Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add pipeline in FB's supported hints #30212

Merged
merged 2 commits into from
Feb 4, 2022
Merged

Add pipeline in FB's supported hints #30212

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
16d542e
Add pipeline in FB's supported hints
ChrsMark Feb 4, 2022
e447a94
Add changelog
ChrsMark Feb 4, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion CHANGELOG.next.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,6 +157,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...main[Check the HEAD dif
- Add support for filtering in journald input with `unit`, `kernel`, `identifiers` and `include_matches`. {pull}29294[29294]
- Add new `userAgent` and `beatInfo` template functions for httpjson input {pull}29528[29528]
- threatintel module: Add new Recorded Future integration. {pull}30030[30030]
- Add pipeline in FB's supported hints. {pull}30212[30212]

*Heartbeat*

Expand All @@ -174,7 +175,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...main[Check the HEAD dif
- Add `elasticsearch.cluster.id` field to Beat and Kibana modules. {pull}29577[29577]
- Add `elasticsearch.cluster.id` field to Logstash module. {pull}29625[29625]
- Add `xpack.enabled` support for Enterprise Search module. {pull}29871[29871]
- Add gcp firestore metricset. {pull}29918[29918]
- Add gcp firestore metricset. {pull}29918[29918]
- Remove strict parsing on RabbitMQ module {pull}30090[30090]

*Packetbeat*
Expand Down
9 changes: 9 additions & 0 deletions filebeat/autodiscover/builder/hints/logs.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@ const (
excludeLines = "exclude_lines"
processors = "processors"
json = "json"
pipeline = "pipeline"
)

// validModuleNames to sanitize user input
Expand Down Expand Up @@ -121,6 +122,10 @@ func (l *logHints) CreateConfig(event bus.Event, options ...ucfg.Option) []*comm
tempCfg.Put(processors, procs)
}

if pip := l.getPipeline(h); len(pip) != 0 {
tempCfg.Put(pipeline, pip)
}

if jsonOpts := l.getJSONOptions(h); len(jsonOpts) != 0 {
tempCfg.Put(json, jsonOpts)
}
Expand Down Expand Up @@ -187,6 +192,10 @@ func (l *logHints) getProcessors(hints common.MapStr) []common.MapStr {
return builder.GetProcessors(hints, l.config.Key)
}

func (l *logHints) getPipeline(hints common.MapStr) string {
return builder.GetHintString(hints, l.config.Key, "pipeline")
}

func (l *logHints) getJSONOptions(hints common.MapStr) common.MapStr {
return builder.GetHintMapStr(hints, l.config.Key, json)
}
Expand Down
10 changes: 10 additions & 0 deletions filebeat/docs/autodiscover-hints.asciidoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,16 @@ co.elastic.logs/processors.dissect.tokenizer: "%{key2} %{key1}"

In the above sample the processor definition tagged with `1` would be executed first.

[float]
===== `co.elastic.logs/pipeline`

Define an ingest pipeline ID to be added to the {beatname_uc} input/module configuration.

[source,yaml]
-----
co.elastic.logs/pipeline: custom-pipeline
-----

[float]
==== Kubernetes

Expand Down