Skip to content

Docs: Updates system, windows, winlog integrations to clarify windows event log info#17702

Merged
jmikell821 merged 4 commits intomainfrom
docs-enhancement/clarify-windows-event-logs
Mar 16, 2026
Merged

Docs: Updates system, windows, winlog integrations to clarify windows event log info#17702
jmikell821 merged 4 commits intomainfrom
docs-enhancement/clarify-windows-event-logs

Conversation

@jmikell821
Copy link
Copy Markdown
Member

@jmikell821 jmikell821 commented Mar 7, 2026 •
edited
Loading

Proposed commit message

Adds a short paragraph to each of these integrations (system, windows, winlog) to confirm the use case of that integration for collecting windows log events, so the user can decide which are best for their use case.

Why?

There are multiple integrations that collect Windows Event logs, most notably system, windows, and winlog. While the winlog integration is designed for pulling logs from any defined channel, the system and windows integrations collect from a specific set of channels and apply some additional pipeline processing to make the data usable for observability and/or security purposes. Collecting the system event logs via the custom winlog integration will not apply the same pipelines, and would make the data less valuable to the user.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • Ensure the added text is factual.

Related issues

Resolves #12642.

@jmikell821 jmikell821 self-assigned this Mar 7, 2026
@jmikell821 jmikell821 requested review from a team as code owners March 7, 2026 00:53
@jmikell821 jmikell821 added the enhancement New feature or request label Mar 7, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 7, 2026 •
edited
Loading

Vale Linting Results

Summary: 4 warnings, 4 suggestions found

⚠️ Warnings (4)
File Line Rule Message
packages/system/_dev/build/docs/README.md 17 Elastic.DontUse Don't use 'note that'.
packages/system/docs/README.md 17 Elastic.DontUse Don't use 'note that'.
packages/windows/_dev/build/docs/README.md 13 Elastic.DontUse Don't use 'note that'.
packages/windows/docs/README.md 13 Elastic.DontUse Don't use 'note that'.
💡 Suggestions (4)
File Line Rule Message
packages/winlog/_dev/build/docs/README.md 5 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/winlog/_dev/build/docs/README.md 6 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/winlog/docs/README.md 5 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/winlog/docs/README.md 6 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 7, 2026

Please run these commands to update changelogs and build docs:

for pkg in system windows winlog; do
  cd packages/$pkg
  elastic-package changelog add --type enhancement --description "Improve documentation" --link "https://github.com/elastic/integrations/pull/17702" --next minor
  elastic-package build
  cd ../..
done
git add -u
git commit -m "docs: update changelogs and build documentation"
git push

Prerequisite: go install github.com/elastic/elastic-package

@elastic-vault-github-plugin-prod
Copy link
Copy Markdown

elastic-vault-github-plugin-prod bot commented Mar 7, 2026

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@pierrehilbert pierrehilbert added Team:Elastic-Agent-Data-Plane Agent Data Plane team [elastic/elastic-agent-data-plane] Team:Obs-InfraObs Observability Infrastructure Monitoring team [elastic/obs-infraobs-integrations] labels Mar 8, 2026
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Mar 8, 2026

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

@pierrehilbert pierrehilbert added the Team:Security-Linux Platform Linux Platform Security team [elastic/sec-linux-platform] label Mar 8, 2026
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Mar 8, 2026

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)

@jmikell821 jmikell821 requested a review from a team as a code owner March 9, 2026 17:26
mmahacek
mmahacek reviewed Mar 9, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

@mmahacek mmahacek left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thanks!

shmsr
shmsr approved these changes Mar 11, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@shmsr shmsr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"vale lint" has reported some issues, are you going to fix them? rest looks good!

shmsr
shmsr reviewed Mar 11, 2026
View reviewed changes
alaudazzi
alaudazzi approved these changes Mar 13, 2026
View reviewed changes
Copy link
Copy Markdown
Member

@alaudazzi alaudazzi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@andrewkroh andrewkroh added the Integration:winlog Custom Windows Event Logs label Mar 15, 2026
@andrewkroh andrewkroh added documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. Integration:system System Integration:windows Windows Team:Security-Windows Platform Security Windows Platform team [elastic/sec-windows-platform] labels Mar 15, 2026
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Mar 15, 2026

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

@jmikell821 jmikell821 enabled auto-merge (squash) March 16, 2026 19:30
@elasticmachine
Copy link
Copy Markdown

elasticmachine commented Mar 16, 2026

💚 Build Succeeded

History

cc @jmikell821

@jmikell821 jmikell821 merged commit 97cb946 into main Mar 16, 2026
11 checks passed
@jmikell821 jmikell821 deleted the docs-enhancement/clarify-windows-event-logs branch March 16, 2026 20:07
@elastic-vault-github-plugin-prod
Copy link
Copy Markdown

elastic-vault-github-plugin-prod bot commented Mar 16, 2026

Package system - 2.13.0 containing this change is available at https://epr.elastic.co/package/system/2.13.0/

@elastic-vault-github-plugin-prod
Copy link
Copy Markdown

elastic-vault-github-plugin-prod bot commented Mar 16, 2026

Package windows - 3.6.0 containing this change is available at https://epr.elastic.co/package/windows/3.6.0/

@elastic-vault-github-plugin-prod
Copy link
Copy Markdown

elastic-vault-github-plugin-prod bot commented Mar 16, 2026

Package winlog - 2.5.0 containing this change is available at https://epr.elastic.co/package/winlog/2.5.0/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mmahacek mmahacek mmahacek left review comments

@shmsr shmsr shmsr approved these changes

@theletterf theletterf theletterf approved these changes

@marc-gr marc-gr marc-gr approved these changes

@alaudazzi alaudazzi alaudazzi approved these changes

@nfritts nfritts nfritts approved these changes

@andrzej-stencel andrzej-stencel andrzej-stencel approved these changes

@VihasMakwana VihasMakwana Awaiting requested review from VihasMakwana VihasMakwana is a code owner automatically assigned from elastic/elastic-agent-data-plane

Assignees

@jmikell821 jmikell821

Labels

documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:system System Integration:windows Windows Integration:winlog Custom Windows Event Logs Team:Elastic-Agent-Data-Plane Agent Data Plane team [elastic/elastic-agent-data-plane] Team:Obs-InfraObs Observability Infrastructure Monitoring team [elastic/obs-infraobs-integrations] Team:Security-Linux Platform Linux Platform Security team [elastic/sec-linux-platform] Team:Security-Windows Platform Security Windows Platform team [elastic/sec-windows-platform]

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Documentation] Clarify use case of Windows Event Logs across multiple integrations