add field mapping to filebeat ds

kcreddy · kcreddy · commit 3b40cb6333fc · 2023-01-31T16:11:02.000+05:30
diff --git a/packages/elastic_agent/data_stream/filebeat_metrics/fields/fields.yml b/packages/elastic_agent/data_stream/filebeat_metrics/fields/fields.yml
@@ -23,6 +23,63 @@
       ignore_above: 1024
       description: Elastic agent version.
       example: 7.11.0
+    # Filebeat Input Metrics fields
+    - name: filebeat_input
+      title: Filebeat Input Metric fields
+      description: Fields related to the Filebeat Input Metrics
+      type: group
+      fields:
+        # Common static fields for all inputs
+        - name: id
+          type: keyword
+          description: ID of the Filebeat Input
+        - name: input
+          type: keyword
+          description: Filebeat Input type
+        # Common dynamic fields for all inputs
+        - name: '*.histogram.*'
+          type: object
+          object_type: double
+          object_type_mapping_type: "*"
+          description: Map all fields with `path_match:``*.histogram.*` to `double`
+        - name: '*.histogram.count'
+          type: object
+          object_type: long
+          object_type_mapping_type: "*"
+          description: Map all fields with `path_match:``*.histogram.count` to `long`
+        - name: '*_total'
+          type: object
+          object_type: long
+          object_type_mapping_type: "*"
+          description: Map all fields with `path_match:``*_total` to `long`
+        - name: '*_gauge'
+          type: object
+          object_type: long
+          object_type_mapping_type: "*"
+          description: Map all fields with `path_match:``*_gauge` to `long`
+        - name: '*_length'
+          type: object
+          object_type: long
+          object_type_mapping_type: "*"
+          description: Map all fields with `path_match:``*_length` to `long`
+        # CEL specific fields
+        - name: resource
+          type: keyword
+          description: URL-ish of CEL input resource
+        - name: cel_executions
+          type: long
+          description: URL-ish of input resource
+        # Lumberjack specific fields
+        - name: bind_address
+          type: keyword
+          description: Bind address of Lumberjack input.
+        # UDP specific fields
+        - name: device
+          type: keyword
+          description: Name of the UDP device being monitored
+        - name: system_packet_drops
+          type: long
+          description: Number of udp drops noted in /proc/net/udp
 - name: system.process
   type: group
   fields:
