Repository navigation
Enhancement - Allow custom processors from the Integration policy #452
Description
Hi,
In our environment we connect a lot of servers from different customers where we enrich all events with the ID of that customer. For most integrations it's possible to add custom processors in the integration policy in Kibana, but for the endpoint package this option doesn't exist.
As an example, in the access datastream for the Apache policy there is some processor configuration (https://github.com/elastic/integrations/blob/main/packages/apache/data_stream/access/manifest.yml#L32) which makes this option available in Kibana and templates it in the Agent's config. (https://github.com/elastic/integrations/blob/main/packages/apache/data_stream/access/agent/stream/log.yml.hbs#L17)
We would like this feature in the endpoint package so we can enrich the events with information based on the integration policy the agent is using.
Activity
[-]Enchangement - Allow custom processors from the Integration policy[/-][+]Enchancement - Allow custom processors from the Integration policy[/+]ferullo commentedon Nov 20, 2023
Since 8.11, Endpoint supports an advanced option
windows.advanced.document_enrichment.fields/mac.advanced.document_enrichment.fields/linux.advanced.document_enrichment.fieldsthat can be used to set custom fields in documents on a per policy basis. Does that help?[-]Enchancement - Allow custom processors from the Integration policy[/-][+]Enhancement - Allow custom processors from the Integration policy[/+]