Enhancement - Allow custom processors from the Integration policy

[rlapond]

Hi,

In our environment we connect a lot of servers from different customers where we enrich all events with the ID of that customer. For most integrations it's possible to add custom processors in the integration policy in Kibana, but for the endpoint package this option doesn't exist.

As an example, in the access datastream for the Apache policy there is some processor configuration (https://github.com/elastic/integrations/blob/main/packages/apache/data_stream/access/manifest.yml#L32) which makes this option available in Kibana and templates it in the Agent's config. (https://github.com/elastic/integrations/blob/main/packages/apache/data_stream/access/agent/stream/log.yml.hbs#L17)

We would like this feature in the endpoint package so we can enrich the events with information based on the integration policy the agent is using.

[ferullo]

Since 8.11, Endpoint supports an advanced option windows.advanced.document_enrichment.fields / mac.advanced.document_enrichment.fields / linux.advanced.document_enrichment.fields that can be used to set custom fields in documents on a per policy basis. Does that help?