[docs-patrol] Document winlog forwarded option for WEF setups

Open Beginner friendly
#18,631 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
82/100
Issue type
Documentation
Clarity
Clearly specified
Activity status
Quiet
Tech stack
handlebars
Domain
documentation

Research direction

Read the existing Configuration section in packages/winlog/_dev/build/docs/README.md and compare the forwarded policy description in packages/winlog/manifest.yml with the generated packages/winlog/docs/README.md. Add guidance covering WEF/forwarded events, defaults, omitted-option implications, and ForwardedEvents channel behavior, then regenerate and verify the generated README matches.

Written by the indexing model from the issue text.

Description

Recent code changes in the repository have introduced documentation drift. The following change needs a corresponding documentation update.

Changes Requiring Documentation Updates

1. New user-facing forwarded option in winlog is not documented

Commit(s): 37a57bf234d343172034733e0cc7435479bc8953

What changed:

  • packages/winlog/manifest.yml lines 55-66 now define a new visible policy option forwarded with guidance that it must be enabled for WEF/forwarded events to avoid degraded correlation behavior.
  • packages/winlog/agent/input/winlog.yml.hbs lines 5-7 now render forwarded: true when the option is set.

Documentation impact:

  • packages/winlog/_dev/build/docs/README.md and generated packages/winlog/docs/README.md currently have no configuration guidance for the new forwarded setting (the Configuration section only documents the Event ID clause limit).
  • Add a configuration subsection for forwarded explaining when to enable it (WEF/forwarded events), implications if omitted, and that ForwardedEvents channel behavior is forced.

Suggested Actions

  • Update packages/winlog/_dev/build/docs/README.md with a forwarded configuration section (purpose, defaults, and WEF-specific guidance).
  • Regenerate and verify packages/winlog/docs/README.md includes the new guidance.
  • Confirm wording aligns with the policy description in manifest.yml so users configuring forwarded events do not end up in degraded state.

[!NOTE]

🔒 Integrity filter blocked 3 items

The following items were blocked because they don't meet the GitHub integrity level.

  • #4564 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
  • #13075 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
  • #784 search_issues: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

What is this? | From workflow: Docs Patrol

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

  • expires on May 1, 2026, 10:38 AM UTC
Dominant language
Handlebars
Stars
334
Forks
652
Avg merge
1d 22h
Merged PRs (30d)
241

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from elastic/integrations

All issues in elastic/integrations

Similar issues

More Documentation issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.