elastic / elastic/endpoint-package

Enhancement - Allow custom processors from the Integration policy

Open
#452 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
33
Forks
20
Avg merge
2d 16h
Merged PRs (30d)
5

Description

Hi,

In our environment we connect a lot of servers from different customers where we enrich all events with the ID of that customer. For most integrations it's possible to add custom processors in the integration policy in Kibana, but for the endpoint package this option doesn't exist.

As an example, in the access datastream for the Apache policy there is some processor configuration (https://github.com/elastic/integrations/blob/main/packages/apache/data_stream/access/manifest.yml#L32) which makes this option available in Kibana and templates it in the Agent's config. (https://github.com/elastic/integrations/blob/main/packages/apache/data_stream/access/agent/stream/log.yml.hbs#L17)

We would like this feature in the endpoint package so we can enrich the events with information based on the integration policy the agent is using.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.