docs: inputs: ebpf: document trace_exec

[eschabell]

• Add trace_exec to the Trace parameter example list.
• Add exec to the event_type enumeration in the Common fields table.
• Add a new Exec trace fields section documenting the fields produced by the exec trace.

Note this is a fix for code changes without corresponding docs PR

Summary by CodeRabbit

• Documentation
  • Enhanced eBPF plugin documentation with trace_exec configuration examples.
  • Added exec event type documentation.
  • Documented exec trace-specific fields including stage, process information, filename, and arguments.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 09aea1ff-0095-4a9d-b07a-6a26a615af7b

📥 Commits

Reviewing files that changed from the base of the PR and between bf3e17c and a249fdd.

📒 Files selected for processing (1)

• pipeline/inputs/ebpf.md

---

📝 Walkthrough

Walkthrough

The PR updates the eBPF input plugin documentation to cover the trace_exec trace type. Changes add trace_exec to the configuration example, include exec as a documented event_type value, and introduce a new section documenting the specialized output fields produced by trace_exec operations.

Changes

trace_exec feature documentation

Layer / File(s)	Summary
trace_exec configuration and fields documentation pipeline/inputs/ebpf.md	Trace configuration example updated to include trace_exec, event_type field documented to include exec value, and new "Exec trace fields" section added documenting trace_exec-specific output fields: stage, ppid, filename, argv/argv1/argv2/argv_last, argc, and error_raw.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Possibly related PRs

• fluent/fluent-bit-docs#2240: Modifies the same ebpf input plugin documentation to expand trace-related configuration and per-trace output fields.
• fluent/fluent-bit-docs#2534: Updates pipeline/inputs/ebpf.md to add trace-specific field sections (for trace_vfs), similar pattern to this PR's trace_exec documentation.

Suggested labels

5.0

Suggested reviewers

• patrick-stephens

Poem

🐰 A rabbit hops through docs so bright,
trace_exec now shines in the light!
Fields like argv, ppid, and stage,
Fill each careful documentation page. ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: documenting the trace_exec feature in the ebpf input plugin documentation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[eschabell]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[eschabell]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.