feat(gamepulse): add GamePulse gaming telemetry integration

[MathewRJ]

What does this PR do?

Adds the GamePulse integration — a gaming performance telemetry agent that collects CPU, GPU, memory, frame timing, storage, network, audio, power, session lifecycle, discrete events, and kernel-level eBPF scheduler/I/O/GPU fence metrics, shipping them directly to Elasticsearch via Fleet.

Why is it important?

Gaming is one of the largest consumer workloads on Linux (Steam Deck, desktop gaming rigs) and Windows, yet there is no existing Elastic integration for gaming performance telemetry. GamePulse fills that gap, providing frame-time analysis, stutter detection, and hardware bottleneck identification in Kibana.

Checklist

• I have reviewed tips for building integrations and my integration follows the best practices.
• Unit tests were added for the ingest pipeline (all 11 data streams have pipeline tests; 24/24 pass).
• An ingest pipeline is defined for every data stream that requires data transformation.
• Fields follow ECS where applicable (event.*, host.*, service.*, ecs.version).
• All fields are documented in fields/fields.yml and fields/base-fields.yml.
• elastic-package check passes.
• elastic-package test pipeline passes (all 24 test cases).
• Screenshots — placeholder img/screenshots/.gitkeep is present; real screenshots will be added before merge if reviewers request them (dashboards are live on Elastic Cloud and can be captured).

Checklist for the reviewer

• Does the integration follow the package spec?
• Are the ingest pipelines correct and efficient?
• Are the ECS mappings appropriate?
• Are the dashboards useful and well-designed?

Data streams

Data stream	Type	Description
gamepulse.cpu	metrics	Per-core and aggregate CPU utilization, frequency, temperature, scheduler stats
gamepulse.gpu	metrics	GPU utilization, VRAM, temperature, power, clock speed
gamepulse.memory	metrics	RAM/swap usage, page faults, memory pressure
gamepulse.frame	metrics	Per-frame FPS, frame time, 1%/0.1% lows, stutter classification
gamepulse.session	metrics	Session lifecycle: start, end, duration, game name, launcher
gamepulse.storage	metrics	Read/write throughput, IOPS, latency
gamepulse.network	metrics	Network throughput, packet loss, latency
gamepulse.audio	metrics	Audio buffer underruns, latency
gamepulse.power	metrics	System and component power draw
gamepulse.events	logs	Discrete events: shader compile, VRR toggle, driver crash, process lifecycle
gamepulse.ebpf	metrics	Kernel-level eBPF scheduler migrations, I/O wait, GPU fence timing

Agent

The gamepulse-agent binary is distributed separately at https://github.com/MathewRJ/GamePulse. It supports Linux (Arch/AUR, Debian/Ubuntu deb, Fedora rpm) and Windows (winget).

[github-actions]

✅ Vale Linting Results

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

TL;DR

The Buildkite failure is a static test failure in the gamepulse.events data stream, not an infra issue. event.category and event.type in sample_event.json are strings, but ECS normalization expects arrays.

Remediation

• Update packages/gamepulse/data_stream/events/sample_event.json so:
  • event.category is [ "process" ]
  • event.type is [ "info" ]
• Re-run package checks/tests for gamepulse (at minimum static tests) to confirm the failure clears.

Investigation details

Root Cause

gamepulse.events static sample validation fails because ECS array fields are provided as scalars in the sample event.

• packages/gamepulse/data_stream/events/sample_event.json:13 currently has "category": "process"
• packages/gamepulse/data_stream/events/sample_event.json:14 currently has "type": "info"

These should be arrays for ECS-normalized event.category and event.type.

Evidence

• Build: https://buildkite.com/elastic/integrations/builds/42496
• Job/step: Check integrations gamepulse
• Key log excerpt (from generated static test report):

test case failed: one or more errors found in document:
[0] field "event.category" is not normalized as expected: expected array, found "process" (string)
[1] field "event.type" is not normalized as expected: expected array, found "info" (string)

Source: build/test-results/gamepulse-static-1778175957079476111.xml:11.

Verification

• Reproduced locally with elastic-package test static against this PR branch; static suite reports 1 failure in gamepulse.events with the same normalization error.

Follow-up

After fixing sample_event.json, if CI still fails in later stages, share the updated failing step/log and I can triage the next blocker.

Note

🔒 Integrity filter blocked 2 items

The following items were blocked because they don't meet the GitHub integrity level.

• feat(gamepulse): add GamePulse gaming telemetry integration #18878 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• #18878 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 648fa19

History

• 💚 Build #42504 succeeded 8b382f1
• 💔 Build #42499 failed d59cb76
• 💔 Build #42496 failed 688edbf
• 💔 Build #42495 failed c0e26d2

[lalit-satapathy]

@claude do a detailed initial review, as a new integration package to ensure all requirements are met.

[github-actions]

Thanks for the substantial integration work. I found one blocking TSDB modeling issue in ebpf_thread (inline): tid is marked as a dimension, which risks unbounded time-series cardinality. Please address that before merge.

---

What is this? | From workflow: Mention in PR

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[github-actions]

gamepulse.ebpf_thread.tid is currently marked as a TSDB dimension, but thread IDs are highly volatile and effectively unbounded over time. In a time_series data stream, that can create very high series cardinality and unnecessary index growth.

Please consider keeping tid as a regular field (remove dimension: true) and rely on more stable identifiers (for example host.name, session.id, and possibly comm) for dimensions.