Skip to content

Commit 3e2fd02

Browse files
[9.0](backport #44793) [documentation][exported-fields] update autogeneration scripts to generate markdown (#44803)
* [documentation][exported-fields] update autogeneration scripts to generate markdown (#44793) * chore: port asciidoc scripts to markdown * fix docs preview * add meraki description * make check (cherry picked from commit 00dcc0c) # Conflicts: # docs/reference/metricbeat/exported-fields-nats.md # libbeat/scripts/generate_fields_docs.py * merge conflicts * exported docs --------- Co-authored-by: Vihas Makwana <[email protected]> Co-authored-by: Vihas Makwana <[email protected]>
1 parent 457669e commit 3e2fd02

File tree

230 files changed

+4320
-3482
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

230 files changed

+4320
-3482
lines changed

dev-tools/mage/docs.go

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ func DocsIndexFile(file string) DocsOption {
6666
// Docs holds the utilities for building documentation.
6767
var Docs = docsBuilder{}
6868

69-
// FieldDocs generates docs/fields.asciidoc from the specified fields.yml file.
69+
// FieldDocs generates exported-fields.md from the specified fields.yml file.
7070
func (docsBuilder) FieldDocs(fieldsYML string) error {
7171
// Run the docs_collector.py script.
7272
ve, err := PythonVirtualenv(false)
@@ -84,13 +84,15 @@ func (docsBuilder) FieldDocs(fieldsYML string) error {
8484
return err
8585
}
8686

87+
outputPath := filepath.Join(DocsDir(), "reference", BeatName)
88+
8789
// TODO: Port this script to Go.
88-
log.Println(">> Generating docs/fields.asciidoc for", BeatName)
90+
log.Println(">> Generating exported-fields.md for", BeatName)
8991
return sh.Run(python, LibbeatDir("scripts/generate_fields_docs.py"),
90-
fieldsYML, // Path to fields.yml.
91-
BeatName, // Beat title.
92-
esBeats, // Path to general beats folder.
93-
"--output_path", OSSBeatDir()) // It writes to {output_path}/docs/fields.asciidoc.
92+
fieldsYML, // Path to fields.yml.
93+
BeatName, // Beat title.
94+
esBeats, // Path to general beats folder.
95+
"--output_path", outputPath) // It writes to {output_path}/exported-fields.md.
9496
}
9597

9698
func (b docsBuilder) AsciidocBook(opts ...DocsOption) error {

docs/reference/auditbeat/exported-fields-auditd.md

Lines changed: 35 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ mapped_pages:
33
- https://www.elastic.co/guide/en/beats/auditbeat/current/exported-fields-auditd.html
44
---
55

6+
% This file is generated! See scripts/generate_fields_docs.py
7+
68
# Auditd fields [exported-fields-auditd]
79

810
These are the fields generated by the auditd module.
@@ -49,10 +51,9 @@ alias to: user.saved.group.id
4951
alias to: user.filesystem.group.id
5052

5153

52-
5354
## name_map [_name_map]
5455

55-
If `resolve_ids` is set to true in the configuration then `name_map` will contain a mapping of uid field names to the resolved name (e.g. auid root).
56+
If `resolve_ids` is set to true in the configuration then `name_map` will contain a mapping of uid field names to the resolved name (e.g. auid -> root).
5657

5758
**`user.name_map.auid`**
5859
: type: alias
@@ -96,7 +97,6 @@ alias to: user.saved.group.name
9697
alias to: user.filesystem.group.name
9798

9899

99-
100100
## selinux [_selinux]
101101

102102
The SELinux identity of the actor.
@@ -108,32 +108,31 @@ type: keyword
108108

109109

110110
**`user.selinux.role`**
111-
: users SELinux role
111+
: user's SELinux role
112112

113113
type: keyword
114114

115115

116116
**`user.selinux.domain`**
117-
: The actors SELinux domain or type.
117+
: The actor's SELinux domain or type.
118118

119119
type: keyword
120120

121121

122122
**`user.selinux.level`**
123-
: The actors SELinux level.
123+
: The actor's SELinux level.
124124

125125
type: keyword
126126

127127
example: s0
128128

129129

130130
**`user.selinux.category`**
131-
: The actors SELinux category or compartments.
131+
: The actor's SELinux category or compartments.
132132

133133
type: keyword
134134

135135

136-
137136
## process [_process]
138137

139138
Process attributes.
@@ -146,7 +145,6 @@ type: alias
146145
alias to: process.working_directory
147146

148147

149-
150148
## source [_source]
151149

152150
Source that triggered the event.
@@ -157,7 +155,6 @@ Source that triggered the event.
157155
type: keyword
158156

159157

160-
161158
## destination [_destination]
162159

163160
Destination address that triggered the event.
@@ -196,13 +193,12 @@ type: keyword
196193
example: success or fail
197194

198195

199-
200196
## actor [_actor]
201197

202198
The actor is the user that triggered the audit event.
203199

204200
**`auditd.summary.actor.primary`**
205-
: The primary identity of the actor. This is the actors original login ID. It will not change even if the user changes to another account.
201+
: The primary identity of the actor. This is the actor's original login ID. It will not change even if the user changes to another account.
206202

207203
type: keyword
208204

@@ -213,7 +209,6 @@ type: keyword
213209
type: keyword
214210

215211

216-
217212
## object [_object]
218213

219214
This is the thing or object being acted upon in the event.
@@ -238,7 +233,6 @@ type: keyword
238233
type: keyword
239234

240235

241-
242236
## paths [_paths]
243237

244238
List of paths associated with the event.
@@ -317,8 +311,7 @@ type: keyword
317311
type: keyword
318312

319313

320-
321-
## data [_data_2]
314+
## data [_data]
322315

323316
The data from the audit messages.
324317

@@ -335,7 +328,7 @@ type: keyword
335328

336329

337330
**`auditd.data.acct`**
338-
: a users account name
331+
: a user's account name
339332

340333
type: keyword
341334

@@ -555,7 +548,7 @@ type: keyword
555548

556549

557550
**`auditd.data.audit_backlog_limit`**
558-
: audit systems backlog queue size
551+
: audit system's backlog queue size
559552

560553
type: keyword
561554

@@ -591,7 +584,7 @@ type: keyword
591584

592585

593586
**`auditd.data.oauid`**
594-
: objects login user ID
587+
: object's login user ID
595588

596589
type: keyword
597590

@@ -615,13 +608,13 @@ type: keyword
615608

616609

617610
**`auditd.data.vm-ctx`**
618-
: the vms context string
611+
: the vm's context string
619612

620613
type: keyword
621614

622615

623616
**`auditd.data.opid`**
624-
: objects process ID
617+
: object's process ID
625618

626619
type: keyword
627620

@@ -675,7 +668,7 @@ type: keyword
675668

676669

677670
**`auditd.data.range`**
678-
: users SE Linux range
671+
: user's SE Linux range
679672

680673
type: keyword
681674

@@ -705,7 +698,7 @@ type: keyword
705698

706699

707700
**`auditd.data.subj`**
708-
: lspp subjects context string
701+
: lspp subject's context string
709702

710703
type: keyword
711704

@@ -723,13 +716,13 @@ type: keyword
723716

724717

725718
**`auditd.data.kernel`**
726-
: kernels version number
719+
: kernel's version number
727720

728721
type: keyword
729722

730723

731724
**`auditd.data.ocomm`**
732-
: objects command line name
725+
: object's command line name
733726

734727
type: keyword
735728

@@ -807,7 +800,7 @@ type: keyword
807800

808801

809802
**`auditd.data.iuid`**
810-
: ipc objects user ID
803+
: ipc object's user ID
811804

812805
type: keyword
813806

@@ -837,7 +830,7 @@ type: keyword
837830

838831

839832
**`auditd.data.vm-pid`**
840-
: vms process ID
833+
: vm's process ID
841834

842835
type: keyword
843836

@@ -855,7 +848,7 @@ type: keyword
855848

856849

857850
**`auditd.data.oses`**
858-
: objects session ID
851+
: object's session ID
859852

860853
type: keyword
861854

@@ -867,7 +860,7 @@ type: keyword
867860

868861

869862
**`auditd.data.igid`**
870-
: ipc objects group ID
863+
: ipc object's group ID
871864

872865
type: keyword
873866

@@ -987,7 +980,7 @@ type: keyword
987980

988981

989982
**`auditd.data.audit_backlog_wait_time`**
990-
: audit systems backlog wait time
983+
: audit system's backlog wait time
991984

992985
type: keyword
993986

@@ -1023,7 +1016,7 @@ type: keyword
10231016

10241017

10251018
**`auditd.data.format`**
1026-
: audit logs format
1019+
: audit log's format
10271020

10281021
type: keyword
10291022

@@ -1035,7 +1028,7 @@ type: keyword
10351028

10361029

10371030
**`auditd.data.tcontext`**
1038-
: the targets or objects context string
1031+
: the target's or object's context string
10391032

10401033
type: keyword
10411034

@@ -1113,7 +1106,7 @@ type: keyword
11131106

11141107

11151108
**`auditd.data.inode_gid`**
1116-
: group ID of the inodes owner
1109+
: group ID of the inode's owner
11171110

11181111
type: keyword
11191112

@@ -1203,7 +1196,7 @@ type: keyword
12031196

12041197

12051198
**`auditd.data.audit_failure`**
1206-
: audit systems failure mode
1199+
: audit system's failure mode
12071200

12081201
type: keyword
12091202

@@ -1263,7 +1256,7 @@ type: keyword
12631256

12641257

12651258
**`auditd.data.seuser`**
1266-
: users SE Linux user acct
1259+
: user's SE Linux user acct
12671260

12681261
type: keyword
12691262

@@ -1359,7 +1352,7 @@ type: keyword
13591352

13601353

13611354
**`auditd.data.list`**
1362-
: the audit systems filter list number
1355+
: the audit system's filter list number
13631356

13641357
type: keyword
13651358

@@ -1401,7 +1394,7 @@ type: keyword
14011394

14021395

14031396
**`auditd.data.audit_enabled`**
1404-
: audit systemss enable/disable status
1397+
: audit systems's enable/disable status
14051398

14061399
type: keyword
14071400

@@ -1425,19 +1418,19 @@ type: keyword
14251418

14261419

14271420
**`auditd.data.scontext`**
1428-
: the subjects context string
1421+
: the subject's context string
14291422

14301423
type: keyword
14311424

14321425

14331426
**`auditd.data.tclass`**
1434-
: targets object classification
1427+
: target's object classification
14351428

14361429
type: keyword
14371430

14381431

14391432
**`auditd.data.ver`**
1440-
: audit daemons version number
1433+
: audit daemon's version number
14411434

14421435
type: keyword
14431436

@@ -1455,7 +1448,7 @@ type: keyword
14551448

14561449

14571450
**`auditd.data.img-ctx`**
1458-
: the vms disk image context string
1451+
: the vm's disk image context string
14591452

14601453
type: keyword
14611454

@@ -1479,7 +1472,7 @@ type: keyword
14791472

14801473

14811474
**`auditd.data.inode_uid`**
1482-
: user ID of the inodes owner
1475+
: user ID of the inode's owner
14831476

14841477
type: keyword
14851478

@@ -1538,7 +1531,6 @@ type: alias
15381531
alias to: error.message
15391532

15401533

1541-
15421534
## geoip [_geoip]
15431535

15441536
The geoip fields are defined as a convenience in case you decide to enrich the data using a geoip filter in Logstash or an Elasticsearch geoip ingest processor.

docs/reference/auditbeat/exported-fields-beat-common.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ mapped_pages:
33
- https://www.elastic.co/guide/en/beats/auditbeat/current/exported-fields-beat-common.html
44
---
55

6+
% This file is generated! See scripts/generate_fields_docs.py
7+
68
# Beat fields [exported-fields-beat-common]
79

810
Contains common beat fields available in all event types.

0 commit comments

Comments
 (0)