# GitHub CODEOWNERS definition
# See: https://help.github.com/articles/about-codeowners/

# The beats repository is owned by the @elastic/elastic-agent-data-plane team. Many teams contribute to this repository.
# The goal is to cover all directories in the CODEOWNERS file which are owned by the different teams.
# The list is sorted alphabetically by directory and sub directories.

* @elastic/elastic-agent-data-plane

# List the CHANGELOG files without an owner. This will prevent the data plane team from being added
# as a reviewer every time a change to files they do not own also adds a changelog entry.
# https://github.community/t/codeowners-file-with-a-not-file-type-condition/1423/9
CHANGELOG*

# The tech leads of the teams working in Beats share ownership of the Go module dependencies and related files.
/.github/CODEOWNERS @elastic/beats-tech-leads
/go.mod @elastic/beats-tech-leads
/go.sum @elastic/beats-tech-leads
/NOTICE.txt @elastic/beats-tech-leads

/.ci/ @elastic/elastic-agent-data-plane @elastic/ingest-eng-prod
/.github/ @elastic/elastic-agent-data-plane
/auditbeat/ @elastic/sec-linux-platform
/deploy/ @elastic/elastic-agent-data-plane
/deploy/kubernetes @elastic/elastic-agent-data-plane @elastic/obs-cloudnative-monitoring
/dev-tools/ @elastic/elastic-agent-data-plane
/dev-tools/kubernetes @elastic/obs-ds-hosted-services
/docs/ @elastic/elastic-agent-data-plane
/filebeat @elastic/elastic-agent-data-plane
/filebeat/docs/ # Listed without an owner to avoid maintaining doc ownership for each input and module.
/filebeat/input/syslog/ @elastic/sec-deployment-and-devices
/filebeat/input/winlog/ @elastic/sec-windows-platform
/filebeat/module/apache @elastic/obs-infraobs-integrations
/filebeat/module/auditd @elastic/sec-linux-platform
/filebeat/module/elasticsearch/ @elastic/stack-monitoring
/filebeat/module/haproxy @elastic/obs-infraobs-integrations
/filebeat/module/icinga # TODO: find right team
/filebeat/module/iis @elastic/obs-infraobs-integrations
/filebeat/module/kafka @elastic/obs-infraobs-integrations
/filebeat/module/kibana/ @elastic/stack-monitoring
/filebeat/module/logstash/ @elastic/stack-monitoring
/filebeat/module/mongodb @elastic/obs-infraobs-integrations
/filebeat/module/mysql @elastic/obs-infraobs-integrations
/filebeat/module/nats @elastic/obs-infraobs-integrations
/filebeat/module/nginx @elastic/obs-infraobs-integrations
/filebeat/module/osquery @elastic/sec-deployment-and-devices
/filebeat/module/pensando @elastic/sec-deployment-and-devices
/filebeat/module/postgresql @elastic/obs-infraobs-integrations
/filebeat/module/redis @elastic/obs-infraobs-integrations
/filebeat/module/santa @elastic/security-service-integrations
/filebeat/module/system @elastic/elastic-agent-data-plane
/filebeat/module/traefik # TODO: find right team
/heartbeat/ @elastic/obs-ds-hosted-services
/journalbeat @elastic/elastic-agent-data-plane
/libbeat/ @elastic/elastic-agent-data-plane
/libbeat/docs/processors-list.asciidoc @elastic/ingest-docs
/libbeat/management @elastic/elastic-agent-control-plane
/libbeat/processors/cache/ @elastic/security-service-integrations
/libbeat/processors/community_id/ @elastic/sec-deployment-and-devices
/libbeat/processors/decode_xml/ @elastic/security-service-integrations
/libbeat/processors/decode_xml_wineventlog/ @elastic/sec-windows-platform
/libbeat/processors/dns/ @elastic/sec-deployment-and-devices
/libbeat/processors/registered_domain/ @elastic/sec-deployment-and-devices
/libbeat/processors/translate_sid/ @elastic/sec-windows-platform
/libbeat/processors/add_cloud_metadata @elastic/obs-cloud-monitoring
/libbeat/processors/add_kubernetes_metadata @elastic/obs-cloudnative-monitoring
/licenses/ @elastic/elastic-agent-data-plane
/metricbeat/ @elastic/elastic-agent-data-plane
/metricbeat/docs/ # Listed without an owner to avoid maintaining doc ownership for each input and module.
/metricbeat/helper/kubernetes @elastic/obs-cloudnative-monitoring
/metricbeat/module/apache @elastic/obs-infraobs-integrations
/metricbeat/module/beat/ @elastic/stack-monitoring
/metricbeat/module/ceph @elastic/obs-infraobs-integrations
/metricbeat/module/couchbase @elastic/obs-infraobs-integrations
/metricbeat/module/couchdb @elastic/obs-infraobs-integrations
/metricbeat/module/elasticsearch/ @elastic/stack-monitoring
/metricbeat/module/etcd @elastic/obs-infraobs-integrations
/metricbeat/module/golang @elastic/obs-infraobs-integrations
/metricbeat/module/haproxy @elastic/obs-infraobs-integrations
/metricbeat/module/http @elastic/obs-infraobs-integrations
/metricbeat/module/jolokia @elastic/obs-infraobs-integrations
/metricbeat/module/kafka @elastic/obs-infraobs-integrations
/metricbeat/module/kibana/ @elastic/stack-monitoring
/metricbeat/module/kubernetes/ @elastic/obs-cloudnative-monitoring
/metricbeat/module/logstash/ @elastic/stack-monitoring
/metricbeat/module/memcached @elastic/obs-infraobs-integrations
/metricbeat/module/mongodb @elastic/obs-infraobs-integrations
/metricbeat/module/mysql @elastic/obs-infraobs-integrations
/metricbeat/module/nats/ @elastic/obs-cloudnative-monitoring
/metricbeat/module/nginx @elastic/obs-infraobs-integrations
/metricbeat/module/php_fpm @elastic/obs-infraobs-integrations
/metricbeat/module/prometheus/ @elastic/obs-cloudnative-monitoring
/metricbeat/module/postgresql @elastic/obs-infraobs-integrations
/metricbeat/module/rabbitmq @elastic/obs-infraobs-integrations
/metricbeat/module/redis @elastic/obs-infraobs-integrations
/metricbeat/module/system/ @elastic/elastic-agent-data-plane
/metricbeat/module/vsphere @elastic/obs-infraobs-integrations
/metricbeat/module/zookeeper @elastic/obs-infraobs-integrations
/packetbeat/ @elastic/sec-linux-platform
/script/ @elastic/elastic-agent-data-plane
/testing/ @elastic/elastic-agent-data-plane
/tools/ @elastic/elastic-agent-data-plane
/winlogbeat/ @elastic/sec-windows-platform
/x-pack/auditbeat/ @elastic/sec-linux-platform
/x-pack/elastic-agent/ @elastic/elastic-agent-control-plane
/x-pack/filebeat @elastic/elastic-agent-data-plane
/x-pack/filebeat/docs/ # Listed without an owner to avoid maintaining doc ownership for each input and module.
/x-pack/filebeat/input/awscloudwatch/ @elastic/obs-cloud-monitoring
/x-pack/filebeat/input/awss3/ @elastic/obs-cloud-monitoring
/x-pack/filebeat/input/azureblobstorage/ @elastic/security-service-integrations
/x-pack/filebeat/input/azureeventhub/ @elastic/obs-cloud-monitoring
/x-pack/filebeat/input/cel/ @elastic/security-service-integrations
/x-pack/filebeat/input/cometd/ @elastic/obs-infraobs-integrations
/x-pack/filebeat/input/entityanalytics/ @elastic/security-service-integrations
/x-pack/filebeat/input/etw/ @elastic/sec-windows-platform
/x-pack/filebeat/input/gcppubsub/ @elastic/security-service-integrations
/x-pack/filebeat/input/gcs/ @elastic/security-service-integrations
/x-pack/filebeat/input/http_endpoint/ @elastic/security-service-integrations
/x-pack/filebeat/input/httpjson/ @elastic/security-service-integrations
/x-pack/filebeat/input/internal/httplog @elastic/security-service-integrations
/x-pack/filebeat/input/internal/httpmon @elastic/security-service-integrations
/x-pack/filebeat/input/lumberjack/ @elastic/security-service-integrations
/x-pack/filebeat/input/netflow/ @elastic/sec-deployment-and-devices
/x-pack/filebeat/input/o365audit/ @elastic/security-service-integrations
/x-pack/filebeat/input/websocket/ @elastic/security-service-integrations
/x-pack/filebeat/module/activemq @elastic/obs-infraobs-integrations
/x-pack/filebeat/module/aws @elastic/obs-cloud-monitoring
/x-pack/filebeat/module/awsfargate @elastic/obs-cloud-monitoring
/x-pack/filebeat/module/azure @elastic/obs-cloud-monitoring
/x-pack/filebeat/module/barracuda @elastic/security-service-integrations
/x-pack/filebeat/module/bluecoat @elastic/sec-deployment-and-devices
/x-pack/filebeat/module/cef @elastic/sec-deployment-and-devices
/x-pack/filebeat/module/checkpoint @elastic/sec-deployment-and-devices
/x-pack/filebeat/module/cisco @elastic/sec-deployment-and-devices
/x-pack/filebeat/module/coredns @elastic/sec-deployment-and-devices
/x-pack/filebeat/module/crowdstrike @elastic/security-service-integrations
/x-pack/filebeat/module/cyberarkpas @elastic/security-service-integrations
/x-pack/filebeat/module/cylance @elastic/security-service-integrations
/x-pack/filebeat/module/envoyproxy @elastic/sec-deployment-and-devices
/x-pack/filebeat/module/f5 @elastic/security-service-integrations
/x-pack/filebeat/module/fortinet @elastic/sec-deployment-and-devices
/x-pack/filebeat/module/gcp @elastic/security-service-integrations
/x-pack/filebeat/module/google_workspace @elastic/security-service-integrations
/x-pack/filebeat/module/ibmmq @elastic/obs-infraobs-integrations
/x-pack/filebeat/module/imperva @elastic/sec-deployment-and-devices
/x-pack/filebeat/module/infoblox @elastic/security-service-integrations
/x-pack/filebeat/module/iptables @elastic/sec-deployment-and-devices
/x-pack/filebeat/module/juniper @elastic/sec-deployment-and-devices
/x-pack/filebeat/module/microsoft @elastic/sec-windows-platform
/x-pack/filebeat/module/misp @elastic/security-service-integrations
/x-pack/filebeat/module/mssql @elastic/obs-infraobs-integrations
/x-pack/filebeat/module/mysqlenterprise @elastic/sec-windows-platform
/x-pack/filebeat/module/netflow @elastic/sec-deployment-and-devices
/x-pack/filebeat/module/netscout @elastic/sec-deployment-and-devices
/x-pack/filebeat/module/o365 @elastic/security-service-integrations
/x-pack/filebeat/module/okta @elastic/security-service-integrations
/x-pack/filebeat/module/oracle @elastic/obs-infraobs-integrations
/x-pack/filebeat/module/panw @elastic/sec-deployment-and-devices
/x-pack/filebeat/module/proofpoint @elastic/security-service-integrations
/x-pack/filebeat/module/rabbitmq @elastic/obs-infraobs-integrations
/x-pack/filebeat/module/radware @elastic/sec-deployment-and-devices
/x-pack/filebeat/module/salesforce @elastic/obs-infraobs-integrations
/x-pack/filebeat/module/snort @elastic/sec-deployment-and-devices
/x-pack/filebeat/module/snyk @elastic/security-service-integrations
/x-pack/filebeat/module/sonicwall @elastic/sec-deployment-and-devices
/x-pack/filebeat/module/sophos @elastic/sec-deployment-and-devices
/x-pack/filebeat/module/squid @elastic/sec-deployment-and-devices
/x-pack/filebeat/module/suricata @elastic/sec-deployment-and-devices
/x-pack/filebeat/module/threatintel @elastic/security-service-integrations
/x-pack/filebeat/module/tomcat @elastic/obs-infraobs-integrations
/x-pack/filebeat/module/zeek @elastic/sec-deployment-and-devices
/x-pack/filebeat/module/zookeeper @elastic/obs-infraobs-integrations
/x-pack/filebeat/module/zoom @elastic/security-service-integrations
/x-pack/filebeat/module/zscaler @elastic/security-service-integrations
/x-pack/filebeat/modules.d/zoom.yml.disabled @elastic/security-service-integrations
/x-pack/filebeat/processors/decode_cef/ @elastic/sec-deployment-and-devices
/x-pack/heartbeat/ @elastic/obs-ds-hosted-services
/x-pack/libbeat/reader/parquet/ @elastic/security-service-integrations
/x-pack/libbeat/reader/etw/ @elastic/sec-windows-platform
/x-pack/metricbeat/ @elastic/elastic-agent-data-plane
/x-pack/metricbeat/docs/ # Listed without an owner to avoid maintaining doc ownership for each input and module.
/x-pack/metricbeat/module/activemq @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/airflow @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/aws @elastic/obs-ds-hosted-services
/x-pack/metricbeat/module/awsfargate @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/azure @elastic/obs-ds-hosted-services
/x-pack/metricbeat/module/azure/billing @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/cloudfoundry @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/cockroachdb @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/containerd/ @elastic/obs-cloudnative-monitoring
/x-pack/metricbeat/module/coredns @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/enterprisesearch @elastic/ent-search-application-backend
/x-pack/metricbeat/module/gcp @elastic/obs-ds-hosted-services @elastic/obs-infraobs-integrations @elastic/security-service-integrations
/x-pack/metricbeat/module/gcp/billing @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/gcp/cloudrun_metrics @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/gcp/cloudsql_mysql @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/gcp/cloudsql_postgressql @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/gcp/cloudsql_sqlserver @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/gcp/carbon @elastic/obs-ds-hosted-services
/x-pack/metricbeat/module/gcp/compute @elastic/obs-ds-hosted-services
/x-pack/metricbeat/module/gcp/dataproc @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/gcp/dns @elastic/security-service-integrations
/x-pack/metricbeat/module/gcp/firestore @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/gcp/firewall @elastic/security-service-integrations
/x-pack/metricbeat/module/gcp/gke @elastic/obs-ds-hosted-services
/x-pack/metricbeat/module/gcp/loadbalancing_logs @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/gcp/loadbalancing_metrics @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/gcp/pubsub @elastic/obs-ds-hosted-services
/x-pack/metricbeat/module/gcp/redis @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/gcp/storage @elastic/obs-ds-hosted-services
/x-pack/metricbeat/module/gcp/vpcflow @elastic/security-service-integrations
/x-pack/metricbeat/module/ibmmq @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/iis @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/istio/ @elastic/obs-cloudnative-monitoring
/x-pack/metricbeat/module/mssql @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/oracle @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/prometheus/ @elastic/obs-cloudnative-monitoring
/x-pack/metricbeat/module/redisenterprise @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/sql @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/statsd @elastic/obs-infraobs-integrations
/x-pack/metricbeat/module/stan/ @elastic/obs-cloudnative-monitoring
/x-pack/metricbeat/module/tomcat @elastic/obs-infraobs-integrations
/x-pack/osquerybeat/ @elastic/sec-deployment-and-devices
/x-pack/packetbeat/ @elastic/sec-linux-platform
/x-pack/winlogbeat/ @elastic/sec-windows-platform

# Ownership of CI or related files by the Ingest Eng Prod team
/.buildkite @elastic/ingest-eng-prod
/catalog-info.yaml @elastic/ingest-eng-prod
/libbeat/scripts @elastic/ingest-eng-prod
/metricbeat/tests @elastic/ingest-eng-prod