[Filebeat] Include input metadata in logs

[taylor-swanson]

Overview

For loggers in inputs, additional metadata should be added to enrich logs about the input type, id, and any other attribute that would be necessary for identifying/filtering logs in Kibana, namely the Agent Logs UI.

This issue builds off the proposal in this RFC. While the RFC proposed extending the unit.* fields, it would be better to add to the existing input.* fields.

Proposed fields:

• input.type
• input.id
• input.name

Problems

Elastic Agent uses filestream to read Filebeat logs and input.type is always overridden with filestream

Related Issues

• Relates elastic/integration-experience#32

[elasticmachine]

Pinging @elastic/sec-deployment-and-devices (Team:Security-Deployment and Devices)

[taylor-swanson]

Since Elastic Agent will overwrite input.type in some situations, the new fields will be nested under log.input.*. The final fields to be added are:

• log.input.id - the id of the input (udp-cisco_asa.log-a9570e9e-b147-4045-827d-bde4213f5210)
• log.input.type - the type of the input (udp)

log.input.name was previously suggested, but this seems to be redundant when log.input.type is already given.