x-pack/osquerybeat: rename query profiling config and enable profiling by default

[marc-gr]

Proposed commit message

Consolidate the osquerybeat query profiling settings under a single elastic_options.profiling block (ProfilingConfig):

• profiling_all is the fleet-wide default and storage keeps local retention of live profiles for diagnostics.
• Profiling is now enabled by default: profiling_all defaults to true when unset, and individual queries/actions may override it via their own profiling flag.
• Per-query and per-action overrides are tri-state (*bool) so an unset value inherits the global default while an explicit false opts out.

WHY: the previous naming (profile / query_profile_storage, boolean enabled) conflated the profiling activity with the produced profile artifacts and defaulted profiling off. Renaming to profiling and defaulting on makes the configuration clearer and profiling available out of the box, while still allowing per-query opt-out.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works.
• I have added an entry in ./changelog/fragments using the changelog tool.

Disruptive User Impact

The profiling configuration keys are renamed (elastic_options.profiling, profiling_all, per-query profiling) and profiling now defaults to on. This profiling feature has not yet shipped in a released version, so there is no migration required for existing deployments.

How to test this PR locally

• cd x-pack/osquerybeat && go test ./beater/ ./internal/config/ ./internal/action/
• mage update and confirm osquerybeat.reference.yml shows the profiling block with profiling_all: true.

Related issues

[infra-vault-gh-plugin-prod]

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)
• /test : Run the Buildkite pipeline.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: ba34412c-1164-470e-9c25-80173029a3fc

📥 Commits

Reviewing files that changed from the base of the PR and between d1dcf6f and cbc3a73.

📒 Files selected for processing (2)

• x-pack/osquerybeat/beater/config_plugin.go
• x-pack/osquerybeat/beater/config_plugin_test.go

🚧 Files skipped from review as they are similar to previous changes (2)

• x-pack/osquerybeat/beater/config_plugin_test.go
• x-pack/osquerybeat/beater/config_plugin.go

---

📝 Walkthrough

Walkthrough

Changes

This PR renames osquerybeat profiling settings from profile and query_profile_storage to profiling, with pointer-based overrides for unset behavior. It adds a fleet-wide default profiling setting, resolves it with per-query and per-action overrides, and uses that resolved value in config generation and profile publishing. The reference configuration examples, tests, and changelog fragment are updated to match.

Sequence Diagram(s)

Included in the hidden review stack artifact above.

Compact metadata
Related issues: Not specified in provided context.
Related PRs: Not specified in provided context.
Suggested labels: enhancement, osquerybeat
Suggested reviewers: Not specified in provided context.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

• 🛠️ Update Documentation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@x-pack/osquerybeat/beater/config_plugin.go`:
- Around line 84-88: The live profiling default in ConfigPlugin is incorrectly
left at Go’s zero value, so ad-hoc queries can start with profiling disabled
until the first successful Set() call. Initialize the default in NewConfigPlugin
by setting globalProfileEnabled to true (matching ProfilingAllOrDefault() and
the documented fleet-wide default), and keep set()/Set() as the mechanism for
applying later overrides in config_plugin.go and the related default handling in
action_handler.go.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 41440362-a40f-4f16-89f1-7d3ab24bed2e

📥 Commits

Reviewing files that changed from the base of the PR and between eada494 and d1dcf6f.

📒 Files selected for processing (11)

• changelog/fragments/1783001090-osquerybeat-profiling-config.yaml
• x-pack/osquerybeat/_meta/config/beat.reference.yml.tmpl
• x-pack/osquerybeat/beater/action_handler.go
• x-pack/osquerybeat/beater/config_plugin.go
• x-pack/osquerybeat/beater/config_plugin_test.go
• x-pack/osquerybeat/beater/osquerybeat.go
• x-pack/osquerybeat/internal/action/action.go
• x-pack/osquerybeat/internal/action/action_test.go
• x-pack/osquerybeat/internal/config/config.go
• x-pack/osquerybeat/internal/config/osquery.go
• x-pack/osquerybeat/osquerybeat.reference.yml

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request