docs
Everything deeper than the README. Start at architecture.md if you are new to the service, and at compat.md if you are working a source towards parity.
| Page | What it is for |
|---|---|
| architecture.md | The code map: system context, the crate graph, what the service binary does, and what an Event is on the way through |
| configuration.md | Where the values come from, which env spelling reaches a --config file, the bus/direct transport selector, and the sections the file cannot carry |
| parity.md | What the service promises against Elastic's own output, what it leaves alone, and how the claim is measured |
| parsers.md | The three parser layers over grok and regex, every ingest processor the transforms use, and how far the Painless matchers reach |
| enrichment.md | GeoIP, user agent and community ID -- the three runtime enrichers and the cache in front of the MMDB |
| performance.md | SIMD, zero-copy, buffer reuse, the release profile, the native parser targets, and the key dependencies |
| testing.md | The three test tracks, the match modes, and the non-English sweep |
| compat.md | How to run scripts/compat.py: prerequisites, commands, working a source, older stacks, and the licence position on the corpus |
| compat-policy.md | What counts as a difference: the ratchet, the compare-policy.yaml sections, and the divergences kept on purpose |
| schema-generation.md | Publishing the Elastic-side field knowledge to dfe-schemas as ClickHouse schemas |
| shared-crates.md | What dfe-transform-splack took a copy of, and what it would take to extract the common half |
Everything else in this directory is generated by
dfe-transform-elastic generate-artefacts -- metrics-manifest.json,
deployment-contract.json, container-manifest.json, Dockerfile.runtime,
config-schema.{json,yaml} and capability-catalog.{json,yaml}. Do not
hand-edit them; re-run the command.