[O11y][Salesforce] Add support of the interval parameter in Salesforce setupaudittrail-rest fileset.

CHANGELOG.asciidoc

@@ -239,6 +239,7 @@ automatic splitting at root level, if root level element is an array. {pull}3415
 - Improve CEL input documentation {pull}34831[34831]
 - Add metrics documentation for CEL and AWS CloudWatch inputs. {issue}34887[34887] {pull}34889[34889]
 - Metrics hosted by the HTTP monitoring endpoint for the `aws-cloudwatch`, `aws-s3`, `cel`, and `lumberjack` inputs are now available under `/inputs/` instead of `/dataset`.
+- Add support of the interval parameter in Salesforce setupaudittrail-rest fileset. {issue}35917[35917] {pull}35938[35938]
 
 *Heartbeat*
 

CHANGELOG.next.asciidoc

@@ -327,6 +327,7 @@ automatic splitting at root level, if root level element is an array. {pull}3415
 - Add Okta input package for entity analytics. {pull}35611[35611]
 - Expose harvester metrics from filestream input {pull}35835[35835] {issue}33771[33771]
 - Add device support for Azure AD entity analytics. {pull}35807[35807]
+- Add support of the interval parameter in Salesforce setupaudittrail-rest fileset. {issue}35917[35917] {pull}35938[35938]
 
 *Auditbeat*
    - Migration of system/package module storage from gob encoding to flatbuffer encoding in bolt db. {pull}34817[34817]

filebeat/docs/modules/salesforce.asciidoc

@@ -225,6 +225,7 @@ Example config:
     var.user: "my.email@here.com"
     var.password: "password"
     var.url: "https://instance-url.salesforce.com"
+    var.interval: 1h
 ----
 
 include::../include/var-paths.asciidoc[]
@@ -253,6 +254,12 @@ The password used as part of the authentication flow. It is required for authent
 
 The URL of the Saleforce instance.
 
+*`var.interval`*::
+
+Period of fetching logs, i.e. 1s/1m/1h. 
+
+Note: It is important to exercise caution when reducing the interval, as it directly affects the API rate limit of the Salesforce instance. Please refer to the following link for the https://developer.salesforce.com/docs/atlas.en-us.salesforce_app_limits_cheatsheet.meta/salesforce_app_limits_cheatsheet/salesforce_app_limits_platform_api.htm[Salesforce API Rate Limit].
+
 [float]
 ==== `apex-rest` fileset settings
 

x-pack/filebeat/filebeat.reference.yml

@@ -1999,7 +1999,9 @@ filebeat.modules:
 
     # URL, should include the instance_url
     #var.url: "https://instance_id.my.salesforce.com"
-
+
+    # Interval, should include the time interval
+    #var.interval: 1h
 #----------------------------- Google Santa Module -----------------------------
 - module: santa
   log:

x-pack/filebeat/module/salesforce/_meta/config.yml

@@ -125,3 +125,6 @@
 
     # URL, should include the instance_url
     #var.url: "https://instance_id.my.salesforce.com"
+
+    # Interval, should include the time interval
+    #var.interval: 1h

x-pack/filebeat/module/salesforce/_meta/docs.asciidoc

@@ -218,6 +218,7 @@ Example config:
     var.user: "my.email@here.com"
     var.password: "password"
     var.url: "https://instance-url.salesforce.com"
+    var.interval: 1h
 ----
 
 include::../include/var-paths.asciidoc[]
@@ -246,6 +247,12 @@ The password used as part of the authentication flow. It is required for authent
 
 The URL of the Saleforce instance.
 
+*`var.interval`*::
+
+Period of fetching logs, i.e. 1s/1m/1h. 
+
+Note: It is important to exercise caution when reducing the interval, as it directly affects the API rate limit of the Salesforce instance. Please refer to the following link for the https://developer.salesforce.com/docs/atlas.en-us.salesforce_app_limits_cheatsheet.meta/salesforce_app_limits_cheatsheet/salesforce_app_limits_platform_api.htm[Salesforce API Rate Limit].
+
 [float]
 ==== `apex-rest` fileset settings
 

x-pack/filebeat/modules.d/salesforce.yml.disabled

@@ -128,3 +128,6 @@
 
     # URL, should include the instance_url
     #var.url: "https://instance_id.my.salesforce.com"
+
+    # Interval, should include the time interval
+    #var.interval: 1h