diff --git a/auditbeat/docs/auditbeat-options.asciidoc b/auditbeat/docs/auditbeat-options.asciidoc new file mode 100644 index 00000000000..8233f79cee1 --- /dev/null +++ b/auditbeat/docs/auditbeat-options.asciidoc @@ -0,0 +1,56 @@ +////////////////////////////////////////////////////////////////////////// +//// This content is shared by all Auditbeat modules. Make sure you keep the +//// descriptions generic enough to work for all modules. To include +//// this file, use: +//// +//// include::{docdir}/auditbeat-options.asciidoc[] +//// +////////////////////////////////////////////////////////////////////////// + +[id="module-standard-options-{modulename}"] +[float] +==== Standard configuration options + +You can specify the following options for any {beatname_uc} module. + +*`module`*:: The name of the module to run. + +ifeval::["{modulename}"=="system"] +*`datasets`*:: A list of datasets to execute. +endif::[] + +*`enabled`*:: A Boolean value that specifies whether the module is enabled. + +ifeval::["{modulename}"=="system"] +*`period`*:: The frequency at which the datasets check for changes. If a system +is not reachable, {beatname_uc} returns an error for each period. This setting +is required. For most datasets, especially `process` and `socket`, a shorter +period is recommended. +endif::[] + +*`fields`*:: A dictionary of fields that will be sent with the dataset event. This setting +is optional. + +*`tags`*:: A list of tags that will be sent with the dataset event. This setting is +optional. + +*`processors`*:: A list of processors to apply to the data generated by the dataset. ++ +See <> for information about specifying +processors in your config. + +*`index`*:: If present, this formatted string overrides the index for events from this +module (for elasticsearch outputs), or sets the `raw_index` field of the event's +metadata (for other outputs). This string can only refer to the agent name and +version and the event timestamp; for access to dynamic fields, use +`output.elasticsearch.index` or a processor. ++ +Example value: `"%{[agent.name]}-myindex-%{+yyyy.MM.dd}"` might +expand to +"{beatname_lc}-myindex-2019.12.13"+. + +*`keep_null`*:: If this option is set to true, fields with `null` values will be published in +the output document. By default, `keep_null` is set to `false`. + +*`service.name`*:: A name given by the user to the service the data is collected from. It can be +used for example to identify information collected from nodes of different +clusters with the same `service.type`. diff --git a/auditbeat/docs/modules/auditd.asciidoc b/auditbeat/docs/modules/auditd.asciidoc index c419c66db39..e913160d9cb 100644 --- a/auditbeat/docs/modules/auditd.asciidoc +++ b/auditbeat/docs/modules/auditd.asciidoc @@ -2,6 +2,8 @@ This file is generated! See scripts/docs_collector.py //// +:modulename: auditd + [id="{beatname_lc}-module-auditd"] == Auditd Module @@ -135,6 +137,10 @@ following example shows all configuration options with their default values. backpressure_strategy: auto ---- +This module also supports the +<> +described later. + *`socket_type`*:: This optional setting controls the type of socket that {beatname_uc} uses to receive events from the kernel. The two options are `unicast` and `multicast`. @@ -189,7 +195,8 @@ setting is primarily used for development and debugging purposes. installed to the kernel. There should be one rule per line. Comments can be embedded in the string using `#` as a prefix. The format for rules is the same used by the Linux `auditctl` utility. {beatname_uc} supports adding file watches -(`-w`) and syscall rules (`-a` or `-A`). +(`-w`) and syscall rules (`-a` or `-A`). For more information, see +<>. *`audit_rule_files`*:: A list of files to load audit rules from. This files are loaded after the rules declared in `audit_rules` are loaded. Wildcards are @@ -218,10 +225,10 @@ time. - `none`: No backpressure mitigation measures are enabled. -- -*`keep_null`*:: If this option is set to true, fields with `null` values will be -published in the output document. By default, `keep_null` is set to `false`. +include::{docdir}/auditbeat-options.asciidoc[] [float] +[[audit-rules]] === Audit rules The audit rules are where you configure the activities that are audited. These @@ -304,3 +311,6 @@ auditbeat.modules: ---- + +:modulename!: + diff --git a/auditbeat/docs/modules/file_integrity.asciidoc b/auditbeat/docs/modules/file_integrity.asciidoc index c420818cb39..42f0378de64 100644 --- a/auditbeat/docs/modules/file_integrity.asciidoc +++ b/auditbeat/docs/modules/file_integrity.asciidoc @@ -2,6 +2,8 @@ This file is generated! See scripts/docs_collector.py //// +:modulename: file_integrity + [id="{beatname_lc}-module-file_integrity"] == File Integrity Module @@ -66,6 +68,10 @@ Linux. recursive: false ---- +This module also supports the +<> +described later. + *`paths`*:: A list of paths (directories or files) to watch. Globs are not supported. The specified paths should exist when the metricset is started. @@ -122,8 +128,7 @@ of this directories are watched. If `recursive` is set to `true`, the `file_integrity` module will watch for changes on this directories and all their subdirectories. -*`keep_null`*:: If this option is set to true, fields with `null` values will be -published in the output document. By default, `keep_null` is set to `false`. +include::{docdir}/auditbeat-options.asciidoc[] [float] @@ -146,3 +151,6 @@ auditbeat.modules: ---- + +:modulename!: + diff --git a/auditbeat/module/auditd/_meta/docs.asciidoc b/auditbeat/module/auditd/_meta/docs.asciidoc index 45e3e3de934..4585b7179ff 100644 --- a/auditbeat/module/auditd/_meta/docs.asciidoc +++ b/auditbeat/module/auditd/_meta/docs.asciidoc @@ -130,6 +130,10 @@ following example shows all configuration options with their default values. backpressure_strategy: auto ---- +This module also supports the +<> +described later. + *`socket_type`*:: This optional setting controls the type of socket that {beatname_uc} uses to receive events from the kernel. The two options are `unicast` and `multicast`. @@ -184,7 +188,8 @@ setting is primarily used for development and debugging purposes. installed to the kernel. There should be one rule per line. Comments can be embedded in the string using `#` as a prefix. The format for rules is the same used by the Linux `auditctl` utility. {beatname_uc} supports adding file watches -(`-w`) and syscall rules (`-a` or `-A`). +(`-w`) and syscall rules (`-a` or `-A`). For more information, see +<>. *`audit_rule_files`*:: A list of files to load audit rules from. This files are loaded after the rules declared in `audit_rules` are loaded. Wildcards are @@ -213,10 +218,10 @@ time. - `none`: No backpressure mitigation measures are enabled. -- -*`keep_null`*:: If this option is set to true, fields with `null` values will be -published in the output document. By default, `keep_null` is set to `false`. +include::{docdir}/auditbeat-options.asciidoc[] [float] +[[audit-rules]] === Audit rules The audit rules are where you configure the activities that are audited. These diff --git a/auditbeat/module/file_integrity/_meta/docs.asciidoc b/auditbeat/module/file_integrity/_meta/docs.asciidoc index 9282b289589..372e9fc3b47 100644 --- a/auditbeat/module/file_integrity/_meta/docs.asciidoc +++ b/auditbeat/module/file_integrity/_meta/docs.asciidoc @@ -61,6 +61,10 @@ Linux. recursive: false ---- +This module also supports the +<> +described later. + *`paths`*:: A list of paths (directories or files) to watch. Globs are not supported. The specified paths should exist when the metricset is started. @@ -117,5 +121,4 @@ of this directories are watched. If `recursive` is set to `true`, the `file_integrity` module will watch for changes on this directories and all their subdirectories. -*`keep_null`*:: If this option is set to true, fields with `null` values will be -published in the output document. By default, `keep_null` is set to `false`. +include::{docdir}/auditbeat-options.asciidoc[] diff --git a/auditbeat/scripts/docs_collector.py b/auditbeat/scripts/docs_collector.py index 8c5d532ae8e..5e897bde3ed 100644 --- a/auditbeat/scripts/docs_collector.py +++ b/auditbeat/scripts/docs_collector.py @@ -44,6 +44,9 @@ def collect(base_paths): os.mkdir(os.path.join(module_docs_path(module_dir), "modules", module)) module_file = generated_note + + module_file += ":modulename: " + module + "\n\n" + module_file += "[id=\"{beatname_lc}-module-" + module + "\"]\n" with open(module_doc) as f: @@ -84,6 +87,9 @@ def collect(base_paths): module_file += "----\n\n" + # Close modulename variable + module_file += "\n:modulename!:\n\n" + module_links = "" module_includes = "" diff --git a/x-pack/auditbeat/docs/modules/system.asciidoc b/x-pack/auditbeat/docs/modules/system.asciidoc index dc80845aa24..361af353c43 100644 --- a/x-pack/auditbeat/docs/modules/system.asciidoc +++ b/x-pack/auditbeat/docs/modules/system.asciidoc @@ -2,9 +2,10 @@ This file is generated! See scripts/docs_collector.py //// +:modulename: system + [id="{beatname_lc}-module-system"] [role="xpack"] - == System Module beta[] @@ -72,8 +73,9 @@ sample suggested configuration. user.detect_password_changes: true ---- -*`period`*:: The frequency at which the datasets check for changes. For most -datasets - esp. `process` and `socket` - a shorter period is recommended. +This module also supports the +<> +described later. *`state.period`*:: The frequency at which the datasets send full state information. This option can be overridden per dataset using `{dataset}.state.period`. @@ -85,8 +87,7 @@ the `beat.db` file to detect changes between Auditbeat restarts. The `beat.db` f should be readable only by the root user and be treated similar to the shadow file itself. -*`keep_null`*:: If this option is set to true, fields with `null` values will be -published in the output document. By default, `keep_null` is set to `false`. +include::{docdir}/auditbeat-options.asciidoc[] [float] === Suggested configuration @@ -151,6 +152,9 @@ auditbeat.modules: login.btmp_file_pattern: /var/log/btmp* ---- + +:modulename!: + [float] === Datasets diff --git a/x-pack/auditbeat/module/system/_meta/docs.asciidoc b/x-pack/auditbeat/module/system/_meta/docs.asciidoc index 30d97edb478..2e91d2db116 100644 --- a/x-pack/auditbeat/module/system/_meta/docs.asciidoc +++ b/x-pack/auditbeat/module/system/_meta/docs.asciidoc @@ -1,5 +1,4 @@ [role="xpack"] - == System Module beta[] @@ -67,8 +66,9 @@ sample suggested configuration. user.detect_password_changes: true ---- -*`period`*:: The frequency at which the datasets check for changes. For most -datasets - esp. `process` and `socket` - a shorter period is recommended. +This module also supports the +<> +described later. *`state.period`*:: The frequency at which the datasets send full state information. This option can be overridden per dataset using `{dataset}.state.period`. @@ -80,8 +80,7 @@ the `beat.db` file to detect changes between Auditbeat restarts. The `beat.db` f should be readable only by the root user and be treated similar to the shadow file itself. -*`keep_null`*:: If this option is set to true, fields with `null` values will be -published in the output document. By default, `keep_null` is set to `false`. +include::{docdir}/auditbeat-options.asciidoc[] [float] === Suggested configuration