elastic / elastic/beats

[docs-patrol] Document new osquerybeat scheduled-query metadata fields in exported fields docs

Open
#49,520 3 comments 0 reactions 0 assignees View on GitHub
enhancement Team:Security-Service Integrations
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 15m
Merged PRs (30d)
385

Description

Recent code changes introduced documentation drift for `osquerybeat` exported fields.

## Changes Requiring Documentation Updates

### 1. New scheduled-query metadata fields are emitted but not documented

**Commit(s):**
- `3a992dbf4f45e25dcc3b2afd3ccd1a713c3ad732` (`feat(osquerybeat): improve native scheduled-query metadata and identifiers`)

**What changed (code evidence):**
- `x-pack/osquerybeat/beater/osquerybeat.go:545-548` now adds `planned_schedule_time` and `schedule_execution_count` to query result metadata.
- `x-pack/osquerybeat/internal/pub/publisher.go:165-182` now emits `schedule_id`, `planned_schedule_time`, `schedule_execution_count`, and optional `pack_id` / `space_id` in scheduled response events.

**Documentation impact (current docs evidence):**
- `x-pack/osquerybeat/_meta/fields.yml:1-4` is still empty (`fields:` has no definitions).
- `x-pack/osquerybeat/docs/fields.asciidoc:15621-15624` still says `== Osquerybeat fields` followed by `None`.

This makes current exported-fields documentation concretely incorrect for users inspecting osquerybeat event schema.

## Suggested Actions

- [ ] Add osquerybeat field definitions for the newly emitted scheduled-query metadata fields in `x-pack/osquerybeat/_meta/fields.yml` (at minimum: `planned_schedule_time`, `schedule_execution_count`, and any other newly emitted top-level scheduled response fields that are intended to be public).
- [ ] Regenerate/update `x-pack/osquerybeat/docs/fields.asciidoc` so `Osquerybeat fields` no longer reports `None` for these emitted fields.
- [ ] Confirm whether `pack_id` / `space_id` in scheduled responses are intended public fields; if yes, document them in exported fields as well.

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Docs Patrol](https://github.com/elastic/beats/actions/runs/23199146534)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on Mar 24, 2026, 2:41 PM UTC

Contributor guide

Open the contributing guide

Research direction

Start with x-pack/osquerybeat/_meta/fields.yml and review the emitted fields in x-pack/osquerybeat/beater/osquerybeat.go:545-548 and x-pack/osquerybeat/internal/pub/publisher.go:165-182. Add definitions for the intended scheduled-query metadata fields, clarify whether pack_id and space_id are public, then regenerate x-pack/osquerybeat/docs/fields.asciidoc. Done means the generated Osquerybeat fields section documents the emitted fields instead of reporting None.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
documentation
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.