[ON Week] Fix errors in code blocks in Fleet docs (#3982)

This PR fixes errors in code blocks in the Fleet docs using an AI
assistant (Cursor) and semantic code search in Elastic repos for
identifying and confirming the errors.

It also fixes a couple of smaller issues:
- removes empty columns
- removes a reference to the apm-data plugin (unrelated to the specific
doc’s other content)
- makes some descriptions (in tables) a bit more accurate.

——

AI-assisted by Cursor using the claude-4.5-sonnet (thinking) model;
the necessary changes were identified in multiple iterations.

Author: vishaangelova

reference/fleet/add_docker_metadata-processor.md

@@ -52,7 +52,7 @@ If the Docker daemon is restarted, the mounted socket will become invalid, and m
       #match_source: true
       #match_source_index: 4
       #match_short_id: true
-      #cleanup_timeout: 60
+      #cleanup_timeout: 60s
       #labels.dedot: false
       # To connect to Docker over TLS you must specify a client and CA certificate.
       #ssl:

reference/fleet/add_host_metadata-processor.md

@@ -95,5 +95,5 @@ If `host.*` fields already exist in the event, they are overwritten by default u
 | `geo.city_name` | No |  | Name of the city. |
 | `geo.country_iso_code` | No |  | ISO country code. |
 | `geo.region_iso_code` | No |  | ISO region code. |
-| `replace_fields` | No | `true` | Whether to replace original host fields from the event. If set `false`, original host fields from the event are not replaced by host fields from `add_host_metadata`. |
+| `replace_fields` | No | `true` | Whether to replace existing host fields in the event. If `true` (default), the processor always runs and overwrites any existing `host.*` fields with metadata from `add_host_metadata`. If `false`, the processor only adds metadata when no `host.*` fields exist in the event or when only `host.name` is present. If other host fields exist, the processor is skipped entirely. |
 

reference/fleet/add_kubernetes_metadata-processor.md

@@ -63,7 +63,7 @@ This configuration enables the processor on an {{agent}} running as a process on
       host: <hostname>
       # If kube_config is not set, KUBECONFIG environment variable will be checked
       # and if not present it will fall back to InCluster
-      kube_config: ${fleet} and {agent} Guide/.kube/config
+      kube_config: ~/.kube/config
       # Defining indexers and matchers manually is required for {beatname_lc}, for instance:
       #indexers:
       #  - ip_port:

reference/fleet/configure-standalone-elastic-agents.md

@@ -39,7 +39,8 @@ inputs:
     data_stream.namespace: default
     use_output: default
     streams:
-      - metricset: cpu
+      - metricsets:
+          - cpu
         data_stream.dataset: system.cpu
 ```
 

reference/fleet/data-streams-scenario2.md

@@ -10,7 +10,7 @@ products:
 # Scenario 2: Apply an ILM policy to specific data streams generated from Fleet integrations across all namespaces [data-streams-scenario2]
 
 
-Mappings and settings for data streams can be customized through the creation of `*@custom` component templates, which are referenced by the index templates created by the {{es}} apm-data plugin. The easiest way to configure a custom index lifecycle policy per data stream is to edit this template.
+Mappings and settings for data streams can be customized through the creation of `*@custom` component templates, which are referenced by the index templates created by each integration. The easiest way to configure a custom index lifecycle policy per data stream is to edit this template.
 
 This tutorial explains how to apply a custom index lifecycle policy to the `logs-system.auth` data stream.
 

reference/fleet/decode_duration-processor.md

@@ -27,8 +27,8 @@ processors:
 
 ## Configuration settings [_configuration_settings_21]
 
-| Name | Required | Default | Description |  |
-| --- | --- | --- | --- | --- |
-| `field` | yes |  | Which field of event needs to be decoded as `time.Duration` |  |
-| `format` | yes | `milliseconds` | Supported formats: `milliseconds`/`seconds`/`minutes`/`hours` |  |
+| Name | Required | Default | Description |
+| --- | --- | --- | --- |
+| `field` | yes |  | Which field of event needs to be decoded as `time.Duration` |
+| `format` | yes | `milliseconds` | Supported formats: `milliseconds`/`seconds`/`minutes`/`hours` |
 

reference/fleet/decode_xml_wineventlog-processor.md

@@ -149,10 +149,10 @@ If `map_ecs_fields` is enabled then the following field mappings are also perfor
 | --- | --- | --- |
 | `event.code` | `winlog.event_id` |  |
 | `event.kind` | `"event"` |  |
-| `event.provider` | `<Event><System><Provider>` | `Name` attribute |
-| `event.action` | `<Event><RenderingInfo><Task>` |  |
-| `event.host.name` | `<Event><System><Computer>` |  |
+| `event.provider` | `winlog.provider_name` | `Name` attribute |
+| `event.action` | `winlog.task` |  |
 | `event.outcome` | `winlog.outcome` |  |
+| `host.name` | `winlog.computer_name` |  |
 | `log.level` | `winlog.level` |  |
 | `message` | `winlog.message` |  |
 | `error.code` | `winlog.error.code` |  |

reference/fleet/dynamic-input-configuration.md

@@ -184,7 +184,8 @@ inputs:
   - id: unique-system-metrics-id
     type: system/metrics
     streams:
-      - metricset: load
+      - metricsets:
+          - load
         data_stream.dataset: system.cpu
         condition: ${host.platform} != 'windows'
 ```
@@ -196,7 +197,8 @@ inputs:
   - id: unique-system-metrics-id
     type: system/metrics
     streams:
-      - metricset: load
+      - metricsets:
+          - load
         data_stream.dataset: system.cpu
     processors:
       - add_fields:

reference/fleet/elastic-agent-container.md

@@ -189,10 +189,10 @@ If you’d like to run {{agent}} in a Docker container on a read-only file syste
 For example:
 
 ```bash subs=true
-docker run --rm --mount source=$(pwd)/state,destination=/state -e {STATE_PATH}=/state --read-only docker.elastic.co/elastic-agent/elastic-agent:{{version.stack}} <1>
+docker run --rm --mount source=$(pwd)/state,destination=/state -e STATE_PATH=/state --read-only docker.elastic.co/elastic-agent/elastic-agent:{{version.stack}} <1>
 ```
 
-1. Where `{STATE_PATH}` is the path to a stateful directory to mount where {{agent}} application data can be stored.
+1. Where `STATE_PATH` is the path to a stateful directory to mount where {{agent}} application data can be stored.
 
 You can also add `type=tmpfs` to the mount parameter (`--mount type=tmpfs,destination=/state...`) to specify a temporary file storage location. This should be done with caution as it can cause data duplication, particularly for logs, when the container is restarted, as no state data is persisted.
 

reference/fleet/elasticsearch-output.md

@@ -248,7 +248,7 @@ Settings used to parse, filter, and transform data.
     ```yaml
     outputs:
       default:
-        type: elasticsearchoutput.elasticsearch:
+        type: elasticsearch
         hosts: ["http://localhost:9200"]
         pipeline: my_pipeline_id
     ```