Filebeat: Make all filesets disabled in default configuration

[adriansr]

What does this PR do?

Changes the default configuration for Filebeat's filesets to make them disabled by default (enabled: false).

Adds a check to the config and update targets of mage to check that default configurations have an explicit disable:

Error: 1 error: in file 'modules.d/checkpoint.yml.disabled': checkpoint module dataset firewall must be explicitly disabled (needs enabled: false)

Why is it important?

The previous default of having all filesets enabled, paired with the configuration loader enabling all non-explicitly-disabled filesets (changed in #27526) has been causing trouble for our users for quite some time.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• [ ] I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

• Update docs

Updated docs

Shared modules configuration snippet:

---

Filebeat getting started guide:

Related issues

• Closes [Filebeat][proposal] Disable filesets that are not configured #17256

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2021-09-15T09:27:57.186+0000

• Duration: 147 min 45 sec

• Commit: 9240081

Test stats 🧪

Test	Results
Failed	0
Passed	54032
Skipped	5324
Total	59356

Trends 🧪

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	54032
Skipped	5324
Total	59356

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[dedemorton]

Sounds like users will need to enable the module and always edit the config to turn on the filesets they want to use. I understand why we are doing this, but it sounds like the getting started workflow will be much less streamlined.

For doc changes (in addition to what you've already done), we'll need to:

• Update the Kibana in-product instructions on the Add Data pages and make it clear that users need to enable filesets explicitly.
• Update the shared file here and make it clear that users need to enable filesets explicitly.
• Add info about this change to the breaking changes documentation for 8.0.0.
• Update any tutorials in the observability guide that show module configs.
• Update the stack getting started.
• Check the cloud and logstash docs, too, because I think they might have steps for using Filebeat modules.

I can create an issue in the observability-docs repo to track this work, if you'd like.

[adriansr]

@dedemorton

I can create an issue in the observability-docs repo to track this work, if you'd like.

Yes, please.

I've updated in this PR the docs that are included in the Beats repo, can you have look?

[dedemorton]

LGTM

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b disable_filesets_by_default upstream/disable_filesets_by_default
git merge upstream/master
git push upstream disable_filesets_by_default