Backport PR #14472 to 8.4: winlogbeat-modules: add docs for interfacing winlogbeat with logstash #14512
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport PR #14472 to 8.4 branch, original message:
These are taken from the filebeat-modules doc with minor changes to
localise to winlogbeat and to remove the fully worked example.
Release notes
[rn:skip]
What does this PR do?
This adds documentation to help users understand how to interface winlogbeat with logstash.
Why is it important/What is the impact to the user?
Prior to Winlogbeat 8.0 processor pipelines were run internally within Winlogbeat as js, but now are ingest pipelines. This has caused issues for some users who were previously using logstash to process/forward the js-processed documents and are now in the position of needing to perform the enrichment steps that were previously done by the js code. The documentation here is intended to help these users understand how they can obtain the ingest pipelines needed to pre-process their existing logstash pipelines, or to directly forward the documents through logstash.
Checklist
I have commented my code, particularly in hard-to-understand areasdocsI have made corresponding change to the default configuration files (and/or docker env variables)I have added tests that prove my fix is effective or that my feature worksdocsAuthor's Checklist
How to test this PR locally
Related issues
Use cases
Screenshots
Logs