets with data: hostmetricsreceiver.otel, elastic_agent, fleet_server.agent_status, system.process.summary, system.socket_summary, elastic_agent.filebeat_input, elastic_agent.metricbeat, elastic_agent.filebeat, system.memory, elastic_agent.elastic_agent, generic.otel, elastic_agent.status_change, hostmetricsreceiver, elastic_agent.fleet_server, system.uptime, system.cpu, system.process, system.filesystem, system.fsstat, system.load, fleet_server.agent_versions, system.network, system.diskio
[2025-08-04T15:51:43.748+02:00][DEBUG][plugins.fleet.fleet:auto-install-content-packages-task:1.0.1] [AutoInstallContentPackagesTask] Content packages to install: system_otel@0.2.0
[2025-08-04T15:51:43.748+02:00][DEBUG][plugins.fleet] Kicking off install of system_otel-0.2.0 from registry

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
• This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
• Flaky Test Runner was used on any tests changed
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
• Review the backport guidelines and apply applicable backport:* labels.

Identify risks

Does this PR introduce any risks? For example, consider risks like hard to test bugs, performance regression, potential of data loss.

Describe the risk, its severity, and mitigation for each identified risk. Invite stakeholders and evaluate how to proceed before merging.

• See some risk examples
• ...

[kibanamachine]

Cloud deployment initiated, see credentials at: https://buildkite.com/elastic/kibana-deploy-cloud-from-pr/builds/324

[florent-leborgne]

LGTM for docs

[elasticmachine]

Pinging @elastic/fleet (Team:Fleet)

[juliaElastic]

Removed the 100 limit, because there can be much more than 100 datasets when many packages are installed. And even when filtering out datasets from already installed content packages, there might still be many non-content package datasets.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 6e155fb
• Cloud Deployment

Metrics [docs]

✅ unchanged

History

• 💔 Build #326040 failed ef1603f
• 💔 Build #325978 failed 372346f
• 💔 Build #325894 failed 456335c

cc @juliaElastic

[criamico]

Code LGTM

[jillguyonnet]

LGTM