docs: inputs: ebpf: document trace_vfs trace type

[eschabell]

• Update trace parameter description to list trace_vfs as an example
• Update common event_type field to include vfs as a valid value
• Add "VFS trace fields" section documenting operation, path, flags, mode, fd, and error_raw fields

Fixes #2533

Summary by CodeRabbit

• Documentation
  • Added support documentation for trace_vfs eBPF trace type
  • Updated configuration examples to include the new trace type
  • Documented output fields and event type for VFS trace operations

[coderabbitai]

📝 Walkthrough

Walkthrough

Documentation update for the eBPF input plugin adding support for the trace_vfs trace type, including the corresponding vfs event type and output fields (operation, path, flags, mode, fd, error_raw).

Changes

Cohort / File(s)	Summary
eBPF Plugin Documentation pipeline/inputs/ebpf.md	Added trace_vfs to trace configuration examples, expanded event_type values to include vfs, and documented new output fields emitted by the trace_vfs trace.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Possibly related PRs

• Updated ebpf input plugin doc with new config options and cleanup. Fixes #2239. #2240: Modifies eBPF input plugin documentation's trace and output-fields sections.

Suggested reviewers

• patrick-stephens

Poem

🐰 A trace of vfs now blooms so clear,
With fields of paths for all to hear,
Operation, flags, and modes galore,
The rabbit docs shine evermore! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: documenting the trace_vfs trace type in the eBPF input plugin documentation.
Linked Issues check	✅ Passed	The PR fulfills the linked issue #2533 requirement to document new configuration parameters in the 5.0.2 release for the eBPF input plugin.
Out of Scope Changes check	✅ Passed	All changes are directly related to documenting the trace_vfs trace type and its associated fields, which is within the scope of the linked issue.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (2)

pipeline/inputs/ebpf.md (2)

169-169: Remove backticks from section header for consistency.

The section header uses backticks around VFS, which is inconsistent with other trace field section headers in this document (lines 138, 147, 157). Those headers use plain text without backticks.

📝 Proposed fix for consistent formatting

-### `VFS` trace fields
+### VFS trace fields

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pipeline/inputs/ebpf.md` at line 169, Header formatting is inconsistent:
remove the inline code backticks around the header titled `VFS` so it matches
other trace field headers; change the markdown heading from "### `VFS` trace
fields" to a plain text heading "### VFS trace fields" (update the "VFS" header
occurrence in the ebpf.md file).

---

175-175: Provide enumerated VFS operation type values in the description.

The operation field description only states "(integer)" without explaining the values. The Memory trace fields section (line 153) documents operation values explicitly (0 = malloc, 1 = free, 2 = calloc, 3 = realloc), which is significantly clearer. Consider documenting VFS operation type values similarly for consistency and usability.

Additionally, the field uses backticks around `VFS` but the Memory section uses no backticks around "Memory" — standardize the formatting.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@pipeline/inputs/ebpf.md` at line 175, The `operation` field description is
incomplete—add an explicit enumeration of integer values and their meanings
(e.g., map each integer to VFS ops like read, write, open, etc.) following the
same style used in the "Memory trace fields" section (which lists `0` =
`malloc`, `1` = `free`, etc.), and standardize inline formatting (remove or add
backticks consistently across sections so "VFS" matches how "Memory" is
presented); update the `operation` line to include the mapped values and adjust
surrounding text for consistent formatting.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@pipeline/inputs/ebpf.md`:
- Line 169: Header formatting is inconsistent: remove the inline code backticks
around the header titled `VFS` so it matches other trace field headers; change
the markdown heading from "### `VFS` trace fields" to a plain text heading "###
VFS trace fields" (update the "VFS" header occurrence in the ebpf.md file).
- Line 175: The `operation` field description is incomplete—add an explicit
enumeration of integer values and their meanings (e.g., map each integer to VFS
ops like read, write, open, etc.) following the same style used in the "Memory
trace fields" section (which lists `0` = `malloc`, `1` = `free`, etc.), and
standardize inline formatting (remove or add backticks consistently across
sections so "VFS" matches how "Memory" is presented); update the `operation`
line to include the mapped values and adjust surrounding text for consistent
formatting.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 71c773d8-8841-4caa-97ce-b4eaf3e7d383

📥 Commits

Reviewing files that changed from the base of the PR and between 8927998 and cc6ff59.

📒 Files selected for processing (1)

• pipeline/inputs/ebpf.md

[eschabell]

@patrick-stephens ready for review!