Skip to content

Commit bb56025

Browse files
authored
Doc: Add more configurable attributes (#423)
Add conditional processing to support differences in beats/agent content Bump to v6.1.6
1 parent 2c07862 commit bb56025

File tree

3 files changed

+60
-11
lines changed

3 files changed

+60
-11
lines changed

CHANGELOG.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,6 @@
1+
## 6.1.6
2+
- [DOC] Applied more attributes to manage plugin name in doc content, and implemented conditional text processing. [#423](https://github.com/logstash-plugins/logstash-input-http/pull/423)
3+
14
## 6.1.5
25
- Changed jar dependencies to reflect newer versions [#425](https://github.com/logstash-plugins/logstash-input-beats/pull/425)
36

VERSION

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
6.1.5
1+
6.1.6

docs/index.asciidoc

Lines changed: 56 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
:type: input
33
:default_codec: plain
44
:plugin-uc: Beats
5+
:plugin-singular: Beat
56

67
///////////////////////////////////////////
78
START - GENERATED VARIABLES, DO NOT EDIT!
@@ -19,18 +20,21 @@ END - GENERATED VARIABLES, DO NOT EDIT!
1920
=== {plugin-uc} input plugin
2021

2122
NOTE: The `input-elastic_agent` plugin is the next generation of the
22-
`input-beats` plugin. They currently share a common codebase.
23+
`input-beats` plugin.
24+
They currently share code and a https://github.com/logstash-plugins/logstash-input-beats[common codebase].
2325

2426
include::{include_path}/plugin_header.asciidoc[]
2527

2628
==== Description
2729

2830
This input plugin enables Logstash to receive events from the
29-
https://www.elastic.co/products/beats[Elastic Beats] framework.
31+
{plugin-uc} framework.
3032

3133
The following example shows how to configure Logstash to listen on port
3234
5044 for incoming {plugin-uc} connections and to index into Elasticsearch.
3335

36+
//Example for Beats
37+
ifeval::["{plugin}"=="beats"]
3438
["source","sh",subs="attributes"]
3539
-----
3640
@@ -48,9 +52,8 @@ output {
4852
}
4953
-----
5054
<1> `%{[@metadata][beat]}` sets the first part of the index name to the value
51-
of the `beat` metadata field and `%{[@metadata][version]}` sets the second part to
52-
the {plugin-uc} version. For example:
53-
metricbeat-7.4.0.
55+
of the metadata field and `%{[@metadata][version]}` sets the second part to
56+
the {plugin-singular} version. For example: metricbeat-6.1.6.
5457

5558
Events indexed into Elasticsearch with the Logstash configuration shown here
5659
will be similar to events directly indexed by {plugin-uc} into Elasticsearch.
@@ -59,14 +62,56 @@ NOTE: If ILM is not being used, set `index` to
5962
`%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}` instead so
6063
Logstash creates an index per day, based on the `@timestamp` value of the events
6164
coming from {plugin-uc}.
65+
endif::[]
6266

63-
IMPORTANT: If you are shipping events that span multiple lines, you need to use
67+
//Example for Elastic Agent
68+
ifeval::["{plugin}"!="beats"]
69+
["source","sh",subs="attributes"]
70+
-----
71+
72+
input {
73+
{plugin} {
74+
port => 5044
75+
}
76+
}
77+
78+
output {
79+
elasticsearch {
80+
hosts => ["http://localhost:9200"]
81+
data_stream => "true"
82+
}
83+
}
84+
-----
85+
86+
Events indexed into Elasticsearch with the Logstash configuration shown here
87+
will be similar to events directly indexed by {plugin-uc} into Elasticsearch.
88+
endif::[]
89+
90+
91+
//Content for Beats
92+
ifeval::["{plugin}"=="beats"]
93+
[id="plugins-{type}s-{plugin}-multiline"]
94+
===== Multi-line events
95+
96+
If you are shipping events that span multiple lines, you need to use
6497
the {filebeat-ref}/multiline-examples.html[configuration options available in
6598
Filebeat] to handle multiline events before sending the event data to Logstash.
6699
You cannot use the {logstash-ref}/plugins-codecs-multiline.html[Multiline codec
67100
plugin] to handle multiline events. Doing so will result in the failure to start
68101
Logstash.
102+
endif::[]
103+
104+
//Content for Elastic Agent
105+
ifeval::["{plugin}"!="beats"]
106+
[id="plugins-{type}s-{plugin}-limitations"]
107+
===== Elastic Agent and Fleet limitations
108+
109+
Early releases of Elastic Agent and Fleet have some limitations, including support for advanced Beats settings like multiline, processors, and so forth.
110+
For more information, see {fleet-guide}/fleet-limitations.html[Limitations of this release].
111+
endif::[]
69112

113+
//Content for Beats
114+
ifeval::["{plugin}"=="beats"]
70115
[id="plugins-{type}s-{plugin}-versioned-indexes"]
71116
==== Versioned indices
72117

@@ -89,6 +134,7 @@ Logstash `@timestamp` field.
89134

90135
This configuration results in daily index names like
91136
+filebeat-{logstash_version}-{localdate}+.
137+
endif::[]
92138

93139

94140
[id="plugins-{type}s-{plugin}-ecs_metadata"]
@@ -106,16 +152,16 @@ output.
106152
|=======================================================================
107153
|ECS disabled |ECS v1 |Availability |Description
108154

109-
|[host] |[@metadata][input][beats][host][name] |Always |Name or address of the beat host
110-
|[@metadata][ip_address] |[@metadata][input][beats][host][ip] |Always |IP address of the Beats client
155+
|[host] |[@metadata][input][beats][host][name] |Always |Name or address of the {plugin-singular} host
156+
|[@metadata][ip_address] |[@metadata][input][beats][host][ip] |Always |IP address of the {plugin-uc} client
111157
|[@metadata][tls_peer][status] | [@metadata][tls_peer][status] | When SSL related fields are populated | Contains "verified"/"unverified" labels in `disabled`, `true`/`false` in `v1`
112158
|[@metadata][tls_peer][protocol] | [@metadata][input][beats][tls][version_protocol] | When SSL status is "verified" | Contains the TLS version used (e.g. `TLSv1.2`)
113159
|[@metadata][tls_peer][subject] | [@metadata][input][beats][tls][client][subject] | When SSL status is "verified" | Contains the identity name of the remote end (e.g. `CN=artifacts-no-kpi.elastic.co`)
114160
|[@metadata][tls_peer][cipher_suite] | [@metadata][input][beats][tls][cipher] | When SSL status is "verified" | Contains the name of cipher suite used (e.g. `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`)
115161
|=======================================================================
116162

117163
[id="plugins-{type}s-{plugin}-options"]
118-
==== {plugin-uc} Input Configuration Options
164+
==== {plugin-uc} input configuration options
119165

120166
This plugin supports the following configuration options plus the <<plugins-{type}s-{plugin}-common-options>> described later.
121167

@@ -154,7 +200,7 @@ input plugins.
154200
* Value type is <<boolean,boolean>>
155201
* Default value is `false`
156202

157-
Flag to determine whether to add `host` field to event using the value supplied by the beat in the `hostname` field.
203+
Flag to determine whether to add `host` field to event using the value supplied by the {plugin-singular} in the `hostname` field.
158204

159205

160206
[id="plugins-{type}s-{plugin}-cipher_suites"]

0 commit comments

Comments
 (0)