Filebeat: filter inputs as first input transform.

Move input filtering to be the first input transformation that occurs in the filebeat spec file. Fixes #427.
elastic · Jul 8, 2022 · 5c6fe30 · 5c6fe30
1 parent 7f573b5
commit 5c6fe30
Show file tree

Hide file tree

Showing 2 changed files with 39 additions and 29 deletions.
diff --git a/internal/pkg/agent/program/supported.go b/internal/pkg/agent/program/supported.go
diff --git a/internal/spec/filebeat.yml b/internal/spec/filebeat.yml
@@ -19,6 +19,44 @@ rules:
     on_conflict: insert_after
     type: logs
 
+# Input filtering needs to happen before any other input transformations.
+# See https://github.com/elastic/elastic-agent/issues/427.
+- filter_values:
+    selector: inputs
+    key: type
+    values:
+    - aws-cloudwatch
+    - aws-s3
+    - azure-eventhub
+    - cloudfoundry
+    - container
+    - docker
+    - event/file
+    - event/stdin
+    - event/tcp
+    - event/udp
+    - filestream
+    - gcp-pubsub
+    - http_endpoint
+    - httpjson
+    - journald
+    - kafka
+    - log
+    - log/docker
+    - log/redis_slowlog
+    - log/syslog
+    - logfile
+    - mqtt
+    - netflow
+    - o365audit
+    - redis
+    - stdin
+    - syslog
+    - tcp
+    - udp
+    - unix
+    - winlog
+
 - map:
     path: inputs
     rules:
@@ -63,34 +101,6 @@ rules:
     - remove_key:
         key: data_stream.dataset
 
-- filter_values:
-    selector: inputs
-    key: type
-    values:
-    - aws-cloudwatch
-    - aws-s3
-    - azure-eventhub
-    - cloudfoundry
-    - container
-    - docker
-    - gcp-pubsub
-    - http_endpoint
-    - httpjson
-    - journald
-    - kafka
-    - log
-    - mqtt
-    - netflow
-    - o365audit
-    - redis
-    - stdin
-    - syslog
-    - tcp
-    - udp
-    - unix
-    - winlog
-    - filestream
-
 - filter_values:
     selector: inputs
     key: enabled