Hi,
In our environment we connect a lot of servers from different customers where we enrich all events with the ID of that customer. For most integrations it's possible to add custom processors in the integration policy in Kibana, but for the endpoint package this option doesn't exist.
As an example, in the access datastream for the Apache policy there is some processor configuration (https://github.com/elastic/integrations/blob/main/packages/apache/data_stream/access/manifest.yml#L32) which makes this option available in Kibana and templates it in the Agent's config. (https://github.com/elastic/integrations/blob/main/packages/apache/data_stream/access/agent/stream/log.yml.hbs#L17)
We would like this feature in the endpoint package so we can enrich the events with information based on the integration policy the agent is using.
Hi,
In our environment we connect a lot of servers from different customers where we enrich all events with the ID of that customer. For most integrations it's possible to add custom processors in the integration policy in Kibana, but for the endpoint package this option doesn't exist.
As an example, in the access datastream for the Apache policy there is some processor configuration (https://github.com/elastic/integrations/blob/main/packages/apache/data_stream/access/manifest.yml#L32) which makes this option available in Kibana and templates it in the Agent's config. (https://github.com/elastic/integrations/blob/main/packages/apache/data_stream/access/agent/stream/log.yml.hbs#L17)
We would like this feature in the endpoint package so we can enrich the events with information based on the integration policy the agent is using.