Updated ebpf input plugin doc with new config options and cleanup. Fixes #2239.

[eschabell]

Updated ebpf input plugin doc with new config options and cleanup. Fixes #2239.

Summary by CodeRabbit

• Documentation
  • Added a comprehensive "Configuration parameters" section listing available settings and defaults
  • Added an "Output fields" section describing common fields and trace-specific fields
  • Updated configuration examples to show new parameters in both formats
  • Clarified how to enable and document multiple trace configurations

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Walkthrough

Documentation update for the eBPF input plugin: adds a "Configuration parameters" section (poll_ms, ringbuf_map_name, trace with defaults), updates the configuration examples (YAML and classic), and expands the "Output fields" section with common fields and per-trace details for trace_signal, trace_malloc, and trace_bind.

Changes

Cohort / File(s)	Change Summary
eBPF Plugin Documentation pipeline/inputs/ebpf.md	Added "Configuration parameters" documenting poll_ms, ringbuf_map_name, and trace (with defaults); updated YAML and classic config examples to include poll_ms; introduced comprehensive "Output fields" with common fields (event_type, pid, tid, comm) and per-trace fields for trace_signal, trace_malloc, and trace_bind.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

• Verify documented default values match implementation.
• Confirm example configurations are syntactically correct in both YAML and classic formats.
• Check per-trace output field names and descriptions align with actual emitted events.

Suggested reviewers

• esmerel
• alexakreizinger

Poem

🐰 I hopped through docs with nimble paws,
Poll_ms, ringbuf, and trace I saws,
Signals, malloc, binds in line,
Fields recorded, neat and fine,
Hop! The docs now shining cause 🌿📚

Pre-merge checks and finishing touches

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: updating eBPF input plugin documentation with new config options and cleanup, directly matching the file modification in the changeset.
Linked Issues check	✅ Passed	The changes add missing configuration options (poll_ms, ringbuf_map_name, trace) and output fields documentation to the eBPF input plugin, fulfilling the objective to update documentation with current plugin status.
Out of Scope Changes check	✅ Passed	All changes are focused on the eBPF input plugin documentation file, directly addressing the linked issue requirement for config options and documentation updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between e68ae1a and 4522e34.

📒 Files selected for processing (1)

• pipeline/inputs/ebpf.md (4 hunks)

🔇 Additional comments (3)

pipeline/inputs/ebpf.md (3)

11-19: Configuration parameters section looks solid.

The new parameters table is well-organized with clear descriptions and sensible defaults. The grammar fix from the previous review has been applied correctly on line 19. The three parameters (poll_ms, ringbuf_map_name, trace) are clearly documented.

---

88-88: Configuration examples properly updated with poll_ms parameter.

Both YAML and classic configuration formats now include the poll_ms parameter with a concrete value (500ms), making the examples more practical. The capitalization differs between formats (poll_ms in YAML and Poll_Ms in classic) as expected for Fluent Bit's format conventions.

Also applies to: 101-101

---

119-163: Output fields section is comprehensive and well-structured.

The new section provides clear documentation of both common fields (event_type, pid, tid, comm) and trace-specific fields for all three trace types (signal, malloc, bind). Field descriptions are practical and include concrete examples (e.g., memory operation type values: 0=malloc, 1=free, 2=calloc, 3=realloc). This significantly improves the documentation's usability.

Please verify that the documented field names and operation type values match the actual plugin output. For instance, confirm that:

• Memory operation codes (0=malloc, 1=free, 2=calloc, 3=realloc) are accurate
• Field names like bound_dev_if, error_raw, and others align with current plugin implementation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 99da2f0 and e68ae1a.

📒 Files selected for processing (1)

• pipeline/inputs/ebpf.md (4 hunks)

🧰 Additional context used

🪛 LanguageTool

pipeline/inputs/ebpf.md

[style] ~19-~19: To form a complete sentence, be sure to include a subject.
Context: ...bind, trace_malloc, trace_signal`). Can be set multiple times to enable multipl...

(MISSING_IT_THERE)

🔇 Additional comments (4)

pipeline/inputs/ebpf.md (4)

11-19: Well-structured configuration parameters documentation.

The new configuration parameters table is clearly organized and provides helpful defaults. The parameters are well-documented with concise, practical descriptions.

---

88-88: Configuration examples properly demonstrate new parameters.

Both YAML and classic text format examples now include the poll_ms parameter, providing clear guidance on configuration usage. The formatting is consistent with the documented parameter names and types.

Also applies to: 101-101

---

119-163: Comprehensive output fields documentation.

The new "Output fields" section is well-structured and provides excellent clarity on what data each trace type produces. The organization into common fields and trace-specific subsections (Signal, Memory, Bind) makes the documentation easy to navigate and reference. Field descriptions are concise and helpful.

---

11-19: Verify parameter defaults and names match plugin implementation.

To ensure the documentation stays accurate long-term, please verify that the documented parameter defaults (poll_ms: 1000, ringbuf_map_name: events) and parameter names match the actual plugin implementation. Consider checking against the plugin's source code or configuration schema.

Also applies to: 88-88, 101-101

[eschabell]

AI review passed, merging.