[DRAFT] Add docs for Serverless log delivery - #8081
Conversation
Elastic Docs AI PR menuCheck the box to run an AI review for this pull request.
Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team. |
Elastic Docs Style Checker (Vale)Summary: 3 suggestions found 💡 Suggestions (3): Optional style improvements. Apply when helpful.
The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
consulthys
left a comment
consulthys
left a comment
There was a problem hiding this comment.
Looks great! I've added a few comments below
| @@ -0,0 +1,51 @@ | |||
| --- | |||
| navigation_title: Log delivery | |||
There was a problem hiding this comment.
Could this be "Serverless log delivery" so we make sure that stands out in the navigation? Also why don't we put this under the "Logging" section above it?
Unrelated note: Somewhere in Logging we should also have the new Kibana user activity logs
There was a problem hiding this comment.
Sure, updated title.
I kept the section separate because:
- Logging section applies to stack, not serverless. I thought serverless log delivery would get buried in so many stack-only pages
- Logging is mostly about how to configure logs, not how to deliver them. The difference in objective might be confusing
- When we release delivery for query logs, it might interfere with this Query logging in Elasticsearch page, which specifically says it's unavailable for serverless (side note: will this change? will it be available for serverless now?)
What do you think? I'm happy to discuss this more and move the section if it makes sense. (small note for moving it though: the link we provided for the UI targets the separate Log delivery section. If we move this section under Logging, the UI link would have to change.)
Let me see who worked on the user activity logs docs
There was a problem hiding this comment.
Thanks for the follow up!
- The first point is fair, but I'd still love that we find a good way to arrange all these pages since... they are all about "logging".
- I feel that "configure" and "deliver" are very synonymous, it's just that in Serverless there's less to configure and you can all do it via the UI. Also, this is akin to ECH "Logs and Metrics", which should also somehow be here, but it is under Stack Monitoring.
- Query logs will be available for Serverless very soon after GA, as well as Kibana user activity logs
Some more feedback:
- The Logging section contains individual pages for different ES-related logs but a single section for Kibana logs. Why not also grouping the ES logging pages together?
- Security event audit logging in Security (for self-managed, ECH and ECE) and "Audit trail" here (Serverless only) are also related somehow
I don't want to propose a new hierarchy as I know it is tricky to get this right :-)
| 3. For **Audit trail**, complete the following fields. | ||
| * In the **Destination** column, select one or more {{sec-serverless}} or {{obs-serverless}} projects to receive the logs. | ||
| :::{tip} | ||
| We recommend selecting an {{sec-serverless}} project as the destination for your audit trail. |
There was a problem hiding this comment.
@consulthys can we provide a reason for this?
There was a problem hiding this comment.
For two reasons:
- audit logs are security logs, not observability ones (but can still be searched from O11Y via CPS if needed)
- who best than our very own Security solution to provide a curated UI + alerts on top of our very own audit logs ;-)
| * Ignore filters exclude events *before* delivery. Use them to reduce the volume of delivered data. | ||
| * Retention of delivered data is billed on the destination project. Use [AutoOps](/deploy-manage/monitor/autoops/autoops-for-serverless.md) on this project to monitor your ingest rate and storage retained, and adjust accordingly. | ||
|
|
||
| For exact rates, refer to [{{sec-serverless}} pricing](https://www.elastic.co/pricing/serverless-security) and [{{obs-serverless}} pricing](https://www.elastic.co/pricing/serverless-observability). |
There was a problem hiding this comment.
@consulthys should I add the elasticsearch link here as well? Since a source project can be elasticsearch
There was a problem hiding this comment.
Currently only the destination project incurs charges (i.e. Ingest and storage).
We're still figuring out if the data flowing out of the source project should also be billed or not (leaning towards no for now). And if ever, we might decide to bill that dimension to the destination project (similar to what is done for CPS)
2 participants
Summary
Closes https://github.com/elastic/docs-content-internal/issues/1134
Generative AI disclosure