As a future improvment idea, the Defend for Containers integration uses UI components (buttons, dropdowns, etc) to create somewhat similar rules, and then generates a yaml file based on the GUI.

It would be easier for users to have something like that here. I didn't work on that part myself, so I'm not too sure how much work it would be to add here, but it's probably worth investigating. I think setting up this yaml could cause difficulties for a lot of users.

Phase 2 of this project does involve UI work, but I'll take a look at that integration to see if I can apply any of that here.

I agree the yaml is convoluted, but this is how beats is designed. I'm not sure what to do here, though. One of my original approaches to this integration was developing a new processor, which allowed me to have a much "nicer" looking yaml configuration. I abandoned that in favor of the existing conditionals and processors in beats. Unfortunately, you can't do anything special with yaml blocks from the agent configuration in handlebars, so I wasn't able to take a nicer looking yaml from the agent config and produce the correct filebeat config from it.

I'll take a look at the Defend for Containers integration and see what I can use from that.

Yeah looking at Defend for Containers, that's what we're aiming for in Phase 2.

This was the "nicer" looking yaml config I came up with (one of the reroute definitions). I feel like this would be easier for the UI to work with than the beats config that's currently being used. The beats config would be fairly easy for the UI to emit, but not read back in.

- target: citrix_waf.log
  patterns:
    - "CEF:0\\|Citrix\\|NetScaler"
  processors:
    - add_fields:
        target: ''
        fields:
          _conf.tz_offset: "UTC"
    - append:
        target_field: tags
        values:
          - citrix_waf-log