Skip to content

Commit

Permalink
Polish content
Browse files Browse the repository at this point in the history
  • Loading branch information
karenzone committed Nov 8, 2024
1 parent a7800a8 commit 4b4e672
Show file tree
Hide file tree
Showing 2 changed files with 19 additions and 17 deletions.
26 changes: 14 additions & 12 deletions docs/static/ea-integration-tutorial.asciidoc
Original file line number Diff line number Diff line change
@@ -1,31 +1,32 @@
[[ea-integrations-tutorial]]
=== Tutorial: {ls} `elastic_integration filter` to extend Elastic {integrations}
=== Tutorial: Using the {ls} `elastic_integration filter` to extend Elastic {integrations}
++++
<titleabbrev>Tutorial: {ls} `elastic_integration filter`</titleabbrev>
++++

You can use {ls} to transform events collected by {agent} using our {integrations-docs}[Elastic integrations].
You can use {ls} to transform events collected by {agent} and paired with an {integrations-docs}[Elastic integration].
You get the benefits of Elastic integrations--such as the simplicity of ingesting data from a wide variety of data
sources and ensuring compliance with the {ecs-ref}/index.html[Elastic Common Schema (ECS)]--combined with the extra
processing power of {ls}.

This new functionality is made possible by the <<plugins-filters-elastic_integration,elastic_integration filter>> plugin.
When you include the `elastic_integration` filter in your configuration, {ls} reads certain field values generated by the {agent},
and uses them to apply the transformations from Elastic integrations. This allows you to to further process events in the Logstash pipeline before sending them to their
and uses them to apply the transformations from Elastic integrations.
This allows you to to further process events in the Logstash pipeline before sending them to their
configured destinations.

This tutorial walks you through adding the {integrations-docs}/crowdstrike-intro[Crowdstrike integration], using {ls} to
remove the `_version` field, and then sending the data to {ess} or self-managed {es}.


[[ea-integrations-prereqs]]
==== Prerequisites and requirements
==== Prerequisites

You'll need:
You need:

* A working {es} cluster
* {fleet} server
* An {agent} configured to send output to {ls}
* {fleet-server}
* An {fleet-guide}/elastic-agent-installation.html[{agent} installed] on the hosts you want to collect data from, and configured to {fleet-guide}/logstash-output.html[send output to {ls}]
* An active Elastic Enterprise https://www.elastic.co/subscriptions[subscription]
* A user configured with the <<plugins-filters-elastic_integration-minimum_required_privileges,minimum required privileges>>

Expand Down Expand Up @@ -157,8 +158,8 @@ filter {
hosts => "{es-host}:9200"
ssl_enabled => true
ssl_certificate_authorities => "/usr/share/logstash/config/certs/ca-cert.pem"
username => "elastic" <1>
password => "changeme" <2>
username => "elastic"
password => "changeme"
remove_field => ["_version"]
}
}
Expand All @@ -177,7 +178,8 @@ output {
}
-----

<1> The user credentials that you specify in the `elastic_integration` filter must have sufficient privileges to get information about {es} and the integrations that you are using.
<2> The user credentials that you specify in the `elastic_integration` filter must have sufficient privileges to get information about {es} and the integrations that you are using.
Note that the user credentials that you specify in the `elastic_integration` filter must have sufficient privileges to get information about {es} and the integrations that you are using.

If your {agent} and {ls} pipeline are configured correctly, then events go to {ls} for processing before {ls} forwards them on to {es}.


All processing occurs in {ls} before events are forwarded to {es}.
10 changes: 5 additions & 5 deletions docs/static/ea-integrations.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -78,13 +78,11 @@ output { <3>
-----

<1> Use `filter-elastic_integration` as the first filter in your pipeline
<2> You can use additional filters as long as they follow `filter-elastic_integration`. They will have access to the event as-transformed by your enabled integrations.
<2> You can use additional filters as long as they follow `filter-elastic_integration`.
They will have access to the event as transformed by your enabled integrations.
<3> Sample config to output data to multiple destinations

<<<<<<< 15871-tutorial

include::ea-integration-tutorial.asciidoc[]
=======
[discrete]
[[es-tips]]
==== Using `filter-elastic_integration` with `output-elasticsearch`
Expand All @@ -97,4 +95,6 @@ Be sure that these features are enabled in the {logstash-ref}/plugins-outputs-el
* Set {logstash-ref}/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-ecs_compatibility[`ecs-compatibility`] to `v1` or `v8`.

Check out the {logstash-ref}/plugins-outputs-elasticsearch.html[`output-elasticsearch` plugin] docs for additional settings.
>>>>>>> main


include::ea-integration-tutorial.asciidoc[]

0 comments on commit 4b4e672

Please sign in to comment.