[DOC] Add notes to Packetbeat docs related to bonded interfaces

[joshjanoski]

This is in relation to the issue here: #21495 that is currently being looked into. If this issue is resolved, then a doc enhancement may not be needed, but I wanted to call out a specific scenario that would be worth noting until this is resolved.

The page here: https://www.elastic.co/guide/en/beats/packetbeat/current/configuration-interfaces.html#_sniffing_configuration_options shows an example of configuring the packetbeat.interfaces.device: any parameter. However, when setting the any value for this parameter while using a bonded network interface, you will encounter an issue where Packetbeat will attempt to send null values for some fields (notably the dns.resolved_ip and related.ip fields). As a result, some log lines will fail to index due to these conflicts.

The current workaround is to change the packetbeat.interfaces.device: parameter from any to the specific name of the bonded interface. Can the documentation please be updated to include a note related to bonded interfaces letting readers know that they may need to account for this issue in their config if using bonded interfaces. Thank you!

[elasticmachine]

Pinging @elastic/obs-docs (Team:Docs)

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.