elastic / elastic/beats

Add input metrics to Auditbeat

Open
#36,945 8 comments 1 reaction 0 assignees View on GitHub
Auditbeat enhancement Team:Security-Service Integrations
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 2h
Merged PRs (30d)
364

Description

Set up Auditbeat to use libbeat's [`inputmon` package](https://github.com/elastic/beats/tree/main/libbeat/monitoring/inputmon) to collect metrics, as is already done for Packetbeat and Filebeat.

It will be important to ensure that a suitable unique, persistent ID is used to refer to each Auditbeat process.

Make sure the [Agent integration](https://github.com/elastic/integrations/tree/main/packages/elastic_agent) pulls these metrics from Auditbeat.

### Use case:

Once Auditbeat is set up for metric collection, the [`system.socket` dataset](https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-dataset-system-socket.html) can be instrumented to better understand memory usage in certain [reported](https://github.com/elastic/sdh-beats/issues/3696) cases.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.