Doc: Add docs for Auditbeat add_session_metadata processor

[karenzone]

Relates #40186

PREVIEW: https://beats_bk_40252.docs-preview.app.elstc.co/guide/en/beats/auditbeat/master/add-session-metadata.html

Proposed commit message

Adds docs for configuring and enabling add_session_metadata processor for Auditbeat. This processor powers the Session View tool in the Elastic Security Platform.

ToDo: Find out how (if at all) the different doc location impacts our docs tooling. DONE

Most processors and docs live in https://github.com/elastic/beats/tree/main/libbeat/processors
The add_session_metadata processor lives in https://github.com/elastic/beats/tree/main/x-pack/auditbeat/processors/sessionmd`.

Partner PR required to get docs building (conf.yaml)

• Add x-pack-auditbeat to conf.yaml docs#3038

Dependency to break free of gridlock created by changes in two repos:

• Auditbeat: Add placeholder for new docs directory and file #40357

[mergify]

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @karenzone? 🙏.
For such, you'll need to label your PR with:

• The upcoming major version of the Elastic Stack
• The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-v8./d.0 is the label to automatically backport to the 8./d branch. /d is the digit

[karenzone]

Please review and comment so that we can nail down the content.

[karenzone]

Builds locally, but fails PR checks.

buildkite/docs-build-pr — Failed

INFO:build_docs:asciidoctor: ERROR: ../../libbeat/docs/processors-list.asciidoc: line 187: include file not found: /tmp/docsbuild/h360rSjkek/beats/x-pack/auditbeat/processors/sessionmd/docs/add_session_metadata.asciidoc
  | INFO:build_docs:asciidoctor: WARNING: invalid reference: add-session-metadata

Notes to self @karenzone:

• New x-pack docs location is present in conf.yaml: https://github.com/elastic/docs/blob/master/conf.yaml#L1676-L1678
• Placeholder PR passed CI and merged without error.
  Nothing is building yet because we haven't merged any includes.
• This seems to point to an error in the include statement in libbeat/docs/processors-list.asciidoc in this PR. But then why would this work when I build locally???

Update - What's going on?

(Updated 2024-0805, M)
The conditional setting ifndef::no_add_session_metadata_processor[] should be set in the index.asciidoc file for Beats in which the new add_session_metadata_processor setting should NOT appear. (Think exclusion, not inclusion!) That's all Beats with the exception of Auditbeat.

Thank you @dedemorton, for the brilliant troubleshooting help. ❤️

[karenzone]

Update: After recent changes, this PR is passing docs-ci. New add_session_metadata processor content is added to Auditbeat Ref, and is excluded for all other Beats references as intended.

PREVIEW: https://beats_bk_40252.docs-preview.app.elstc.co/guide/en/beats/auditbeat/master/add-session-metadata.html

[karenzone]

@mjwolf, thank you so much for answering remaining questions and suggesting some text. I have committed your work with only minor edits.

Please review and let's get this one published.

[mjwolf]

Looks good!

[nick-alayil]

LGTM. Thanks @karenzone and @mjwolf !!

[kilfoyle]

LGTM! 🎸

[karenzone]

Status

This PR touches every Beat, and requires approval from all Beats code owners. We're missing approvals from obs-ds-hosted-services and @VihasMakwana. Please review so that we can get these docs published.

[pierrehilbert]

@karenzone Vihas is in PTOs until end of the week

[karenzone]

12686

[karenzone]

Link: https://www.elastic.co/guide/en/beats/auditbeat/master/add-session-metadata.html