Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Init winlog input #19622

Merged
merged 3 commits into from
Jul 8, 2020
Merged

Init winlog input #19622

merged 3 commits into from
Jul 8, 2020

Conversation

urso
Copy link

@urso urso commented Jul 2, 2020

Enhancement

What does this PR do?

This changes introduces the winlog input in filebeat based on the
input v2 API. Most of the functionality is directly imported from winlogbeat.

Integration tests are not yet implemented. I'd sugest to reimplement the existing python tests in this package as simple go based tests. Most of the implementation is directly shared with winlogbeat, which gives us at least some confidence.

Why is it important?

Provide journald input to the Agent

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
    - [ ] I have made corresponding changes to the documentation
    - [ ] I have made corresponding change to the default configuration files
    - [ ] I have added tests that prove my fix is effective or that my feature works
    - [ ] I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

  • [ ]

How to test this PR locally

Configure the winlog input similar to winlogbeat and check if logs are collected. Restarting filebeat should only collect new logs.

Related issues

@urso urso added review Filebeat Filebeat needs_backport PR is waiting to be backported to other branches. [zube]: In Review Project:Filebeat-Input-v2 Team:Services (Deprecated) Label for the former Integrations-Services team v7.9.0 labels Jul 2, 2020
@elasticmachine
Copy link
Collaborator

Pinging @elastic/integrations-services (Team:Services)

@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Jul 2, 2020
@urso urso requested a review from andrewkroh July 2, 2020 16:17
@elasticmachine
Copy link
Collaborator

elasticmachine commented Jul 2, 2020

💔 Build Failed

Pipeline View Test View Changes Artifacts preview

Expand to view the summary

Build stats

  • Build Cause: [Pull request #19622 updated]

  • Start Time: 2020-07-08T12:22:16.621+0000

  • Duration: 45 min 16 sec

Test stats 🧪

Test Results
Failed 0
Passed 4155
Skipped 674
Total 4829

Steps errors

Expand to view the steps failures

  • Name: Make -C filebeat testsuite

    • Description: make -C filebeat testsuite

    • Duration: 7 min 47 sec

    • Start Time: 2020-07-08T12:44:20.366+0000

    • log

  • Name: Report to Codecov

    • Description: curl -sSLo codecov https://codecov.io/bash for i in auditbeat filebeat heartbeat libbeat metricbeat packetbeat winlogbeat journalbeat do FILE="${i}/build/coverage/full.cov" if [ -f "${FILE}" ]; then bash codecov -f "${FILE}" fi done

    • Duration: 1 min 27 sec

    • Start Time: 2020-07-08T12:48:01.064+0000

    • log

Log output

Expand to view the last 100 lines of log output

[2020-07-08T13:07:01.296Z] [success] 0.43% test_xpack_modules.XPackTest.test_fileset_file_080_aws: 1.9382s
[2020-07-08T13:07:01.296Z] [success] 0.43% test_xpack_modules.XPackTest.test_fileset_file_150_zeek: 1.9359s
[2020-07-08T13:07:01.296Z] [success] 0.43% test_xpack_modules.XPackTest.test_fileset_file_069_aws: 1.9349s
[2020-07-08T13:07:01.296Z] [success] 0.43% test_xpack_modules.XPackTest.test_fileset_file_051_aws: 1.9348s
[2020-07-08T13:07:01.296Z] [success] 0.43% test_xpack_modules.XPackTest.test_fileset_file_075_aws: 1.9326s
[2020-07-08T13:07:01.296Z] [success] 0.43% test_xpack_modules.XPackTest.test_fileset_file_068_aws: 1.9175s
[2020-07-08T13:07:01.296Z] [success] 0.43% test_xpack_modules.XPackTest.test_fileset_file_054_aws: 1.9171s
[2020-07-08T13:07:01.296Z] [success] 0.43% test_xpack_modules.XPackTest.test_fileset_file_093_gsuite: 1.9159s
[2020-07-08T13:07:01.296Z] [success] 0.43% test_xpack_modules.XPackTest.test_fileset_file_061_aws: 1.9149s
[2020-07-08T13:07:01.296Z] [success] 0.43% test_xpack_modules.XPackTest.test_fileset_file_049_aws: 1.9120s
[2020-07-08T13:07:01.296Z] [success] 0.43% test_xpack_modules.XPackTest.test_fileset_file_066_aws: 1.9115s
[2020-07-08T13:07:01.296Z] [success] 0.42% test_xpack_modules.XPackTest.test_fileset_file_056_aws: 1.9042s
[2020-07-08T13:07:01.296Z] [success] 0.42% test_xpack_modules.XPackTest.test_fileset_file_078_aws: 1.8972s
[2020-07-08T13:07:01.296Z] [success] 0.42% test_xpack_modules.XPackTest.test_fileset_file_130_zeek: 1.8939s
[2020-07-08T13:07:01.296Z] [success] 0.42% test_xpack_modules.XPackTest.test_fileset_file_089_aws: 1.8764s
[2020-07-08T13:07:01.296Z] [success] 0.16% test_http_endpoint.Test.test_http_endpoint_wrong_auth_value: 0.7293s
[2020-07-08T13:07:01.296Z] [success] 0.16% test_http_endpoint.Test.test_http_endpoint_empty_body: 0.6969s
[2020-07-08T13:07:01.296Z] [success] 0.14% test_http_endpoint.Test.test_http_endpoint_request: 0.6223s
[2020-07-08T13:07:01.296Z] [success] 0.13% test_http_endpoint.Test.test_http_endpoint_missing_auth_value: 0.5608s
[2020-07-08T13:07:01.296Z] [success] 0.12% test_http_endpoint.Test.test_http_endpoint_malformed_json: 0.5493s
[2020-07-08T13:07:01.296Z] [success] 0.11% test_http_endpoint.Test.test_http_endpoint_get_request: 0.5108s
[2020-07-08T13:07:01.296Z] [success] 0.11% test_http_endpoint.Test.test_http_endpoint_wrong_content_header: 0.5069s
[2020-07-08T13:07:01.296Z] ----------------------------------------------------------------------
[2020-07-08T13:07:01.296Z] Ran 167 tests in 448.448s
[2020-07-08T13:07:01.296Z] 
[2020-07-08T13:07:01.296Z] OK
[2020-07-08T13:07:01.570Z] >> python test: Integration Testing Complete
[2020-07-08T13:07:05.922Z] Recording test results
[2020-07-08T13:07:08.258Z] Stashed 4 file(s)
[2020-07-08T13:07:08.269Z] Archiving artifacts
[2020-07-08T13:07:09.153Z] + curl -sSLo codecov https://codecov.io/bash
[2020-07-08T13:07:09.416Z] + FILE=auditbeat/build/coverage/full.cov
[2020-07-08T13:07:09.416Z] + [ -f auditbeat/build/coverage/full.cov ]
[2020-07-08T13:07:09.416Z] + FILE=filebeat/build/coverage/full.cov
[2020-07-08T13:07:09.416Z] + [ -f filebeat/build/coverage/full.cov ]
[2020-07-08T13:07:09.416Z] + FILE=heartbeat/build/coverage/full.cov
[2020-07-08T13:07:09.416Z] + [ -f heartbeat/build/coverage/full.cov ]
[2020-07-08T13:07:09.416Z] + FILE=libbeat/build/coverage/full.cov
[2020-07-08T13:07:09.416Z] + [ -f libbeat/build/coverage/full.cov ]
[2020-07-08T13:07:09.416Z] + FILE=metricbeat/build/coverage/full.cov
[2020-07-08T13:07:09.416Z] + [ -f metricbeat/build/coverage/full.cov ]
[2020-07-08T13:07:09.416Z] + FILE=packetbeat/build/coverage/full.cov
[2020-07-08T13:07:09.416Z] + [ -f packetbeat/build/coverage/full.cov ]
[2020-07-08T13:07:09.416Z] + FILE=winlogbeat/build/coverage/full.cov
[2020-07-08T13:07:09.416Z] + [ -f winlogbeat/build/coverage/full.cov ]
[2020-07-08T13:07:09.416Z] + FILE=journalbeat/build/coverage/full.cov
[2020-07-08T13:07:09.416Z] + [ -f journalbeat/build/coverage/full.cov ]
[2020-07-08T13:07:10.975Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19622/src/github.com/elastic/beats
[2020-07-08T13:07:11.289Z] + find . -type f -name TEST*.xml -path */build/* -delete
[2020-07-08T13:07:11.301Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19622/src/github.com/elastic/beats/Lint
[2020-07-08T13:07:11.388Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19622/src/github.com/elastic/beats/Winlogbeat-oss
[2020-07-08T13:07:11.465Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19622/src/github.com/elastic/beats/Filebeat-x-pack-Mac-OS-X
[2020-07-08T13:07:11.550Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19622/src/github.com/elastic/beats/Filebeat-Mac-OS-X
[2020-07-08T13:07:11.626Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19622/src/github.com/elastic/beats/Filebeat-oss
[2020-07-08T13:07:11.700Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19622/src/github.com/elastic/beats/Winlogbeat-Windows-x-pack
[2020-07-08T13:07:11.775Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19622/src/github.com/elastic/beats/Filebeat-x-pack-Windows
[2020-07-08T13:07:11.855Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19622/src/github.com/elastic/beats/Filebeat-Windows
[2020-07-08T13:07:11.931Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19622/src/github.com/elastic/beats/Winlogbeat-Windows
[2020-07-08T13:07:12.006Z] Running in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19622/src/github.com/elastic/beats/Filebeat-x-pack
[2020-07-08T13:07:12.368Z] + cat
[2020-07-08T13:07:12.368Z] + /usr/local/bin/runbld ./runbld-script
[2020-07-08T13:07:12.368Z] Picked up JAVA_TOOL_OPTIONS: -Dfile.encoding=UTF8
[2020-07-08T13:07:18.966Z] runbld>>> runbld started
[2020-07-08T13:07:18.966Z] runbld>>> 1.6.12/f45d832f2ba0aa2722ab4ec1fda8ad140f027f8b
[2020-07-08T13:07:20.884Z] runbld>>> The following profiles matched the job 'Beats/beats-beats-mbp/PR-19622' in order of occurrence in the config (last value wins).
[2020-07-08T13:07:21.825Z] runbld>>> Debug logging enabled.
[2020-07-08T13:07:21.825Z] runbld>>> Storing result
[2020-07-08T13:07:22.086Z] runbld>>> Store result: created {:total 2, :successful 2, :failed 0} 1
[2020-07-08T13:07:22.086Z] runbld>>> BUILD: https://c150076387b5421f9154dfbf536e5c60.us-west1.gcp.cloud.es.io:9243/build-1587637540455/t/20200708130721-579E5C49
[2020-07-08T13:07:22.086Z] runbld>>> Adding system facts.
[2020-07-08T13:07:23.030Z] runbld>>> Adding vcs info for the latest commit:  0f9f384620a3d5cb9d5128cbaa7f86eb8402c9fc
[2020-07-08T13:07:23.030Z] runbld>>> >>>>>>>>>>>> SCRIPT EXECUTION BEGIN >>>>>>>>>>>>
[2020-07-08T13:07:23.030Z] runbld>>> Adding /usr/lib/jvm/java-8-openjdk-amd64/bin to the path.
[2020-07-08T13:07:23.030Z] Processing JUnit reports with runbld...
[2020-07-08T13:07:23.030Z] + echo 'Processing JUnit reports with runbld...'
[2020-07-08T13:07:23.599Z] runbld>>> <<<<<<<<<<<< SCRIPT EXECUTION END <<<<<<<<<<<<
[2020-07-08T13:07:23.599Z] runbld>>> DURATION: 23ms
[2020-07-08T13:07:23.599Z] runbld>>> STDOUT: 40 bytes
[2020-07-08T13:07:23.599Z] runbld>>> STDERR: 49 bytes
[2020-07-08T13:07:23.599Z] runbld>>> WRAPPED PROCESS: SUCCESS (0)
[2020-07-08T13:07:23.599Z] runbld>>> Searching for build metadata in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19622/src/github.com/elastic/beats
[2020-07-08T13:07:24.540Z] runbld>>> Storing build metadata: 
[2020-07-08T13:07:24.540Z] runbld>>> Adding test report.
[2020-07-08T13:07:24.540Z] runbld>>> Searching for junit test output files with the pattern: TEST-.*\.xml$ in: /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19622/src/github.com/elastic/beats
[2020-07-08T13:07:25.114Z] runbld>>> Found 15 test output files
[2020-07-08T13:07:26.066Z] runbld>>> Test output logs contained: Errors: 0 Failures: 0 Tests: 4829 Skipped: 649
[2020-07-08T13:07:26.331Z] runbld>>> Storing result
[2020-07-08T13:07:26.331Z] runbld>>> FAILURES: 0
[2020-07-08T13:07:26.591Z] runbld>>> Store result: updated {:total 2, :successful 2, :failed 0} 2
[2020-07-08T13:07:26.591Z] runbld>>> BUILD: https://c150076387b5421f9154dfbf536e5c60.us-west1.gcp.cloud.es.io:9243/build-1587637540455/t/20200708130721-579E5C49
[2020-07-08T13:07:26.591Z] runbld>>> Email notification disabled by environment variable.
[2020-07-08T13:07:26.591Z] runbld>>> Slack notification disabled by environment variable.
[2020-07-08T13:07:32.133Z] Running on Jenkins in /var/lib/jenkins/workspace/Beats_beats-beats-mbp_PR-19622
[2020-07-08T13:07:32.361Z] [INFO] getVaultSecret: Getting secrets
[2020-07-08T13:07:32.423Z] Masking supported pattern matches of $VAULT_ADDR or $VAULT_ROLE_ID or $VAULT_SECRET_ID
[2020-07-08T13:07:33.179Z] + chmod 755 generate-build-data.sh
[2020-07-08T13:07:33.180Z] + ./generate-build-data.sh https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats-beats-mbp/PR-19622/ https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats-beats-mbp/PR-19622/runs/4 FAILURE 2716299
[2020-07-08T13:07:33.180Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats-beats-mbp/PR-19622/runs/4/steps/?limit=10000 -o steps-info.json
[2020-07-08T13:07:33.730Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats-beats-mbp/PR-19622/runs/4/tests/?status=FAILED -o tests-errors.json
[2020-07-08T13:07:34.281Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats-beats-mbp/PR-19622/runs/4/log/ -o pipeline-log.txt

Copy link
Contributor

@kvch kvch left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM but either @andrewkroh or @narph could take a look at it?

@urso urso mentioned this pull request Jul 6, 2020
2 tasks
@urso urso requested a review from adriansr July 7, 2020 14:24
@narph
Copy link
Contributor

narph commented Jul 8, 2020

LGTM but either @andrewkroh or @narph could take a look at it?

LGTM, tested it out.

@urso urso merged commit 4e62fd2 into elastic:master Jul 8, 2020
@urso urso deleted the filebeat-input-winlog branch July 8, 2020 14:13
urso pushed a commit to urso/beats that referenced this pull request Jul 9, 2020
(cherry picked from commit 4e62fd2)
@urso urso removed the needs_backport PR is waiting to be backported to other branches. label Jul 9, 2020
urso pushed a commit that referenced this pull request Jul 9, 2020
@urso urso added the test-plan Add this PR to be manual test plan label Jul 14, 2020
@andresrc andresrc added the test-plan-added This PR has been added to the test plan label Jul 21, 2020
melchiormoulin pushed a commit to melchiormoulin/beats that referenced this pull request Oct 14, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Filebeat Filebeat Project:Filebeat-Input-v2 review Team:Services (Deprecated) Label for the former Integrations-Services team test-plan Add this PR to be manual test plan test-plan-added This PR has been added to the test plan v7.9.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants