elastic / elastic/package-spec

[Change Proposal] Add a new discovery parameter that allows any key / value pair to be set

Open
#1,058 4 comments 0 reactions 0 assignees View on GitHub
discuss Team:Ecosystem
Dominant language
Go
Stars
20
Forks
93
Avg merge
15h 10m
Merged PRs (30d)
12

Description

Currently, content packages are allowed to define different fields to allow for discovery and since https://github.com/elastic/package-spec/issues/919 it also allows datasets names to be set.

The goal of this issue is to add another parameter to allow discovering packages based on any key / value pairs that could be provided.

Example of how this new parameter could be defined in the manifest:

```yaml
discovery:
fields:
- name: host.ip
value: xx
datasets:
- name: nginx.access
```

## Use Cases

### RUM

RUM data is coming from OTel SDKs, hence all the data lands in `traces-generic.otel-default`.
To allow auto-install of a RUM content pack, we would need the possibility to check for the `telemetry.sdk.name` field to contain the value `webjs`.

### Data from generic OTel Collector Receivers

Data from generic receivers (e.g. `prometheusreceiver`) would land in a dataset like `prometheusreceiver.otel`. However, that data may contain metrics from different kind of technologies. To auto-install a content pack for a specific technology in the prometheus metrics, we might need something similar as the above as well.

### Requirements
- [ ] Add new discovery parameter `discovery.fields.value`.
- [ ] Value field is optional, if not provided it will check for existence of the field, otherwise check for the specific value

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.