Add field event.agent_id_status

[andrewkroh]

This adds a field that can be used to reflect the status of the agent.id verification performed by the receiving system or data pipeline. If the receiving system checks that the sender is authorized for a given agent.id value then the outcome can be added to this field.

For example you might implement mTLS for authenticating agents sending data to Logstash. You could add the agent's ID to the agent's client cert subject and then validate incoming events in your Logstash pipeline to ensure the data has the agent ID.

Or with Elasticsearch you could provide each of your agents with an API key that has the agent.id associated to the API key metadata. Then using an Ingest Node pipeline you can validate the agent.id against the client's API key metadata.

[ebeahan]

Two thoughts about naming and the allowed values:

1. What about dropping the agent_id_ prefix and simply use mismatch and missing? The prefix feels a bit redundant with the field name specifying agent_id already.
2. I don't have an issue with event.agent_id_status and understand shorter field names are often preferred, but I do think something more detailed, like event.agent_id_validation_status, describes the field's purpose better.

[andrewkroh]

What about dropping the agent_id_ prefix and simply use mismatch and missing? The prefix feels a bit redundant with the field name specifying agent_id` already.

Good idea. That change is reflected in the changes I pushed.

I don't have an issue with event.agent_id_status and understand shorter field names are often preferred, but I do think something more detailed, like event.agent_id_validation_status, describes the field's purpose better.

I had similar thoughts. Initially I had event.agent_id_validation_status, but I struggled with the overall length. So that's how I got to the shorter name. But if more folks weigh in and want the more descriptive value then I can be swayed.

[andrewkroh]

Doc preview:

[ebeahan]

Thanks, the doc preview for the field looks great 👍