[O11y] Missing description for tag for logs data streams

harnish-elastic commented 1 year ago

In the Filebeat-based integrations, found that the forwarded tag has a major role in the host-related field information.

What is the behavior of forwarded tags?

The forwarded tag will enable the publisher_pipeline.disable_host: true, which is the functionality of a Filebeat input setting that only applies to Filebeat-based integrations.
There could be a proxy server to store log files. The user can forward the log-files/host/TCP/UDP from the actual server to the proxy server and configure the integration using the proxy server rather than the actual server. Hence if the user is using this kind of mechanism to ingest data, they can use the forwarded tag to remove the host-related information.

Here are the following scenarios that found while digging deep in the forwarded tag.

If the forwarded tag is present, the host-related fields won't come.
If the forwarded tag is not present, the host-related fields will come.

Sample host-related information:

    "host": {
        "architecture": "x86_64",
        "containerized": true,
        "hostname": "docker-fleet-agent",
        "id": "e8978f2086c14e13b7a0af9ed0011d19",
        "ip": [
            "127.0.0.1"
        ],
        "mac": [
            "02-42-C0-A8-30-09"
        ],
        "name": "docker-fleet-agent",
        "os": {
            "codename": "focal",
            "family": "debian",
            "kernel": "3.10.0-1160.90.1.el7.x86_64",
            "name": "Ubuntu",
            "platform": "ubuntu",
            "type": "linux",
            "version": "20.04.6 LTS (Focal Fossa)"
        }
    }

The issue here is that in the Add integration page, there are no tooltips related to what the forwarded tag is actually doing for the user. Hence need to have a minimal description for the forwarded tag.

Suggestions:

We can use the toggle button instead of the text field for the forwarded tag and have the description. Please refer to the below screenshot in which we can create a toggle button(default: disabled) the same as the preserve_original_event toggle!

agithomas commented 1 year ago

Alternatively, should we retain the current way and instead provide a link next to tags say Find about tags , that takes users to a page having the details of all the tags present? This will ensure we don't have to document and don't have to worry about any new useful tags.

@ishleenk17 , @lalit-satapathy , thoughts?

ishleenk17 commented 1 year ago

@harnish-elastic : For now as a scope of this task, let's not introduce the toggle. Let's just provide a link to "what are tags and how to use them"

botelastic[bot] commented 2 months ago

Hi! We just realized that we haven't looked into this issue in a while. We're sorry! We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1. Thank you for your contribution!

elastic / integrations