add extended documentation/caveat

elastic · Oct 31, 2023 · f5f51a9 · f5f51a9
1 parent d51fcb6
commit f5f51a9
Show file tree

Hide file tree

Showing 4 changed files with 33 additions and 5 deletions.
diff --git a/packages/gcp/data_stream/audit/manifest.yml b/packages/gcp/data_stream/audit/manifest.yml
@@ -69,7 +69,14 @@ streams:
         required: true
         show_user: false
         title: Keep the JSON document as `gcp.audit.flattened`
-        description: Keeps a copy of the original document as a JSON field for processing in `@custom` pipelines.
+        description: >-
+          Keeps a copy of the original document as a JSON field for processing in `@custom` pipelines.
+          Any fields that are in the original GCP document may renamed, copied or otherwire unprocessed
+          from the field's path relative to `gcp.audit.flattened`. GCP documents may be large and so
+          will potentially add significant storage cost if retained after completion of the ingest
+          pipeline. It is the responsibility of the user to remove the `gcp.audit.flattened` field
+          after `@custom` pipeline processors have been executed if the complete flattened field is
+          not needed.
         type: bool
         multi: false
         default: false

diff --git a/packages/gcp/data_stream/dns/manifest.yml b/packages/gcp/data_stream/dns/manifest.yml
@@ -68,8 +68,15 @@ streams:
       - name: keep_json
         required: true
         show_user: false
-        title: Keep the JSON document as `gcp.audit.flattened`
-        description: Keeps a copy of the original document as a JSON field for processing in `@custom` pipelines.
+        title: Keep the JSON document as `gcp.dns.flattened`
+        description: >-
+          Keeps a copy of the original document as a JSON field for processing in `@custom` pipelines.
+          Any fields that are in the original GCP document may renamed, copied or otherwire unprocessed
+          from the field's path relative to `gcp.dns.flattened`. GCP documents may be large and so
+          will potentially add significant storage cost if retained after completion of the ingest
+          pipeline. It is the responsibility of the user to remove the `gcp.dns.flattened` field
+          after `@custom` pipeline processors have been executed if the complete flattened field is
+          not needed.
         type: bool
         multi: false
         default: false

diff --git a/packages/gcp/data_stream/firewall/manifest.yml b/packages/gcp/data_stream/firewall/manifest.yml
@@ -69,7 +69,14 @@ streams:
         required: true
         show_user: false
         title: Keep the JSON document as `gcp.firewall.flattened`
-        description: Keeps a copy of the original document as a JSON field for processing in `@custom` pipelines.
+        description: >-
+          Keeps a copy of the original document as a JSON field for processing in `@custom` pipelines.
+          Any fields that are in the original GCP document may renamed, copied or otherwire unprocessed
+          from the field's path relative to `gcp.firewall.flattened`. GCP documents may be large and so
+          will potentially add significant storage cost if retained after completion of the ingest
+          pipeline. It is the responsibility of the user to remove the `gcp.firewall.flattened` field
+          after `@custom` pipeline processors have been executed if the complete flattened field is
+          not needed.
         type: bool
         multi: false
         default: false

diff --git a/packages/gcp/data_stream/vpcflow/manifest.yml b/packages/gcp/data_stream/vpcflow/manifest.yml
@@ -69,7 +69,14 @@ streams:
         required: true
         show_user: false
         title: Keep the JSON document as `gcp.vpcflow.flattened`
-        description: Keeps a copy of the original document as a JSON field for processing in `@custom` pipelines.
+        description: >-
+          Keeps a copy of the original document as a JSON field for processing in `@custom` pipelines.
+          Any fields that are in the original GCP document may renamed, copied or otherwire unprocessed
+          from the field's path relative to `gcp.vpcflow.flattened`. GCP documents may be large and so
+          will potentially add significant storage cost if retained after completion of the ingest
+          pipeline. It is the responsibility of the user to remove the `gcp.vpcflow.flattened` field
+          after `@custom` pipeline processors have been executed if the complete flattened field is
+          not needed.
         type: bool
         multi: false
         default: false