Elastic Endpoint Package #223
Conversation
|
For the categories: I guess we will only have security or endpoint? I would suggest to go for now with "Security". Are the events you are shipping now ending up under |
Sounds good! I'll switch it to Security
I think we're going to go with |
jonathan-buttner
changed the title
dev/package-examples/endpoint-0.0.1/dataset/endpoint.events/fields/fields.yml
Outdated
Show resolved
Hide resolved
dev/package-examples/endpoint-0.0.1/dataset/endpoint.events/manifest.yml
Outdated
Show resolved
Hide resolved
| @@ -0,0 +1,200 @@ | |||
| - name: "@timestamp" | |||
There was a problem hiding this comment.
Same comment as above for the path.
There was a problem hiding this comment.
I remember also a discussion around endpoint only using one index? But having 2 datasets would mean 2 indices?
There was a problem hiding this comment.
Gotcha I'll change the dataset name.
So there will be one index for events and alerts (events) and then another index for the metadata of an endpoint for now.
There was a problem hiding this comment.
Got it, then this makes sense.
This raises the question how the metadata index will be called. events-endpoint.metadata-*? If yes, the name here is correct.
There was a problem hiding this comment.
So this one will actually be metrics-endpoint.metadata-* (the type is metrics, this is information about endpoints and their status etc) Do you think endpoint.metadata is reasonable name? I figured metrics-metadata wasn't super clear on what it was referring to, that's why I add the endpoint in there.
If we still with endpoint.metadata would it be better to be consistent in the dataset directory and leave the events one as endpoint.events?
There was a problem hiding this comment.
Agree that we can't really use metrics-metadata as this is too generic and not clear it would belong to endpoint.
By default we will have that the dataset id = {package.name}.{directory.name}. So in the nginx case we have access, error and stubstatus directories. The problem above is that you only have events-endpoint which means the above does not work as the package is already endpoint. You will have to set id in any case. I would probably call the directory è
events, and the other one metadata.
There was a problem hiding this comment.
Ah ok I see. I'll rename the directories and set the id field. Should I rebase off of #176 ?
There was a problem hiding this comment.
I suggest lets get this in as is and then adjust it again as soon as #176 lands.
There was a problem hiding this comment.
Ok sounds good, I moved the datasets to events and metadata. I'm good to merge. @james-elastic could I get a 👍
|
I created #228 to also have a base template in place for events-*. Should not affect this PR but thought worth to mention here. |
This PR adds the elastic endpoint package that has datasets for events and metadata and the fields.yml for both.
I created the
securitycategory.If we want a index pattern created for
events-*we'll need to merge this PR as well: elastic/kibana#58908