elastic / elastic/endpoint-package
Documentation needs updating
- Dominant language
- Python
- Stars
- 33
- Forks
- 20
- Avg merge
- 2d 16h
- Merged PRs (30d)
- 5
Description
I'm currently creating an index template per dataset, which includes both component templates.
For example, index template `logs-endpoint.alerts-.` includes both component templates `logs-endpoint.alerts@package` and `logs-endpoint.alerts@custom`.
I've had some errors while adding and I've been going through the [integration documentation](https://docs.elastic.co/en/integrations/endpoint) for Endpoint and there's something I believe is incomplete.
For the data type `logs`, according to the documentation, we have the following datasets:
`alerts`
`file`
`network`
...
What I see in my Elastic cluster though, is that the index templates and their index patterns are not exactly like this. They're more like:
`alerts` -> `alerts`
`file` -> `events.file`
`library` -> `events.library`
`network` -> `events.network`
...
It also seems `events.api` is missing here as well.
I think an update of the documentation is needed here to show the real datasets used here.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.