[docs-patrol] Document new osquerybeat scheduled-query metadata fields in exported fields docs
- Dominant language
- Go
- Stars
- 12.7k
- Forks
- 5k
- Avg merge
- 2d 15m
- Merged PRs (30d)
- 385
Description
Recent code changes introduced documentation drift for `osquerybeat` exported fields.
## Changes Requiring Documentation Updates
### 1. New scheduled-query metadata fields are emitted but not documented
**Commit(s):**
- `3a992dbf4f45e25dcc3b2afd3ccd1a713c3ad732` (`feat(osquerybeat): improve native scheduled-query metadata and identifiers`)
**What changed (code evidence):**
- `x-pack/osquerybeat/beater/osquerybeat.go:545-548` now adds `planned_schedule_time` and `schedule_execution_count` to query result metadata.
- `x-pack/osquerybeat/internal/pub/publisher.go:165-182` now emits `schedule_id`, `planned_schedule_time`, `schedule_execution_count`, and optional `pack_id` / `space_id` in scheduled response events.
**Documentation impact (current docs evidence):**
- `x-pack/osquerybeat/_meta/fields.yml:1-4` is still empty (`fields:` has no definitions).
- `x-pack/osquerybeat/docs/fields.asciidoc:15621-15624` still says `== Osquerybeat fields` followed by `None`.
This makes current exported-fields documentation concretely incorrect for users inspecting osquerybeat event schema.
## Suggested Actions
- [ ] Add osquerybeat field definitions for the newly emitted scheduled-query metadata fields in `x-pack/osquerybeat/_meta/fields.yml` (at minimum: `planned_schedule_time`, `schedule_execution_count`, and any other newly emitted top-level scheduled response fields that are intended to be public).
- [ ] Regenerate/update `x-pack/osquerybeat/docs/fields.asciidoc` so `Osquerybeat fields` no longer reports `None` for these emitted fields.
- [ ] Confirm whether `pack_id` / `space_id` in scheduled responses are intended public fields; if yes, document them in exported fields as well.
---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Docs Patrol](https://github.com/elastic/beats/actions/runs/23199146534)
Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on Mar 24, 2026, 2:41 PM UTC
Contributor guide
Research direction
Start with x-pack/osquerybeat/_meta/fields.yml and review the emitted fields in x-pack/osquerybeat/beater/osquerybeat.go:545-548 and x-pack/osquerybeat/internal/pub/publisher.go:165-182. Add definitions for the intended scheduled-query metadata fields, clarify whether pack_id and space_id are public, then regenerate x-pack/osquerybeat/docs/fields.asciidoc. Done means the generated Osquerybeat fields section documents the emitted fields instead of reporting None.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 72/100