Disable host.* fields by default for netflow module (elastic#19087)

For the netflow module when data is forwarded to Filebeat from another host/device you don't want Filebeat to add `host`. So by default this modules add a `forwarded` tag to events. If you configure the module to not include the `forwarded` tag (e.g. `var.tags: [my_tag]`) then Filebeat will add the `host.*` fields.

Relates: elastic#13920

CHANGELOG.next.asciidoc

@@ -41,6 +41,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 * Cisco {pull}18753[18753]
 * iptables {pull}18756[18756]
 * Checkpoint {pull}18754[18754]
+* Netflow {pull}19087[19087]
 - Preserve case of http.request.method.  ECS prior to 1.6 specified normalizing to lowercase, which lost information. Affects filesets: apache/access, elasticsearch/audit, iis/access, iis/error, nginx/access, nginx/ingress_controller, aws/elb, suricata/eve, zeek/http. {issue}18154[18154] {pull}18359[18359]
 - Adds check on `<no value>` config option value for the azure input `resource_manager_endpoint`. {pull}18890[18890]
 - Okta module now requires objects instead of JSON strings for the `http_headers`, `http_request_body`, `pagination`, `rate_limit`, and `ssl` variables. {pull}18953[18953]

filebeat/docs/modules/netflow.asciidoc

@@ -72,6 +72,12 @@ details.
 monitor sequence numbers in the Netflow packets to detect an Exporting Process
 reset. See <<filebeat-input-netflow,netflow input>> for details.
 
+*`var.tags`*::
+
+A list of tags to include in events. Including `forwarded` indicates that the
+events did not originate on this host and causes `host.name` to not be added to
+events. Defaults to `[forwarded]`.
+
 :has-dashboards!:
 
 :fileset_ex!:

x-pack/filebeat/module/netflow/_meta/docs.asciidoc

@@ -67,6 +67,12 @@ details.
 monitor sequence numbers in the Netflow packets to detect an Exporting Process
 reset. See <<filebeat-input-netflow,netflow input>> for details.
 
+*`var.tags`*::
+
+A list of tags to include in events. Including `forwarded` indicates that the
+events did not originate on this host and causes `host.name` to not be added to
+events. Defaults to `[forwarded]`.
+
 :has-dashboards!:
 
 :fileset_ex!:

x-pack/filebeat/module/netflow/log/config/netflow.yml

@@ -24,6 +24,9 @@ custom_definitions:
 detect_sequence_reset: {{.detect_sequence_reset}}
 {{end}}
 
+tags: {{.tags | tojson}}
+publisher_pipeline.disable_host: {{ inList .tags "forwarded" }}
+
 processors:
   - add_fields:
       target: ''

x-pack/filebeat/module/netflow/log/manifest.yml

@@ -15,6 +15,8 @@ var:
   - name: timeout
   - name: custom_definitions
   - name: detect_sequence_reset
+  - name: tags
+    default: [forwarded]
 ingest_pipeline: ingest/pipeline.yml
 input: config/netflow.yml