Add Custom data streams docs

[alexandra5000]

What does this PR do?

Introduces a new page describing advanced data stream routing in EDOT. The page explains when routing customization is appropriate, the recommended pattern of using data_stream.namespace, the risks associated with modifying data_stream.dataset, and the naming constraints for template-based routing.

Why is it important?

Until now, this information existed only in a KB and was not discoverable in the official documentation.

Checklist

• I have read and understood the pull request guidelines of this project.
  - [ ] My code follows the style guidelines of this project
  - [ ] I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
  - [ ] I have made corresponding change to the default configuration files
  - [ ] I have added tests that prove my fix is effective or that my feature works
  - [ ] I have added an entry in ./changelog/fragments using the changelog tool
  - [ ] I have added an integration test or an E2E test

Disruptive User Impact

None

Related issues

Closes #4133

Generative AI disclosure

1. Did you use a generative AI (gen AI) tool to assist in creating this contribution?

• Yes
• No

2. If you answered "Yes" to the previous question, please specify the tool(s) and model(s) used (e.g., Google Gemini, OpenAI ChatGPT-4, etc.).

Tool(s) and model(s) used: Claude 4.5 Sonnet via Cursor

[github-actions]

🔍 Preview links for changed docs

• docs/reference/edot-collector/config/custom-data-streams.md
• docs/reference/edot-collector/config/index.md

[elasticmachine]

Pinging @elastic/ingest-docs (Team:Docs)

[theletterf]

Excellent! Let's get a review by an ingest lead (@AlexanderWert and @jlind23)

[jlind23]

Also any other content pack that you end installing though.
cc @AlexanderWert

[alexandra5000]

Good point, thanks for pointing that out!

[bmorelli25]

I feel like the order of information could be better here. Right now it's:

1. Should I customize?
2. Which part is safe to change?
3. What is the naming sctructure?
4. Which part is safe to change? (again)
5. Which part is dangerous to change and why?

I think it'd be better as:

1. Should I customize?
2. If yes, what is the naming sctructure?
3. Which part is safe to change?
4. Which part is dangerous to change and why?

---

for example

---

When to customize data streams

The only recommended use case for customizing data stream routing is to separate data by environment (for example: dev, staging, and prod).

A data stream name follows this structure:

<type>-<dataset>-<namespace>

We recommend changing only data_stream.namespace, not data_stream.dataset.

data_stream.namespace

The namespace is intended as the configurable part of the name. Elastic dashboards, detectors, and UIs support multiple namespaces automatically.

data_stream.dataset

Only modify dataset if it's absolutely necessary and you're aware of the tradeoffs. Changing the dataset value can cause:

• list of downsides

[alexandra5000]

I see what you mean. I've changed the order - see if you like it better now

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b custom-data-streams upstream/custom-data-streams
git merge upstream/main
git push upstream custom-data-streams

[bmorelli25]

Thanks for making those changes!