Disable host.* fields by default for Cisco module (#18753)

For the Cisco module when data is forwarded to Filebeat from another host/device (this is most of the time) you don't want Filebeat to add `host`. So by default this modules add a `forwarded` tag to events. If you configure the module to not include the `forwarded` tag (e.g. `var.tags: [my_tag]`) then Filebeat will add the `host.*` fields.

Relates: #13920

CHANGELOG.next.asciidoc

@@ -23,10 +23,20 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - File integrity dataset (macOS): Replace unnecessary `file.origin.raw` (type keyword) with `file.origin.text` (type `text`). {issue}12423[12423] {pull}15630[15630]
 
 *Filebeat*
+
 - Improve ECS field mappings in panw module.  event.outcome now only contains success/failure per ECS specification. {issue}16025[16025] {pull}17910[17910]
 - Improve ECS categorization field mappings for nginx module. http.request.referrer only populated when nginx sets a value {issue}16174[16174] {pull}17844[17844]
 - Improve ECS field mappings in santa module. move hash.sha256 to process.hash.sha256 & move certificate fields to santa.certificate . {issue}16180[16180] {pull}17982[17982]
 - With the default configuration the cloud modules (aws, azure, googlecloud, o365, okta)
+  will no longer send the `host` field that contains information about the host Filebeat is
+  running on. This is because the `host` field specifies the host on which the event
+  happened. {issue}13920[13920] {pull}18223[18223]
+- With the default configuration the following modules will no longer send the `host`
+  field. You can revert this change by configuring tags for the module and omitting
+  `forwarded` from the list. {issue}13920[13920]
+* CEF {pull}18223[18223]
+* PANW {pull}18223[18223]
+* Cisco {pull}18753[18753]
 will no longer send the `host` field that contains information about the host Filebeat is
 running on. This is because the `host` field specifies the host on which the event
 happened. {issue}13920[13920] {pull}18223[18223]

filebeat/docs/modules/cisco.asciidoc

@@ -102,6 +102,12 @@ Set to 0.0.0.0 to bind to all available interfaces.
 
 The UDP port to listen for syslog traffic. Defaults to 9001.
 
+*`var.tags`*::
+
+A list of tags to include in events. Including `forwarded` indicates that the
+events did not originate on this host and causes `host.name` to not be added to
+events. Defaults to `[cisco-asa, forwarded]`.
+
 :has-dashboards!:
 
 :fileset_ex!:
@@ -244,6 +250,12 @@ Set to 0.0.0.0 to bind to all available interfaces.
 
 The UDP port to listen for syslog traffic. Defaults to 9003.
 
+*`var.tags`*::
+
+A list of tags to include in events. Including `forwarded` indicates that the
+events did not originate on this host and causes `host.name` to not be added to
+events. Defaults to `[cisco-ftd, forwarded]`.
+
 :has-dashboards!:
 
 :fileset_ex!:
@@ -275,6 +287,12 @@ Set to 0.0.0.0 to bind to all available interfaces.
 
 The UDP port to listen for syslog traffic. Defaults to 9002.
 
+*`var.tags`*::
+
+A list of tags to include in events. Including `forwarded` indicates that the
+events did not originate on this host and causes `host.name` to not be added to
+events. Defaults to `[cisco-ios, forwarded]`.
+
 include::../include/timezone-support.asciidoc[]
 
 :has-dashboards!:
@@ -285,10 +303,10 @@ include::../include/timezone-support.asciidoc[]
 [[dynamic-script-compilations]]
 === Dynamic Script Compilations
 
-The `asa` and `ftd` filesets are based on Elasticsearch ingest pipelines and 
-make extensive use of script processors and painless conditions. This can cause 
+The `asa` and `ftd` filesets are based on Elasticsearch ingest pipelines and
+make extensive use of script processors and painless conditions. This can cause
 the pipelines to fail loading the first time the module is used, due to exceeding
-the maximum script compilation limits. It is recommended to tune the following 
+the maximum script compilation limits. It is recommended to tune the following
 parameters on your Elasticsearch cluster:
 
 - {ref}/circuit-breaker.html#script-compilation-circuit-breaker[script.max_compilations_rate]:

x-pack/filebeat/module/cisco/_meta/docs.asciidoc

@@ -97,6 +97,12 @@ Set to 0.0.0.0 to bind to all available interfaces.
 
 The UDP port to listen for syslog traffic. Defaults to 9001.
 
+*`var.tags`*::
+
+A list of tags to include in events. Including `forwarded` indicates that the
+events did not originate on this host and causes `host.name` to not be added to
+events. Defaults to `[cisco-asa, forwarded]`.
+
 :has-dashboards!:
 
 :fileset_ex!:
@@ -239,6 +245,12 @@ Set to 0.0.0.0 to bind to all available interfaces.
 
 The UDP port to listen for syslog traffic. Defaults to 9003.
 
+*`var.tags`*::
+
+A list of tags to include in events. Including `forwarded` indicates that the
+events did not originate on this host and causes `host.name` to not be added to
+events. Defaults to `[cisco-ftd, forwarded]`.
+
 :has-dashboards!:
 
 :fileset_ex!:
@@ -270,6 +282,12 @@ Set to 0.0.0.0 to bind to all available interfaces.
 
 The UDP port to listen for syslog traffic. Defaults to 9002.
 
+*`var.tags`*::
+
+A list of tags to include in events. Including `forwarded` indicates that the
+events did not originate on this host and causes `host.name` to not be added to
+events. Defaults to `[cisco-ios, forwarded]`.
+
 include::../include/timezone-support.asciidoc[]
 
 :has-dashboards!:
@@ -280,10 +298,10 @@ include::../include/timezone-support.asciidoc[]
 [[dynamic-script-compilations]]
 === Dynamic Script Compilations
 
-The `asa` and `ftd` filesets are based on Elasticsearch ingest pipelines and 
-make extensive use of script processors and painless conditions. This can cause 
+The `asa` and `ftd` filesets are based on Elasticsearch ingest pipelines and
+make extensive use of script processors and painless conditions. This can cause
 the pipelines to fail loading the first time the module is used, due to exceeding
-the maximum script compilation limits. It is recommended to tune the following 
+the maximum script compilation limits. It is recommended to tune the following
 parameters on your Elasticsearch cluster:
 
 - {ref}/circuit-breaker.html#script-compilation-circuit-breaker[script.max_compilations_rate]:

x-pack/filebeat/module/cisco/asa/config/input.yml

@@ -15,7 +15,8 @@ exclude_files: [".gz$"]
 
 {{ end }}
 
-tags: {{.tags}}
+tags: {{.tags | tojson}}
+publisher_pipeline.disable_host: {{ inList .tags "forwarded" }}
 
 processors:
   - add_locale: ~

x-pack/filebeat/module/cisco/asa/manifest.yml

@@ -5,7 +5,7 @@ var:
     default:
       - /var/log/cisco-asa.log
   - name: tags
-    default: [cisco-asa]
+    default: [cisco-asa, forwarded]
   - name: syslog_host
     default: localhost
   - name: syslog_port

x-pack/filebeat/module/cisco/asa/test/asa-fix.log-expected.json

@@ -31,7 +31,8 @@
         "source.ip": "10.123.123.123",
         "source.port": 53723,
         "tags": [
-            "cisco-asa"
+            "cisco-asa",
+            "forwarded"
         ]
     },
     {
@@ -60,7 +61,8 @@
         "source.address": "10.123.123.123",
         "source.ip": "10.123.123.123",
         "tags": [
-            "cisco-asa"
+            "cisco-asa",
+            "forwarded"
         ]
     },
     {
@@ -90,7 +92,8 @@
         "source.ip": "10.123.123.123",
         "source.port": 6316,
         "tags": [
-            "cisco-asa"
+            "cisco-asa",
+            "forwarded"
         ]
     },
     {
@@ -122,7 +125,8 @@
         "source.ip": "10.123.123.123",
         "source.port": 57621,
         "tags": [
-            "cisco-asa"
+            "cisco-asa",
+            "forwarded"
         ]
     },
     {
@@ -146,7 +150,8 @@
         "source.address": "10.123.123.123",
         "source.ip": "10.123.123.123",
         "tags": [
-            "cisco-asa"
+            "cisco-asa",
+            "forwarded"
         ]
     }
 ]