[Filebeat] Netflow input - disable event normalization

[andrewkroh]

Describe the enhancement:

Disable Beat event normalization for the input. Event normalization should not be needed for the input because it only uses basic types in its events. This will save CPU time for each event that is Publish()ed.

Example:

beats/x-pack/filebeat/input/awss3/input.go

Lines 158 to 166 in 4586146

	client, err := pipeline.ConnectWith(beat.ClientConfig{
	CloseRef: inputContext.Cancelation,
	EventListener: awscommon.NewEventACKHandler(),
	Processing: beat.ProcessingConfig{
	// This input only produces events with basic types so normalization
	// is not required.
	EventNormalization: boolPtr(false),
	},
	})

Describe a specific use case for the enhancement or feature:

This will marginally speed up the input's processing times (like 2%).

Related Issues

• Depends on [Filebeat] Netflow input - convert to input API v2 #37865

[pkoutsovasilis]

hi @andrewkroh, please correct me if I am wrong, but to achieve disabling the EventNormalization first the netflow input needs to be migrated to plugin.v2 implementation right?

[andrewkroh]

You're right. It does need to be using the v2 API. I forgot that we had inputs that haven't been migrated.

[pkoutsovasilis]

thx for acknowledging my understanding @andrewkroh . I think that this issue should come first before #37762 and #37761 to get this first as a plugin v2 and then work our way through these

[andrewkroh]

I created a separate issue for the conversion. #37865

[pkoutsovasilis]

because of this issue event normalization has been re-enabled here for netflow. Thus, I am reopening this issue, to disable event normalization without any regressions 🙂