[FR] option to users to be able to edit detection-rules

[krishhteja]

Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

1. For a project, I'm trying to add detection rules such that they are tied to a particular namespace. Due to the parsing of beats using beat-*, it gets harder to add a namespace variable before *
2. If any of the parent directories have a - in the name, it fails to compile

Describe the solution you'd like
A clear and concise description of what you want to happen.

1. Once the issue is resolved, beats would be parsed by beat- instead of beat-* so that it is easy to add a namespace after beat-
2. Once fixed, parent directories having - shouldn't block from running the program

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.
2) Edited my file path to have no -. This works fine but having a generic option would help

Additional context
Add any other context or screenshots about the feature request here.

[brokensound77]

Can you share an example similar to an index pattern you are using with namespace

[krishhteja]

Sure. I'm trying to add rules having namespace in them logbeat-<NAMESPACE>*, winbeat-<NAMESPACE>* etc so that my search for that rule is limited to only that namespace

[krishhteja]

This is the PR for the same

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[botelastic]

This has been closed due to inactivity. If you feel this is an error, please re-open and include a justifying comment.

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[botelastic]

This has been closed due to inactivity. If you feel this is an error, please re-open and include a justifying comment.