Document input metrics

[andrewkroh]

Update the documentation for Filebeat, Winlogbeat, and Packetbeat to include a description of the metrics associated with the following inputs.

Inputs

• filebeat/aws-cloudwatch

  beats/x-pack/filebeat/input/awscloudwatch/metrics.go

  Lines 15 to 18 in f74ba69

  	logEventsReceivedTotal *monitoring.Uint // Number of CloudWatch log events received.
  	logGroupsTotal *monitoring.Uint // Logs collected from number of CloudWatch log groups.
  	cloudwatchEventsCreatedTotal *monitoring.Uint // Number of events created from processing logs from CloudWatch.
  	apiCallsTotal *monitoring.Uint // Number of API calls made total.

• filebeat/cel

  beats/x-pack/filebeat/input/cel/input.go

  Lines 927 to 934 in e00506e

  	resource *monitoring.String // URL-ish of input resource
  	executions *monitoring.Uint // times the CEL program has been executed
  	batchesReceived *monitoring.Uint // number of event arrays received
  	eventsReceived *monitoring.Uint // number of events received
  	batchesPublished *monitoring.Uint // number of event arrays published
  	eventsPublished *monitoring.Uint // number of events published
  	celProcessingTime metrics.Sample // histogram of the elapsed successful cel program processing times in nanoseconds
  	batchProcessingTime metrics.Sample // histogram of the elapsed successful batch processing times in nanoseconds (time of receipt to time of ACK for non-empty batches).

• winlogbeat/winlog

  beats/winlogbeat/eventlog/wineventlog.go

  Lines 652 to 658 in 71530c4

  	name *monitoring.String // name of the provider being read
  	events *monitoring.Uint // total number of events received
  	dropped *monitoring.Uint // total number of discarded events
  	errors *monitoring.Uint // total number of errors
  	batchSize metrics.Sample // histogram of the number of events in each non-zero batch
  	sourceLag metrics.Sample // histogram of the difference between timestamped event's creation and reading
  	batchPeriod metrics.Sample // histogram of the elapsed time between non-zero batch reads

• packetbeat/tcp

  beats/packetbeat/protos/tcp/tcp.go

  Lines 395 to 401 in 37ddd1e

  	device *monitoring.String // name of the device being monitored
  	packets *monitoring.Uint // number of packets processed
  	bytes *monitoring.Uint // number of bytes processed
  	overlapped *monitoring.Uint // number of packets shrunk due to overlap
  	dropped *monitoring.Int // number of packets dropped because of gaps
  	arrivalPeriod metrics.Sample // histogram of the elapsed time between packet arrivals
  	processingTime metrics.Sample // histogram of the elapsed time between packet receipt and publication

• packetbeat/udp

  beats/packetbeat/protos/udp/udp.go

  Lines 145 to 149 in 7356c98

  	device *monitoring.String // name of the device being monitored
  	packets *monitoring.Uint // number of packets processed
  	bytes *monitoring.Uint // number of bytes processed
  	arrivalPeriod metrics.Sample // histogram of the elapsed time between packet arrivals
  	processingTime metrics.Sample // histogram of the elapsed time between packet receipt and publication

Existing Examples

• filebeat/tcp
• filebeat/udp
• filebeat/unix
• filebeat/aws-s3

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewkroh]

For consistency and to steer users toward the documented /inputs/ endpoint, we should update the existing metrics docs in 8.7 and beyond with

from:

These metrics are exposed under the /dataset path.

to:

These metrics are exposed under the /inputs path.