Enable netinfo in add metadata processors (elastic#16077)

Enable netinfo in add_host_metadata and add_observer_metadata processors
by default. This network information metadata is used in observability solutions.

Co-authored-by: Dan Roscigno <dan@roscigno.com>

CHANGELOG.next.asciidoc

@@ -106,6 +106,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 *Affecting all Beats*
 
 - Add document_id setting to decode_json_fields processor. {pull}15859[15859]
+- Include network information by default on add_host_metadata and add_observer_metadata. {issue}15347[15347] {pull}16077[16077]
 - Add `aws_ec2` provider for autodiscover. {issue}12518[12518] {pull}14823[14823]
 
 *Auditbeat*

auditbeat/auditbeat.reference.yml

@@ -315,8 +315,7 @@ auditbeat.modules:
 # The following example enriches each event with host metadata.
 #
 #processors:
-#- add_host_metadata:
-#   netinfo.enabled: false
+#- add_host_metadata: ~
 #
 # The following example enriches each event with process metadata using
 # process IDs included in the event.

filebeat/filebeat.reference.yml

@@ -1020,8 +1020,7 @@ filebeat.inputs:
 # The following example enriches each event with host metadata.
 #
 #processors:
-#- add_host_metadata:
-#   netinfo.enabled: false
+#- add_host_metadata: ~
 #
 # The following example enriches each event with process metadata using
 # process IDs included in the event.

heartbeat/heartbeat.reference.yml

@@ -459,8 +459,7 @@ heartbeat.scheduler:
 # The following example enriches each event with host metadata.
 #
 #processors:
-#- add_host_metadata:
-#   netinfo.enabled: false
+#- add_host_metadata: ~
 #
 # The following example enriches each event with process metadata using
 # process IDs included in the event.

journalbeat/journalbeat.reference.yml

@@ -253,8 +253,7 @@ setup.template.settings:
 # The following example enriches each event with host metadata.
 #
 #processors:
-#- add_host_metadata:
-#   netinfo.enabled: false
+#- add_host_metadata: ~
 #
 # The following example enriches each event with process metadata using
 # process IDs included in the event.

libbeat/_meta/config.reference.yml.tmpl

@@ -196,8 +196,7 @@
 # The following example enriches each event with host metadata.
 #
 #processors:
-#- add_host_metadata:
-#   netinfo.enabled: false
+#- add_host_metadata: ~
 #
 # The following example enriches each event with process metadata using
 # process IDs included in the event.

libbeat/processors/add_host_metadata/add_host_metadata_test.go

@@ -64,21 +64,21 @@ func TestConfigDefault(t *testing.T) {
 	assert.NotNil(t, v)
 
 	v, err = newEvent.GetValue("host.ip")
-	assert.Error(t, err)
-	assert.Nil(t, v)
+	assert.NoError(t, err)
+	assert.NotNil(t, v)
 
 	v, err = newEvent.GetValue("host.mac")
-	assert.Error(t, err)
-	assert.Nil(t, v)
+	assert.NoError(t, err)
+	assert.NotNil(t, v)
 }
 
-func TestConfigNetInfoEnabled(t *testing.T) {
+func TestConfigNetInfoDisabled(t *testing.T) {
 	event := &beat.Event{
 		Fields:    common.MapStr{},
 		Timestamp: time.Now(),
 	}
 	testConfig, err := common.NewConfigFrom(map[string]interface{}{
-		"netinfo.enabled": true,
+		"netinfo.enabled": false,
 	})
 	assert.NoError(t, err)
 
@@ -107,12 +107,12 @@ func TestConfigNetInfoEnabled(t *testing.T) {
 	assert.NotNil(t, v)
 
 	v, err = newEvent.GetValue("host.ip")
-	assert.NoError(t, err)
-	assert.NotNil(t, v)
+	assert.Error(t, err)
+	assert.Nil(t, v)
 
 	v, err = newEvent.GetValue("host.mac")
-	assert.NoError(t, err)
-	assert.NotNil(t, v)
+	assert.Error(t, err)
+	assert.Nil(t, v)
 }
 
 func TestConfigName(t *testing.T) {

libbeat/processors/add_host_metadata/config.go

@@ -33,7 +33,7 @@ type Config struct {
 
 func defaultConfig() Config {
 	return Config{
-		NetInfoEnabled: false,
+		NetInfoEnabled: true,
 		CacheTTL:       5 * time.Minute,
 	}
 }

libbeat/processors/add_host_metadata/docs/add_host_metadata.asciidoc

@@ -5,7 +5,6 @@
 -------------------------------------------------------------------------------
 processors:
 - add_host_metadata:
-    netinfo.enabled: false
     cache.ttl: 5m
     geo:
       name: nyc-dc1-rack1
@@ -19,7 +18,7 @@ processors:
 
 It has the following settings:
 
-`netinfo.enabled`:: (Optional) Default false. Include IP addresses and MAC addresses as fields host.ip and host.mac
+`netinfo.enabled`:: (Optional) Default true. Include IP addresses and MAC addresses as fields host.ip and host.mac
 
 `cache.ttl`:: (Optional) The processor uses an internal cache for the host metadata. This sets the cache expiration time. The default is 5m, negative values disable caching altogether.
 

libbeat/processors/add_observer_metadata/add_observer_metadata_test.go

@@ -42,12 +42,12 @@ func TestConfigDefault(t *testing.T) {
 	assert.NoError(t, err)
 
 	v, err := newEvent.GetValue("observer.ip")
-	assert.Error(t, err)
-	assert.Nil(t, v)
+	assert.NoError(t, err)
+	assert.NotNil(t, v)
 
 	v, err = newEvent.GetValue("observer.mac")
-	assert.Error(t, err)
-	assert.Nil(t, v)
+	assert.NoError(t, err)
+	assert.NotNil(t, v)
 }
 
 func TestOverwriteFalse(t *testing.T) {
@@ -86,13 +86,13 @@ func TestOverwriteTrue(t *testing.T) {
 	assert.NotNil(t, v)
 }
 
-func TestConfigNetInfoEnabled(t *testing.T) {
+func TestConfigNetInfoDisabled(t *testing.T) {
 	event := &beat.Event{
 		Fields:    common.MapStr{},
 		Timestamp: time.Now(),
 	}
 	testConfig, err := common.NewConfigFrom(map[string]interface{}{
-		"netinfo.enabled": true,
+		"netinfo.enabled": false,
 	})
 	assert.NoError(t, err)
 
@@ -102,12 +102,12 @@ func TestConfigNetInfoEnabled(t *testing.T) {
 	assert.NoError(t, err)
 
 	v, err := newEvent.GetValue("observer.ip")
-	assert.NoError(t, err)
-	assert.NotNil(t, v)
+	assert.Error(t, err)
+	assert.Nil(t, v)
 
 	v, err = newEvent.GetValue("observer.mac")
-	assert.NoError(t, err)
-	assert.NotNil(t, v)
+	assert.Error(t, err)
+	assert.Nil(t, v)
 }
 
 func TestConfigGeoEnabled(t *testing.T) {

libbeat/processors/add_observer_metadata/config.go

@@ -33,7 +33,7 @@ type Config struct {
 
 func defaultConfig() Config {
 	return Config{
-		NetInfoEnabled: false,
+		NetInfoEnabled: true,
 		CacheTTL:       5 * time.Minute,
 	}
 }

libbeat/processors/add_observer_metadata/docs/add_observer_metadata.asciidoc

@@ -7,7 +7,6 @@ beta[]
 -------------------------------------------------------------------------------
 processors:
 - add_observer_metadata:
-    netinfo.enabled: false
     cache.ttl: 5m
     geo:
       name: nyc-dc1-rack1
@@ -21,7 +20,7 @@ processors:
 
 It has the following settings:
 
-`netinfo.enabled`:: (Optional) Default false. Include IP addresses and MAC addresses as fields observer.ip and observer.mac
+`netinfo.enabled`:: (Optional) Default true. Include IP addresses and MAC addresses as fields observer.ip and observer.mac
 
 `cache.ttl`:: (Optional) The processor uses an internal cache for the observer metadata. This sets the cache expiration time. The default is 5m, negative values disable caching altogether.
 

metricbeat/metricbeat.reference.yml

@@ -1004,8 +1004,7 @@ metricbeat.modules:
 # The following example enriches each event with host metadata.
 #
 #processors:
-#- add_host_metadata:
-#   netinfo.enabled: false
+#- add_host_metadata: ~
 #
 # The following example enriches each event with process metadata using
 # process IDs included in the event.

packetbeat/packetbeat.reference.yml

@@ -742,8 +742,7 @@ packetbeat.ignore_outgoing: false
 # The following example enriches each event with host metadata.
 #
 #processors:
-#- add_host_metadata:
-#   netinfo.enabled: false
+#- add_host_metadata: ~
 #
 # The following example enriches each event with process metadata using
 # process IDs included in the event.

winlogbeat/winlogbeat.reference.yml

@@ -238,8 +238,7 @@ winlogbeat.event_logs:
 # The following example enriches each event with host metadata.
 #
 #processors:
-#- add_host_metadata:
-#   netinfo.enabled: false
+#- add_host_metadata: ~
 #
 # The following example enriches each event with process metadata using
 # process IDs included in the event.

x-pack/auditbeat/auditbeat.reference.yml

@@ -371,8 +371,7 @@ auditbeat.modules:
 # The following example enriches each event with host metadata.
 #
 #processors:
-#- add_host_metadata:
-#   netinfo.enabled: false
+#- add_host_metadata: ~
 #
 # The following example enriches each event with process metadata using
 # process IDs included in the event.

x-pack/filebeat/filebeat.reference.yml

@@ -1566,8 +1566,7 @@ filebeat.inputs:
 # The following example enriches each event with host metadata.
 #
 #processors:
-#- add_host_metadata:
-#   netinfo.enabled: false
+#- add_host_metadata: ~
 #
 # The following example enriches each event with process metadata using
 # process IDs included in the event.

x-pack/functionbeat/functionbeat.reference.yml

@@ -581,8 +581,7 @@ functionbeat.provider.gcp.functions:
 # The following example enriches each event with host metadata.
 #
 #processors:
-#- add_host_metadata:
-#   netinfo.enabled: false
+#- add_host_metadata: ~
 #
 # The following example enriches each event with process metadata using
 # process IDs included in the event.

x-pack/metricbeat/metricbeat.reference.yml

@@ -1237,8 +1237,7 @@ metricbeat.modules:
 # The following example enriches each event with host metadata.
 #
 #processors:
-#- add_host_metadata:
-#   netinfo.enabled: false
+#- add_host_metadata: ~
 #
 # The following example enriches each event with process metadata using
 # process IDs included in the event.

x-pack/winlogbeat/winlogbeat.reference.yml

@@ -241,8 +241,7 @@ winlogbeat.event_logs:
 # The following example enriches each event with host metadata.
 #
 #processors:
-#- add_host_metadata:
-#   netinfo.enabled: false
+#- add_host_metadata: ~
 #
 # The following example enriches each event with process metadata using
 # process IDs included in the event.