[DOCS] Add missing config options to shared file (#15136)

* [DOCS] Add missing config options to shared file

* Add fixes from review

* Run mage fmt update to fix build error

auditbeat/docs/auditbeat-options.asciidoc

@@ -0,0 +1,56 @@
+//////////////////////////////////////////////////////////////////////////
+//// This content is shared by all Auditbeat modules. Make sure you keep the
+//// descriptions generic enough to work for all modules. To include
+//// this file, use:
+////
+//// include::{docdir}/auditbeat-options.asciidoc[]
+////
+//////////////////////////////////////////////////////////////////////////
+
+[id="module-standard-options-{modulename}"]
+[float]
+==== Standard configuration options
+
+You can specify the following options for any {beatname_uc} module. 
+
+*`module`*:: The name of the module to run.
+
+ifeval::["{modulename}"=="system"]
+*`datasets`*:: A list of datasets to execute.
+endif::[]
+
+*`enabled`*:: A Boolean value that specifies whether the module is enabled.
+
+ifeval::["{modulename}"=="system"]
+*`period`*:: The frequency at which the datasets check for changes. If a system
+is not reachable, {beatname_uc} returns an error for each period. This setting
+is required. For most datasets, especially `process` and `socket`, a shorter
+period is recommended.
+endif::[]
+
+*`fields`*:: A dictionary of fields that will be sent with the dataset event. This setting
+is optional.
+
+*`tags`*:: A list of tags that will be sent with the dataset event. This setting is
+optional.
+
+*`processors`*:: A list of processors to apply to the data generated by the dataset.
++
+See <<filtering-and-enhancing-data>> for information about specifying
+processors in your config.
+
+*`index`*:: If present, this formatted string overrides the index for events from this
+module (for elasticsearch outputs), or sets the `raw_index` field of the event's
+metadata (for other outputs). This string can only refer to the agent name and
+version and the event timestamp; for access to dynamic fields, use
+`output.elasticsearch.index` or a processor.
++
+Example value: `"%{[agent.name]}-myindex-%{+yyyy.MM.dd}"` might
+expand to +"{beatname_lc}-myindex-2019.12.13"+.
+
+*`keep_null`*:: If this option is set to true, fields with `null` values will be published in
+the output document. By default, `keep_null` is set to `false`.
+
+*`service.name`*:: A name given by the user to the service the data is collected from. It can be
+used for example to identify information collected from nodes of different
+clusters with the same `service.type`.

auditbeat/docs/modules/auditd.asciidoc

@@ -2,6 +2,8 @@
 This file is generated! See scripts/docs_collector.py
 ////
 
+:modulename: auditd
+
 [id="{beatname_lc}-module-auditd"]
 == Auditd Module
 
@@ -135,6 +137,10 @@ following example shows all configuration options with their default values.
   backpressure_strategy: auto
 ----
 
+This module also supports the
+<<module-standard-options-{modulename},standard configuration options>>
+described later.
+
 *`socket_type`*:: This optional setting controls the type of
 socket that {beatname_uc} uses to receive events from the kernel. The two
 options are `unicast` and `multicast`.
@@ -189,7 +195,8 @@ setting is primarily used for development and debugging purposes.
 installed to the kernel. There should be one rule per line. Comments can be
 embedded in the string using `#` as a prefix. The format for rules is the same
 used by the Linux `auditctl` utility. {beatname_uc} supports adding file watches
-(`-w`) and syscall rules (`-a` or `-A`).
+(`-w`) and syscall rules (`-a` or `-A`). For more information, see
+<<audit-rules>>.
 
 *`audit_rule_files`*:: A list of files to load audit rules from. This files are
 loaded after the rules declared in `audit_rules` are loaded. Wildcards are
@@ -218,10 +225,10 @@ time.
 - `none`: No backpressure mitigation measures are enabled.
 --
 
-*`keep_null`*:: If this option is set to true, fields with `null` values will be
-published in the output document. By default, `keep_null` is set to `false`.
+include::{docdir}/auditbeat-options.asciidoc[]
 
 [float]
+[[audit-rules]]
 === Audit rules
 
 The audit rules are where you configure the activities that are audited. These
@@ -304,3 +311,6 @@ auditbeat.modules:
 
 ----
 
+
+:modulename!:
+

auditbeat/docs/modules/file_integrity.asciidoc

@@ -2,6 +2,8 @@
 This file is generated! See scripts/docs_collector.py
 ////
 
+:modulename: file_integrity
+
 [id="{beatname_lc}-module-file_integrity"]
 == File Integrity Module
 
@@ -66,6 +68,10 @@ Linux.
   recursive: false
 ----
 
+This module also supports the
+<<module-standard-options-{modulename},standard configuration options>>
+described later.
+
 *`paths`*:: A list of paths (directories or files) to watch. Globs are
 not supported. The specified paths should exist when the metricset is started.
 
@@ -122,8 +128,7 @@ of this directories are watched. If `recursive` is set to `true`, the
 `file_integrity` module will watch for changes on this directories and all
 their subdirectories.
 
-*`keep_null`*:: If this option is set to true, fields with `null` values will be
-published in the output document. By default, `keep_null` is set to `false`.
+include::{docdir}/auditbeat-options.asciidoc[]
 
 
 [float]
@@ -146,3 +151,6 @@ auditbeat.modules:
 
 ----
 
+
+:modulename!:
+

auditbeat/module/auditd/_meta/docs.asciidoc

@@ -130,6 +130,10 @@ following example shows all configuration options with their default values.
   backpressure_strategy: auto
 ----
 
+This module also supports the
+<<module-standard-options-{modulename},standard configuration options>>
+described later.
+
 *`socket_type`*:: This optional setting controls the type of
 socket that {beatname_uc} uses to receive events from the kernel. The two
 options are `unicast` and `multicast`.
@@ -184,7 +188,8 @@ setting is primarily used for development and debugging purposes.
 installed to the kernel. There should be one rule per line. Comments can be
 embedded in the string using `#` as a prefix. The format for rules is the same
 used by the Linux `auditctl` utility. {beatname_uc} supports adding file watches
-(`-w`) and syscall rules (`-a` or `-A`).
+(`-w`) and syscall rules (`-a` or `-A`). For more information, see
+<<audit-rules>>.
 
 *`audit_rule_files`*:: A list of files to load audit rules from. This files are
 loaded after the rules declared in `audit_rules` are loaded. Wildcards are
@@ -213,10 +218,10 @@ time.
 - `none`: No backpressure mitigation measures are enabled.
 --
 
-*`keep_null`*:: If this option is set to true, fields with `null` values will be
-published in the output document. By default, `keep_null` is set to `false`.
+include::{docdir}/auditbeat-options.asciidoc[]
 
 [float]
+[[audit-rules]]
 === Audit rules
 
 The audit rules are where you configure the activities that are audited. These

auditbeat/module/file_integrity/_meta/docs.asciidoc

@@ -61,6 +61,10 @@ Linux.
   recursive: false
 ----
 
+This module also supports the
+<<module-standard-options-{modulename},standard configuration options>>
+described later.
+
 *`paths`*:: A list of paths (directories or files) to watch. Globs are
 not supported. The specified paths should exist when the metricset is started.
 
@@ -117,5 +121,4 @@ of this directories are watched. If `recursive` is set to `true`, the
 `file_integrity` module will watch for changes on this directories and all
 their subdirectories.
 
-*`keep_null`*:: If this option is set to true, fields with `null` values will be
-published in the output document. By default, `keep_null` is set to `false`.
+include::{docdir}/auditbeat-options.asciidoc[]

auditbeat/scripts/docs_collector.py

@@ -44,6 +44,9 @@ def collect(base_paths):
         os.mkdir(os.path.join(module_docs_path(module_dir), "modules", module))
 
         module_file = generated_note
+
+        module_file += ":modulename: " + module + "\n\n"
+
         module_file += "[id=\"{beatname_lc}-module-" + module + "\"]\n"
 
         with open(module_doc) as f:
@@ -84,6 +87,9 @@ def collect(base_paths):
 
             module_file += "----\n\n"
 
+        # Close modulename variable
+        module_file += "\n:modulename!:\n\n"
+
         module_links = ""
         module_includes = ""
 

x-pack/auditbeat/docs/modules/system.asciidoc

@@ -2,9 +2,10 @@
 This file is generated! See scripts/docs_collector.py
 ////
 
+:modulename: system
+
 [id="{beatname_lc}-module-system"]
 [role="xpack"]
-
 == System Module
 
 beta[]
@@ -72,8 +73,9 @@ sample suggested configuration.
   user.detect_password_changes: true
 ----
 
-*`period`*:: The frequency at which the datasets check for changes. For most
-datasets - esp. `process` and `socket` - a shorter period is recommended.
+This module also supports the
+<<module-standard-options-{modulename},standard configuration options>>
+described later.
 
 *`state.period`*:: The frequency at which the datasets send full state information.
 This option can be overridden per dataset using `{dataset}.state.period`.
@@ -85,8 +87,7 @@ the `beat.db` file to detect changes between Auditbeat restarts. The `beat.db` f
 should be readable only by the root user and be treated similar to the shadow file
 itself.
 
-*`keep_null`*:: If this option is set to true, fields with `null` values will be
-published in the output document. By default, `keep_null` is set to `false`.
+include::{docdir}/auditbeat-options.asciidoc[]
 
 [float]
 === Suggested configuration
@@ -151,6 +152,9 @@ auditbeat.modules:
   login.btmp_file_pattern: /var/log/btmp*
 ----
 
+
+:modulename!:
+
 [float]
 === Datasets
 

x-pack/auditbeat/module/system/_meta/docs.asciidoc

@@ -1,5 +1,4 @@
 [role="xpack"]
-
 == System Module
 
 beta[]
@@ -67,8 +66,9 @@ sample suggested configuration.
   user.detect_password_changes: true
 ----
 
-*`period`*:: The frequency at which the datasets check for changes. For most
-datasets - esp. `process` and `socket` - a shorter period is recommended.
+This module also supports the
+<<module-standard-options-{modulename},standard configuration options>>
+described later.
 
 *`state.period`*:: The frequency at which the datasets send full state information.
 This option can be overridden per dataset using `{dataset}.state.period`.
@@ -80,8 +80,7 @@ the `beat.db` file to detect changes between Auditbeat restarts. The `beat.db` f
 should be readable only by the root user and be treated similar to the shadow file
 itself.
 
-*`keep_null`*:: If this option is set to true, fields with `null` values will be
-published in the output document. By default, `keep_null` is set to `false`.
+include::{docdir}/auditbeat-options.asciidoc[]
 
 [float]
 === Suggested configuration