diff --git a/packages/chargeback/_dev/build/build.yml b/packages/chargeback/_dev/build/build.yml
deleted file mode 100755
index 97fc8aa10cd..00000000000
--- a/packages/chargeback/_dev/build/build.yml
+++ /dev/null
@@ -1,3 +0,0 @@
-dependencies:
-  ecs:
-    reference: git@v8.17.0
diff --git a/packages/chargeback/elasticsearch/transform/cluster_tier_and_ds_contribution/transform.yml b/packages/chargeback/elasticsearch/transform/cluster_tier_and_ds_contribution/transform.yml
index 42cc3927e0b..bb743556e92 100644
--- a/packages/chargeback/elasticsearch/transform/cluster_tier_and_ds_contribution/transform.yml
+++ b/packages/chargeback/elasticsearch/transform/cluster_tier_and_ds_contribution/transform.yml
@@ -25,14 +25,20 @@ pivot:
           lang: painless
           source: >
             if (doc.containsKey('elasticsearch.index.tier') && !doc['elasticsearch.index.tier'].empty) {
+              def itier = doc.containsKey('elasticsearch.index.tier') && !doc['elasticsearch.index.tier'].empty ? doc['elasticsearch.index.tier'].value : null;
+              if (itier == null) return 'unknown';
+              if (itier.contains('hot') || itier.contains('hot/content') || itier.contains('content')) return 'datahot/datacontent';
+              if (itier.contains('warm')) return 'datawarm';
+              if (itier.contains('cold')) return 'datacold';
+              if (itier.contains('frozen')) return 'datafrozen';
               return doc['elasticsearch.index.tier'].value;
             }
             def pref = doc.containsKey('elasticsearch.index.tier_preference') && !doc['elasticsearch.index.tier_preference'].empty ? doc['elasticsearch.index.tier_preference'].value : null;
             if (pref == null) return 'unknown';
-            if (pref.contains('data_hot') || pref.contains('data_content')) return 'hot/content';
-            if (pref.contains('data_warm')) return 'warm';
-            if (pref.contains('data_cold')) return 'cold';
-            if (pref.contains('data_frozen')) return 'frozen';
+            if (pref.contains('data_hot') || pref.contains('data_content')) return 'datahot/datacontent';
+            if (pref.contains('data_warm')) return 'datawarm';
+            if (pref.contains('data_cold')) return 'datacold';
+            if (pref.contains('data_frozen')) return 'datafrozen';
             return 'unknown';
     datastream:
       terms:
diff --git a/packages/chargeback/elasticsearch/transform/cluster_tier_contribution/transform.yml b/packages/chargeback/elasticsearch/transform/cluster_tier_contribution/transform.yml
index 99b14d3b52d..d06040b3143 100644
--- a/packages/chargeback/elasticsearch/transform/cluster_tier_contribution/transform.yml
+++ b/packages/chargeback/elasticsearch/transform/cluster_tier_contribution/transform.yml
@@ -25,15 +25,21 @@ pivot:
           lang: painless
           source: >
             if (doc.containsKey('elasticsearch.index.tier') && !doc['elasticsearch.index.tier'].empty) {
+              def itier = doc.containsKey('elasticsearch.index.tier') && !doc['elasticsearch.index.tier'].empty ? doc['elasticsearch.index.tier'].value : null;
+              if (itier == null) return 'unknown';
+              if (itier.contains('hot') || itier.contains('hot/content') || itier.contains('content')) return 'datahot/datacontent';
+              if (itier.contains('warm')) return 'datawarm';
+              if (itier.contains('cold')) return 'datacold';
+              if (itier.contains('frozen')) return 'datafrozen';
               return doc['elasticsearch.index.tier'].value;
             }
             
             def pref = doc.containsKey('elasticsearch.index.tier_preference') && !doc['elasticsearch.index.tier_preference'].empty ? doc['elasticsearch.index.tier_preference'].value : null;
             if (pref == null) return 'unknown';
-            if (pref.contains('data_hot') || pref.contains('data_content')) return 'hot/content';
-            if (pref.contains('data_warm')) return 'warm';
-            if (pref.contains('data_cold')) return 'cold';
-            if (pref.contains('data_frozen')) return 'frozen';
+            if (pref.contains('data_hot') || pref.contains('data_content')) return 'datahot/datacontent';
+            if (pref.contains('data_warm')) return 'datawarm';
+            if (pref.contains('data_cold')) return 'datacold';
+            if (pref.contains('data_frozen')) return 'datafrozen';
             return 'unknown';
   aggregations:
     tier_sum_indexing_time: