Disable host.* fields by default for Checkpoint module

CHANGELOG.next.asciidoc

@@ -33,6 +33,7 @@ happened. {issue}13920[13920] {pull}18223[18223]
 - With the default configuration the cef and panw modules will no longer send the `host`
 field. You can revert this change by configuring tags for the module and omitting
 `forwarded` from the list. {issue}13920[13920] {pull}18223[18223]
+* Checkpoint {pull}18754[18754]
 
 *Heartbeat*
 

filebeat/docs/modules/checkpoint.asciidoc

@@ -62,6 +62,12 @@ Set to 0.0.0.0 to bind to all available interfaces.
 
 The UDP port to listen for syslog traffic. Defaults to 9001.
 
+*`var.tags`*::
+
+A list of tags to include in events. Including `forwarded` indicates that the
+events did not originate on this host and causes `host.name` to not be added to
+events. Defaults to `[checkpoint-firewall, forwarded]`.
+
 [float]
 ==== Check Point devices
 
@@ -166,6 +172,7 @@ Check Point Syslog extensions are mapped as follows to ECS:
 
 :modulename!:
 
+
 [float]
 === Fields
 

x-pack/filebeat/module/checkpoint/_meta/docs.asciidoc

@@ -57,6 +57,12 @@ Set to 0.0.0.0 to bind to all available interfaces.
 
 The UDP port to listen for syslog traffic. Defaults to 9001.
 
+*`var.tags`*::
+
+A list of tags to include in events. Including `forwarded` indicates that the
+events did not originate on this host and causes `host.name` to not be added to
+events. Defaults to `[checkpoint-firewall, forwarded]`.
+
 [float]
 ==== Check Point devices
 
@@ -159,4 +165,4 @@ Check Point Syslog extensions are mapped as follows to ECS:
 | xlatedport                 | destination.nat.port           |
 |==============================================================
 
-:modulename!:
+:modulename!:

x-pack/filebeat/module/checkpoint/firewall/config/firewall.yml

@@ -15,7 +15,8 @@ exclude_files: [".gz$"]
 
 {{ end }}
 
-tags: {{.tags}}
+tags: {{.tags | tojson}}
+publisher_pipeline.disable_host: {{ inList .tags "forwarded" }}
 
 processors:
   - add_locale: ~

x-pack/filebeat/module/checkpoint/firewall/manifest.yml

@@ -4,12 +4,12 @@ var:
   - name: syslog_host
     default: localhost
   - name: tags
-    default: [checkpoint-firewall]
+    default: [checkpoint-firewall, forwarded]
   - name: syslog_port
     default: 9001
   - name: input
     default: syslog
 
-ingest_pipeline: 
+ingest_pipeline:
   - ingest/pipeline.json
 input: config/firewall.yml