pipeline: inputs: add AegisBPF input plugin

[ErenAri]

Documents the aegisbpf input plugin proposed in fluent/fluent-bit#12272.

Adds pipeline/inputs/aegisbpf.md (configuration parameters, prerequisites, CLI + YAML + classic config examples) and the nav entry in SUMMARY.md.

The plugin streams runtime-security events from a co-located AegisBPF BPF-LSM agent over its Unix control socket (GET /events → newline-delimited OCSF JSON) into the pipeline.

Companion to the code PR fluent/fluent-bit#12272 — happy to hold this until that merges, or adjust as the code is reviewed.

Summary by CodeRabbit

• Documentation
  • Added documentation for the AegisBPF input plugin, including supported events, configuration options, prerequisites, examples, reconnection behavior, and emitted records.
  • Added AegisBPF to the Data pipeline input plugin table of contents.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

📝 Walkthrough

Walkthrough

Added documentation for the AegisBPF input plugin and linked the page from the Data pipeline input table of contents.

Changes

AegisBPF documentation

Layer / File(s)	Summary
Document and index the AegisBPF input pipeline/inputs/aegisbpf.md, SUMMARY.md	Documents Unix-socket streaming, reconnection, configuration, prerequisites, examples, and emitted-record semantics. Adds the page to the Inputs section.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested labels: 5.0.9

Suggested reviewers: eschabell, patrick-stephens

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the addition of documentation for the AegisBPF input plugin.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

pipeline/inputs/aegisbpf.md (1)

38-58: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Use named configuration tabs for these examples.

Wrap the YAML and classic examples in tabs titled fluent-bit.yaml and fluent-bit.conf. This gives each example a filename and allows configuration validation to discover both examples.

Proposed change

-```yaml
+{% tabs %}
+{% tab title="fluent-bit.yaml" %}
 pipeline:
   inputs:
     - name: aegisbpf
       socket_path: /var/run/aegisbpf/aegisbpf.sock
   outputs:
     - name: stdout
       match: '*'
-```
+{% endtab %}

-```ini
+{% tab title="fluent-bit.conf" %}
 [INPUT]
     name         aegisbpf
     socket_path  /var/run/aegisbpf/aegisbpf.sock
@@
     name         stdout
     match        *
-```
+{% endtab %}
+{% endtabs %}

Based on learnings: scripts/test-config.sh only discovers tabs titled fluent-bit.yaml and fluent-bit.conf.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pipeline/inputs/aegisbpf.md` around lines 38 - 58, Wrap the YAML and classic
configuration examples in the documentation with named tabs using the exact
titles “fluent-bit.yaml” and “fluent-bit.conf”. Preserve each example’s existing
content and remove the individual code fences as needed so the tab structure is
valid and discoverable by scripts/test-config.sh.

Source: Learnings

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@pipeline/inputs/aegisbpf.md`:
- Around line 38-58: Wrap the YAML and classic configuration examples in the
documentation with named tabs using the exact titles “fluent-bit.yaml” and
“fluent-bit.conf”. Preserve each example’s existing content and remove the
individual code fences as needed so the tab structure is valid and discoverable
by scripts/test-config.sh.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d58270a8-17fd-4925-9635-9eb37c0c7835

📥 Commits

Reviewing files that changed from the base of the PR and between 21a0519 and 78f07a5.

📒 Files selected for processing (2)

• SUMMARY.md
• pipeline/inputs/aegisbpf.md

[ErenAri]

@eschabell hi can you look at it