From da331d9e685ae11592261bf0048d0e5163fcf25c Mon Sep 17 00:00:00 2001
From: Chris Mark <chrismarkou92@gmail.com>
Date: Fri, 4 Feb 2022 13:02:23 +0000
Subject: [PATCH] Add pipeline in FB's supported hints (#30212)

(cherry picked from commit 9fda7dd53f59605771bd5f2390f50d49d32d8135)
---
 CHANGELOG.next.asciidoc                     |  3 ++-
 filebeat/autodiscover/builder/hints/logs.go |  9 +++++++++
 filebeat/docs/autodiscover-hints.asciidoc   | 10 ++++++++++
 3 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 38b66dd71ac..2053f6ab0d7 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -158,6 +158,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Add support for filtering in journald input with `unit`, `kernel`, `identifiers` and `include_matches`. {pull}29294[29294]
 - Add new `userAgent` and `beatInfo` template functions for httpjson input {pull}29528[29528]
 - threatintel module: Add new Recorded Future integration. {pull}30030[30030]
+- Add pipeline in FB's supported hints. {pull}30212[30212]
 
 *Heartbeat*
 
@@ -175,7 +176,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Add `elasticsearch.cluster.id` field to Beat and Kibana modules. {pull}29577[29577]
 - Add `elasticsearch.cluster.id` field to Logstash module. {pull}29625[29625]
 - Add `xpack.enabled` support for Enterprise Search module. {pull}29871[29871]
-- Add gcp firestore metricset. {pull}29918[29918] 
+- Add gcp firestore metricset. {pull}29918[29918]
 - Remove strict parsing on RabbitMQ module {pull}30090[30090]
 
 *Packetbeat*
diff --git a/filebeat/autodiscover/builder/hints/logs.go b/filebeat/autodiscover/builder/hints/logs.go
index 5a09bb41780..9c29852dff3 100644
--- a/filebeat/autodiscover/builder/hints/logs.go
+++ b/filebeat/autodiscover/builder/hints/logs.go
@@ -44,6 +44,7 @@ const (
 	excludeLines = "exclude_lines"
 	processors   = "processors"
 	json         = "json"
+	pipeline     = "pipeline"
 )
 
 // validModuleNames to sanitize user input
@@ -121,6 +122,10 @@ func (l *logHints) CreateConfig(event bus.Event, options ...ucfg.Option) []*comm
 			tempCfg.Put(processors, procs)
 		}
 
+		if pip := l.getPipeline(h); len(pip) != 0 {
+			tempCfg.Put(pipeline, pip)
+		}
+
 		if jsonOpts := l.getJSONOptions(h); len(jsonOpts) != 0 {
 			tempCfg.Put(json, jsonOpts)
 		}
@@ -187,6 +192,10 @@ func (l *logHints) getProcessors(hints common.MapStr) []common.MapStr {
 	return builder.GetProcessors(hints, l.config.Key)
 }
 
+func (l *logHints) getPipeline(hints common.MapStr) string {
+	return builder.GetHintString(hints, l.config.Key, "pipeline")
+}
+
 func (l *logHints) getJSONOptions(hints common.MapStr) common.MapStr {
 	return builder.GetHintMapStr(hints, l.config.Key, json)
 }
diff --git a/filebeat/docs/autodiscover-hints.asciidoc b/filebeat/docs/autodiscover-hints.asciidoc
index 55b8f4adb5f..78e95810693 100644
--- a/filebeat/docs/autodiscover-hints.asciidoc
+++ b/filebeat/docs/autodiscover-hints.asciidoc
@@ -90,6 +90,16 @@ co.elastic.logs/processors.dissect.tokenizer: "%{key2} %{key1}"
 
 In the above sample the processor definition tagged with `1` would be executed first.
 
+[float]
+===== `co.elastic.logs/pipeline`
+
+Define an ingest pipeline ID to be added to the {beatname_uc} input/module configuration.
+
+[source,yaml]
+-----
+co.elastic.logs/pipeline: custom-pipeline
+-----
+
 [float]
 ==== Kubernetes