Osquerybeat: Add support for input/integration level osquery platform/version/discovery configuration #27233
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Add support for input/integration level osquery platform/version/discovery configuration.
This allows to map the integration configuration to the osquery packs 1:1.
The
platform
andversion
constraints at the input level had to have a different name currently in order to avoid these values to be injected in every stream instead, that's why the names areiplatform
andiversion
as abbreviation for theinput platform
and theinput version
.This change requires the updated osquery_manager integration elastic/integrations#1441
and is also couple of more fixes on kibana side:
This change can be merged before the work mentioned above, the new constraints just would get propagated with the the policy and would not apply to the osquery configuration without those changes.
Here is an example of the request payload with the new constraints:
Here is the screenshot of the policy configuration with the new
input level
constraintsWhy is it important?
This is needed in order to support the osquery packs further configuration options.
Checklist
Related issues
Special thanks to @nchaulet for working with me yesterday through undocumented obstacles of integration package changes and kibana errors.