add unix input custom integration

[leehinman]

Proposed commit message

Add custom unix input integration. This is similar to the tcp and udp custom integrations.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

1. Install stack and integration
2. Use socat - UNIX-CONNECT:/path/to/socket <line_delimanated_logs.txt
3. Verify events end up in correct data_stream

Related issues

• Closes [New Integration] Unix Socket Input #16945

Screenshots

[infra-vault-gh-plugin-prod]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[github-actions]

✅ Vale Linting Results

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[leehinman]

Waiting on elastic/stream#201 so we can have a system test.

[github-actions]

TL;DR

Buildkite failed in Check integrations unix because the Unix package docs are internally inconsistent, so the generated README differs from the checked docs and the README freshness lint fails. Align the socket-path example text between the two README sources and rerun package build/lint.

Remediation

• Update one side so these lines match exactly:
  • packages/unix/docs/README.md:65 currently uses /tmp/elastic-agent.sock
  • packages/unix/_dev/build/docs/README.md:65 currently uses /tmp/example.sock
• Regenerate package docs (elastic-package build) and rerun the unix package check.

Investigation details

Root Cause

This is a configuration/documentation sync issue (not an infra failure). The unix package README consistency check failed because the docs source files diverged on the Socket Path example value.

Evidence

• Build: https://buildkite.com/elastic/integrations/builds/42963
• Job/step: Check integrations unix → .buildkite/scripts/test_one_package.sh packages/unix origin/main 1b3da995dffee2afffaa7c15dfc5581ecdd5b78c
• Key log excerpt:

README.md is outdated. Rebuild the package with 'elastic-package build'
--- want
+++ got
@@ -64,3 +64,3 @@
-    - **Socket Path**: ... (e.g. `/tmp/elastic-agent.sock`).
+    - **Socket Path**: ... (e.g. `/tmp/example.sock`).
Error: checking package failed: checking readme files are up-to-date failed: files do not match

• File evidence at failing commit (1b3da995dffee2afffaa7c15dfc5581ecdd5b78c):
  • packages/unix/docs/README.md:65 → /tmp/elastic-agent.sock
  • packages/unix/_dev/build/docs/README.md:65 → /tmp/example.sock

Verification

• Not run in this environment (read-only detective workflow); analysis based on Buildkite log + repository content at the failing commit.

Follow-up

After syncing the docs and regenerating, this check should clear unless there are additional README drift changes in the same package.

Note

🔒 Integrity filter blocked 2 items

The following items were blocked because they don't meet the GitHub integrity level.

• #18944 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• add unix input custom integration #18944 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[elastic-vault-github-plugin-prod]

✅ All changelog entries have the correct PR link.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 7d556c2

History

• 💚 Build #43025 succeeded e539c9b
• 💚 Build #42964 succeeded ee70194
• 💔 Build #42963 failed 1b3da99
• 💚 Build #42885 succeeded 6bb96b4
• 💔 Build #42875 failed 79e219f
• 💔 Build #42874 failed b535b9f

[leehinman]

@efd6 any chance you can take a look?