All cisco datasets enabled by default cause poor UX

[immon]

Describe the enhancement:

Disable cisco datasets by default or be more lenient about umbrella dataset misconfiguration.

Describe a specific use case for the enhancement or feature:

We're using CISCO module and use ASA and FTD datasets only. After enabling cisco module all datasets are enabled by default (including meraki, umbrella, nexus, ios). A lack of proper configuration for umbrella caused the following error:

2021-02-18T11:17:37.102Z ERROR instance/beat.go:956 Exiting: Error getting config for fileset cisco/umbrella: Error interpreting the template of the input: template: text:4:14: executing "text" at <.queue_url>: map has no entry for key "queue_url" 

Initially we failed to understand that the error complains about but it's complaining about umbrella dataset misconfiguration where dataset is enabled by default, its input defaults to s3, but queue url is not defined, as the whole section for umbrella is non-existent in our configuration.

We keep all configuration in single filebeat.yml file to simplify management over multiple places.

Steps to reproduce:

• configure cisco ftd in filebeat.yml as following:

$ cat >> filebeat.yml <<EOF
filebeat.modules:
- module: cisco
  ftd:
    enabled: true
    var.syslog_host: 0.0.0.0
    var.syslog_port: 9123
EOF

• filebeat fails with an error message stated above

Expected behaviour:

• Enable ftd dataset only. Don't complain about queue_url. Start successfully.

Possible solution:

• Disable all datasets by default. Be explicit. If one wants them enabled, they will toggle the setting.
• Be more lenient regarding other datasets misconfiguration. Implicit approach where different listening ports get opened for unused datasets etc.

Current workaround (for others who found that issue):

• you should explicitly set enabled: false for every dataset not used to get rid of the startup error.

Note, this issue may apply to all modules enabling multiple datasets by default.

[andresrc]

@urso @andrewkroh related: #17256

[elasticmachine]

Pinging @elastic/agent (Team:Agent)

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[andrewkroh]

This is being address by #27526 for 8.0.