Tags: elastic/beats
Tags
libbeat/common: stabilize TestRound assertions (#50872) (#50879) Use table-driven subtests and assert.InDelta in TestRound to avoid exact float equality comparisons on midpoint rounding cases that can vary by tiny representation differences across platforms. Assisted-By: GitHub Copilot CLI (cherry picked from commit 0291d3b) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
[9.3](backport #50644) Update go to 1.26.3 (#50842) * Fix go vet errors and remove unnecessary code * [libbeat] Update TestGetUrl so all tested URLs are valid * Revert #50686 now that only Go 1.26 is supported (cherry picked from commit 51e7321) # Conflicts: # libbeat/docs/version.asciidoc Assisted-By: Cursor, Model: Composer --------- Co-authored-by: Tiago Queiroz <tiago.queiroz@elastic.co>
[8.19](backport #50609) libbeat: update ebpfevents to 0.9.0 (#50639) * libbeat: update ebpfevents to 0.9.0 (#50609) Improvements to the loader so it uses considerably less memory and loads faster, only one change: elastic/ebpfevents#32 (cherry picked from commit 4d1f975) # Conflicts: # go.mod # go.sum * libbeat: resolve ebpfevents backport merge conflicts Keep the 8.19 elastic-agent dependency versions while updating ebpfevents to 0.9.0 so the backport no longer leaves conflict markers in go.mod and go.sum.\n\nAssisted-By: OpenAI Codex Co-authored-by: ebeahan <7226265+ebeahan@users.noreply.github.com> --------- Co-authored-by: Christiano Haesbaert <haesbaert@elastic.co> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: ebeahan <7226265+ebeahan@users.noreply.github.com>
fix(otel): fix beatprocessor to honor `when` conditions (#50555) (#50561 ) * otel(beatprocessor): honor conditions on inner Beat processors The beat processor instantiated each processor by calling its New constructor directly, bypassing the conditional wrapping that processors.Namespace.Register applies on the standard libbeat path. The `when` field was unpacked into the config but silently dropped, so processors ran unconditionally. Wrap each constructor with `processors.NewConditional` before invoking it so `when` configuration is honored, matching the behavior of standalone beats. * add changelog * better wording (cherry picked from commit 7bbe8ee) Co-authored-by: Mauri de Souza Meneguzzo <mauri870@gmail.com>
[8.19](backport #50215) security: bump aws-sdk-go-v2 cloudwatchlogs t… …o fix GHSA-xmrv-pmrh-hhx2 (#50307) * security: bump aws-sdk-go-v2 cloudwatchlogs to fix GHSA-xmrv-pmrh-hhx2 (#50215) ## Summary - Bumps `github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs` from v1.50.2 → v1.65.0 The other two affected packages from GHSA-xmrv-pmrh-hhx2 were already resolved on main: - `aws/protocol/eventstream` was already at the patched version v1.7.8 - `service/s3` was already bumped to v1.98.0 (≥ v1.97.3 fix) on main Addresses [GHSA-xmrv-pmrh-hhx2](GHSA-xmrv-pmrh-hhx2): a Denial-of-Service vulnerability in the EventStream header decoder where a malformed response frame with a crafted header value type byte outside the valid range causes the host process to terminate. Related: https://github.com/elastic/security/issues/9748 --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> (cherry picked from commit 7da25cf) * update go.mod, go.sum, NOTICE.txt after cloudwatchlogs bump Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Maurizio Branca <maurizio.branca@elastic.co> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
mod,x-pack/filebeat/input/cel: update mito to v1.24.2 (#50222) v1.24.2 of elastic/mito bumps the cel-go version to v0.28.0 and updates the code required for correctly handling maps in that runtime version. cel-go v0.28.0 fixes a bug in the runtime that caused error messages to identify the wrong source location. Update the dependency and fix the two test expectations that were tracking the incorrect locations. This change is functionally equivalent to a back-port of c589041.
[9.3](backport #49796) Split `BeatV2Manager` `Start` into two methods… …, so Beats can reply to check-in in parallel to its initialisation (#49850) The Start method from BeatV2Manager is split into two methods: - PreInit: responsible for starting the Elastic Agent client and start replying to check-ins. - PostInit: responsible for setting the Beats status to 'Running' and start executing Unit changes. A new method, WaitForStop is also added. It stops the BeatV2Manager and waits until all goroutines have returned. Currently it is only used in tests that use `testing.T` as the logger output to ensure no panics happen because the logger was used after the test ended. Multiple lint warnings are fixed GenAI-Assisted: Yes Human-Reviewed: Yes Tool: Cursor-CLI, Model: GPT-5.3 Codex Extra High Fast (cherry picked from commit 034546f) # Conflicts: # x-pack/libbeat/management/managerV2.go # x-pack/osquerybeat/beater/osquerybeat_status_test.go * Fix race that can block managerV2 shutdown (#49414) As described in #49388, `BeatV2Manager` can miss the shutdown signal because its `Stop` method notifies the manager by sending to its signal channel `stopChan` rather than closing it, but there are two goroutines that both listen on that channel. This PR changes `Stop` to close the channel rather than just sending. It also removes the second `stopChan` listener in `watchErrChan`, since the main goroutine already calls the context canceler for that helper when `stopChan` unblocks (this isn't strictly necessary but it will keep error states visible for a little longer during shutdown, and is what was previously happening in the "good" path where the main worker received the stop signal first). (cherry picked from commit d39cb49) --------- Co-authored-by: Tiago Queiroz <tiago.queiroz@elastic.co> Co-authored-by: Fae Charlton <fae.charlton@elastic.co>
[9.2](backport #49796) Split `BeatV2Manager` `Start` into two methods… …, so Beats can reply to check-in in parallel to its initialisation (#49849) The Start method from BeatV2Manager is split into two methods: - PreInit: responsible for starting the Elastic Agent client and start replying to check-ins. - PostInit: responsible for setting the Beats status to 'Running' and start executing Unit changes. A new method, WaitForStop is also added. It stops the BeatV2Manager and waits until all goroutines have returned. Currently it is only used in tests that use `testing.T` as the logger output to ensure no panics happen because the logger was used after the test ended. Multiple lint warnings are fixed GenAI-Assisted: Yes Human-Reviewed: Yes Tool: Cursor-CLI, Model: GPT-5.3 Codex Extra High Fast (cherry picked from commit 034546f) # Conflicts: # x-pack/libbeat/management/managerV2.go # x-pack/osquerybeat/beater/osquerybeat_status_test.go * Fix race that can block managerV2 shutdown (#49414) As described in #49388, `BeatV2Manager` can miss the shutdown signal because its `Stop` method notifies the manager by sending to its signal channel `stopChan` rather than closing it, but there are two goroutines that both listen on that channel. This PR changes `Stop` to close the channel rather than just sending. It also removes the second `stopChan` listener in `watchErrChan`, since the main goroutine already calls the context canceler for that helper when `stopChan` unblocks (this isn't strictly necessary but it will keep error states visible for a little longer during shutdown, and is what was previously happening in the "good" path where the main worker received the stop signal first). (cherry picked from commit d39cb49) --------- Co-authored-by: Tiago Queiroz <tiago.queiroz@elastic.co> Co-authored-by: Fae Charlton <fae.charlton@elastic.co>
PreviousNext