First pass at auditbeat support

x-pack/auditbeat/cmd/agent.go

@@ -0,0 +1,38 @@
+// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+// or more contributor license agreements. Licensed under the Elastic License;
+// you may not use this file except in compliance with the Elastic License.
+
+package cmd
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/elastic/beats/v7/libbeat/common/reload"
+	"github.com/elastic/beats/v7/x-pack/libbeat/management"
+	"github.com/elastic/elastic-agent-client/v7/pkg/client"
+	"github.com/elastic/elastic-agent-client/v7/pkg/proto"
+)
+
+func auditbeatCfg(rawIn *proto.UnitExpectedConfig, agentInfo *client.AgentInfo) ([]*reload.ConfigWithMeta, error) {
+	modules, err := management.CreateInputsFromStreams(rawIn, "metrics", agentInfo)
+	if err != nil {
+		return nil, fmt.Errorf("error creating input list from raw expected config: %w", err)
+	}
+
+	// Extact the type field that has "audit/auditd", treat this
+	// as the module config key
+	module := strings.Split(rawIn.Type, "/")[1]
+
+	for iter := range modules {
+		modules[iter]["module"] = module
+	}
+
+	// format for the reloadable list needed bythe cm.Reload() method
+	configList, err := management.CreateReloadConfigFromInputs(modules)
+	if err != nil {
+		return nil, fmt.Errorf("error creating reloader config: %w", err)
+	}
+
+	return configList, nil
+}

x-pack/auditbeat/cmd/root.go

@@ -11,6 +11,7 @@ import (
 	// Register Auditbeat x-pack modules.
 	_ "github.com/elastic/beats/v7/x-pack/auditbeat/include"
 	_ "github.com/elastic/beats/v7/x-pack/libbeat/include"
+	"github.com/elastic/beats/v7/x-pack/libbeat/management"
 )
 
 // Name of the beat
@@ -20,6 +21,7 @@ var Name = auditbeatcmd.Name
 var RootCmd *cmd.BeatsRootCmd
 
 func init() {
+	management.ConfigTransform.SetTransform(auditbeatCfg)
 	settings := auditbeatcmd.AuditbeatSettings()
 	settings.ElasticLicensed = true
 	RootCmd = auditbeatcmd.Initialize(settings)