Skip to content

[Elastic Agent] Support EQL condition on an input #20784

@blakerouse

Description

@blakerouse

Overview

This builds off of #20781 to provide conditions to an input and is the next step in completing support for dynamic inputs #19225. Condition on an input will allow an input to be enabled only if the condition evaluates too true.

Syntax

An input can have a condition defined with the key condition. Without the condition key an input is evaluated to be always be enabled, with the key it is determined based on the result of the condition evaluation.

The syntax will follow a subset of EQL where clause and will not deviate from the design of EQL other than maybe to provide functions that are not yet implemented in EQL. If a function already exists in EQL and we choose to implement it, it will be the same behavior and parameters.

MVP Support

  • and boolean operator
  • or boolean operator
  • == != value comparisons

Examples

Not on Windows

inputs:
  - type: system/load
    condition: "{{host.platform}} != 'windows'"

Only Windows

inputs:
  - type: system/load
    condition: "{{host.platform}} == 'windows'"

Only Windows & AMD64

inputs:
  - type: system/load
    condition: "{{host.platform}} == 'windows' and {{host.architecture}} == 'amd64'"

Metadata

Metadata

Assignees

Labels

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions