Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Doc: Evaluate and action Beats module messaging and deprecation #16591

Open
2 tasks
karenzone opened this issue Oct 21, 2024 · 2 comments
Open
2 tasks

Doc: Evaluate and action Beats module messaging and deprecation #16591

karenzone opened this issue Oct 21, 2024 · 2 comments
Assignees

Comments

@karenzone
Copy link
Contributor

karenzone commented Oct 21, 2024

Current offerings -- Elastic Agent, Elastic integrations, and the [logstash-filter-agent_integration](https://www.elastic.co/guide/en/logstash/master/ea-integrations.html -- might give users better ways to achieve the same results.

Phase 1: Evaluate recommendations

@flexitrev @jsvd @robbavey @karenzone

Filebeat modules

Winlogbeat modules

Phase 2: Implement recommendations

@karenzone et al

Related: #16590

@flexitrev
Copy link

I think we should remove these pages and focus exclusively on https://www.elastic.co/guide/en/logstash/master/ea-integrations.html

@jsvd
Copy link
Member

jsvd commented Oct 28, 2024

The most obvious answer here comes from the deprecation (or not) of these modules in 9.0.0. If there's messaging on the filebeat and winlogbeat that they're deprecated in 8.x and to be removed in 9.0.0 then we should reflect that messaging in the Logstash documentation side.

The documentation of integrating Logstash with Beats modules focuses on ensuring Logstash forwards the right ingest pipeline name to ES during the bulk request. The documentation mentioned by Trevor focuses on a different experience, running the ingest pipelines directly in Logstash.

There's also an architectural question here where we should likely be still recommending users to run the transformation in ES (by forwarding the pipeline or data stream name correctly) and only move to having run on Logstash if the user needs it (by configuring the elastic_integration filter).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants