From 082b73a2e61db478eed25ade55678158183a6af7 Mon Sep 17 00:00:00 2001 From: "mergify[bot]" <37929162+mergify[bot]@users.noreply.github.com> Date: Tue, 8 Mar 2022 16:14:16 +0100 Subject: [PATCH] Set `log.offset` to the start of the reported line in filestream (#30445) (#30450) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit (cherry picked from commit 8aca67327eb9bc656fc899034601c89ff3839cb9) Co-authored-by: Noémi Ványi --- CHANGELOG.next.asciidoc | 4 +--- libbeat/reader/readfile/metafields.go | 6 ++++-- libbeat/reader/readfile/metafields_test.go | 3 ++- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 2f7b594d1120..fb843d0e85c6 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -44,9 +44,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...main[Check the HEAD dif *Filebeat* - -*Filebeat* - +- Report the starting offset of the line in `log.offset` when using `filestream` instead of the end to be ECS compliant. {pull}30445[30445] *Heartbeat* diff --git a/libbeat/reader/readfile/metafields.go b/libbeat/reader/readfile/metafields.go index 734069b59505..1b5cb8bed206 100644 --- a/libbeat/reader/readfile/metafields.go +++ b/libbeat/reader/readfile/metafields.go @@ -41,10 +41,9 @@ func NewFilemeta(r reader.Reader, path string, offset int64) reader.Reader { func (r *FileMetaReader) Next() (reader.Message, error) { message, err := r.reader.Next() - r.offset += int64(message.Bytes) - // if the message is empty, there is no need to enrich it with file metadata if message.IsEmpty() { + r.offset += int64(message.Bytes) return message, err } @@ -56,6 +55,9 @@ func (r *FileMetaReader) Next() (reader.Message, error) { }, }, }) + + r.offset += int64(message.Bytes) + return message, err } diff --git a/libbeat/reader/readfile/metafields_test.go b/libbeat/reader/readfile/metafields_test.go index 978591c1b1b2..a1480e6291b9 100644 --- a/libbeat/reader/readfile/metafields_test.go +++ b/libbeat/reader/readfile/metafields_test.go @@ -54,7 +54,6 @@ func TestMetaFieldsOffset(t *testing.T) { if err == io.EOF { break } - offset += int64(msg.Bytes) expectedFields := common.MapStr{} if len(msg.Content) != 0 { @@ -67,6 +66,8 @@ func TestMetaFieldsOffset(t *testing.T) { }, } } + offset += int64(msg.Bytes) + require.Equal(t, expectedFields, msg.Fields) require.Equal(t, offset, in.offset) }