Merge branch 'main' into feat/bump-1.23

elastic · Feb 24, 2025 · 48b9fe0 · 48b9fe0
2 parents 5e84968 + 5409677
commit 48b9fe0
Show file tree

Hide file tree

Showing 23 changed files with 188 additions and 97 deletions.
diff --git a/.buildkite/auditbeat/auditbeat-pipeline.yml b/.buildkite/auditbeat/auditbeat-pipeline.yml
@@ -454,9 +454,7 @@ steps:
         env:
           PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
         command: |
-          set -euo pipefail
-          cd auditbeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh auditbeat
         retry:
           automatic:
             - limit: 1
@@ -475,9 +473,7 @@ steps:
           PLATFORMS: "linux/arm64"
           PACKAGES: "docker"
         command: |
-          set -euo pipefail
-          cd auditbeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh auditbeat
         retry:
           automatic:
             - limit: 1

diff --git a/.buildkite/filebeat/filebeat-pipeline.yml b/.buildkite/filebeat/filebeat-pipeline.yml
@@ -399,8 +399,7 @@ steps:
         env:
           PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
         command: |
-          cd filebeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh filebeat
         retry:
           automatic:
             - limit: 1
@@ -421,8 +420,7 @@ steps:
           PLATFORMS: "linux/arm64"
           PACKAGES: "docker"
         command: |
-          cd filebeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh filebeat
         retry:
           automatic:
             - limit: 1

diff --git a/.buildkite/heartbeat/heartbeat-pipeline.yml b/.buildkite/heartbeat/heartbeat-pipeline.yml
@@ -343,8 +343,7 @@ steps:
         env:
           PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
         command: |
-          cd heartbeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh heartbeat
         retry:
           automatic:
             - limit: 1
@@ -363,8 +362,7 @@ steps:
           PLATFORMS: "linux/arm64"
           PACKAGES: "docker"
         command: |
-          cd heartbeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh heartbeat
         retry:
           automatic:
             - limit: 1

diff --git a/.buildkite/metricbeat/pipeline.yml b/.buildkite/metricbeat/pipeline.yml
@@ -399,8 +399,7 @@ steps:
         env:
           PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
         command: |
-          cd metricbeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh metricbeat
         retry:
           automatic:
             - limit: 1
@@ -421,8 +420,7 @@ steps:
           PLATFORMS: "linux/arm64"
           PACKAGES: "docker"
         command: |
-          cd metricbeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh metricbeat
         retry:
           automatic:
             - limit: 1

diff --git a/.buildkite/packetbeat/pipeline.packetbeat.yml b/.buildkite/packetbeat/pipeline.packetbeat.yml
@@ -366,8 +366,7 @@ steps:
         env:
           PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
         command: |
-          cd packetbeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh packetbeat
         retry:
           automatic:
             - limit: 1
@@ -388,8 +387,7 @@ steps:
           PLATFORMS: "linux/arm64"
           PACKAGES: "docker"
         command: |
-          cd packetbeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh packetbeat
         retry:
           automatic:
             - limit: 1

diff --git a/.buildkite/scripts/packaging/packaging.sh b/.buildkite/scripts/packaging/packaging.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+#
+# Centralise the mage package for a given beat in Buildkite.
+# It enables multi-arch builds to avoid the exec format errors when 
+# attempting to build arm64 inside arm64 workers.
+# For further details, see https://github.com/elastic/elastic-agent/pull/6948
+# and https://github.com/elastic/golang-crossbuild/pull/507
+#
+
+set -ueo pipefail
+
+
+BEAT_DIR=${1:?-"Error: Beat directory must be specified."}
+
+#Use newer multiarch support for packaging
+docker run --privileged --rm tonistiigi/binfmt:master --install all
+
+cd $BEAT_DIR
+mage package
diff --git a/.buildkite/winlogbeat/pipeline.winlogbeat.yml b/.buildkite/winlogbeat/pipeline.winlogbeat.yml
@@ -209,8 +209,7 @@ steps:
         env:
           PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
         command: |
-          cd winlogbeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh winlogbeat
         retry:
           automatic:
             - limit: 1

diff --git a/.buildkite/x-pack/pipeline.xpack.agentbeat.yml b/.buildkite/x-pack/pipeline.xpack.agentbeat.yml
@@ -70,9 +70,7 @@ steps:
           PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
           SNAPSHOT: true
         command: |
-          set -euo pipefail
-          cd x-pack/agentbeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh x-pack/agentbeat
         artifact_paths:
           - x-pack/agentbeat/build/distributions/**/*
           - "x-pack/agentbeat/build/*.xml"

diff --git a/.buildkite/x-pack/pipeline.xpack.auditbeat.yml b/.buildkite/x-pack/pipeline.xpack.auditbeat.yml
@@ -374,8 +374,7 @@ steps:
         env:
           PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
         command: |
-          cd x-pack/auditbeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh x-pack/auditbeat
         retry:
           automatic:
             - limit: 1
@@ -396,8 +395,7 @@ steps:
           PLATFORMS: "linux/arm64"
           PACKAGES: "docker"
         command: |
-          cd x-pack/auditbeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh x-pack/auditbeat
         retry:
           automatic:
             - limit: 1

diff --git a/.buildkite/x-pack/pipeline.xpack.dockerlogbeat.yml b/.buildkite/x-pack/pipeline.xpack.dockerlogbeat.yml
@@ -117,8 +117,7 @@ steps:
         env:
           PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
         command: |
-          cd x-pack/dockerlogbeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh x-pack/dockerlogbeat
         retry:
           automatic:
             - limit: 1
@@ -137,8 +136,7 @@ steps:
           PLATFORMS: "linux/arm64"
           PACKAGES: "docker"
         command: |
-          cd x-pack/dockerlogbeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh x-pack/dockerlogbeat
         retry:
           automatic:
             - limit: 1

diff --git a/.buildkite/x-pack/pipeline.xpack.filebeat.yml b/.buildkite/x-pack/pipeline.xpack.filebeat.yml
@@ -430,8 +430,7 @@ steps:
         env:
           PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
         command: |
-          cd x-pack/filebeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh x-pack/filebeat
         retry:
           automatic:
             - limit: 1
@@ -452,8 +451,7 @@ steps:
           PLATFORMS: "linux/arm64"
           PACKAGES: "docker"
         command: |
-          cd x-pack/filebeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh x-pack/filebeat
         retry:
           automatic:
             - limit: 1

diff --git a/.buildkite/x-pack/pipeline.xpack.heartbeat.yml b/.buildkite/x-pack/pipeline.xpack.heartbeat.yml
@@ -361,8 +361,7 @@ steps:
         env:
           PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
         command: |
-          cd x-pack/heartbeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh x-pack/heartbeat
         retry:
           automatic:
             - limit: 1
@@ -383,8 +382,7 @@ steps:
           PLATFORMS: "linux/arm64"
           PACKAGES: "docker"
         command: |
-          cd x-pack/heartbeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh x-pack/heartbeat
         retry:
           automatic:
             - limit: 1

diff --git a/.buildkite/x-pack/pipeline.xpack.metricbeat.yml b/.buildkite/x-pack/pipeline.xpack.metricbeat.yml
@@ -408,8 +408,7 @@ steps:
         env:
           PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
         command: |
-          cd x-pack/metricbeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh x-pack/metricbeat
         retry:
           automatic:
             - limit: 1
@@ -430,8 +429,7 @@ steps:
           PLATFORMS: "linux/arm64"
           PACKAGES: "docker"
         command: |
-          cd x-pack/metricbeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh x-pack/metricbeat
         retry:
           automatic:
             - limit: 1

diff --git a/.buildkite/x-pack/pipeline.xpack.osquerybeat.yml b/.buildkite/x-pack/pipeline.xpack.osquerybeat.yml
@@ -283,8 +283,7 @@ steps:
         env:
           PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
         command: |
-          cd x-pack/osquerybeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh x-pack/osquerybeat
         retry:
           automatic:
             - limit: 1

diff --git a/.buildkite/x-pack/pipeline.xpack.packetbeat.yml b/.buildkite/x-pack/pipeline.xpack.packetbeat.yml
@@ -451,8 +451,7 @@ steps:
         env:
           PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
         command: |
-          cd x-pack/packetbeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh x-pack/packetbeat
         retry:
           automatic:
             - limit: 1
@@ -473,8 +472,7 @@ steps:
           PLATFORMS: "linux/arm64"
           PACKAGES: "docker"
         command: |
-          cd x-pack/packetbeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh x-pack/packetbeat
         retry:
           automatic:
             - limit: 1

diff --git a/.buildkite/x-pack/pipeline.xpack.winlogbeat.yml b/.buildkite/x-pack/pipeline.xpack.winlogbeat.yml
@@ -252,8 +252,7 @@ steps:
         env:
           PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
         command: |
-          cd x-pack/winlogbeat
-          mage package
+          .buildkite/scripts/packaging/packaging.sh x-pack/winlogbeat
         retry:
           automatic:
             - limit: 1

diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -421,6 +421,7 @@ otherwise no tag is added. {issue}42208[42208] {pull}42403[42403]
 - Journald `include_matches.match` now accepts `+` to represent a logical disjunction (OR) {issue}40185[40185] {pull}42517[42517]
 - The journald input is now generally available. {pull}42107[42107]
 - Add metrics for number of events and pages published by HTTPJSON input. {issue}42340[42340] {pull}42442[42442]
+- Add `etw` input fallback to attach an already existing session. {pull}42847[42847]
 
 *Auditbeat*
 

diff --git a/libbeat/common/cli/password.go b/libbeat/common/cli/password.go
@@ -18,14 +18,12 @@
 package cli
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"strings"
-	"syscall"
-
-	"errors"
 
-	"golang.org/x/crypto/ssh/terminal"
+	"golang.org/x/term"
 )
 
 type method func(m string) (string, error)
@@ -61,11 +59,13 @@ func ReadPassword(def string) (string, error) {
 }
 
 func stdin(p string) (string, error) {
+	//nolint:forbidigo // ignore
 	fmt.Print("Enter password: ")
-	bytePassword, err := terminal.ReadPassword(int(syscall.Stdin))
+	bytePassword, err := term.ReadPassword(int(os.Stdin.Fd()))
 	if err != nil {
 		return "", fmt.Errorf("reading password input: %w", err)
 	}
+	//nolint:forbidigo // ignore
 	fmt.Println()
 	return string(bytePassword), nil
 }

diff --git a/libbeat/otelbeat/beatconverter/beatconverter_test.go b/libbeat/otelbeat/beatconverter/beatconverter_test.go
@@ -47,6 +47,9 @@ exporters:
     batcher:
       enabled: true
       max_size_items: 1600
+      min_size_items: 0
+    mapping:
+      mode: bodymap       
 `
 
 func TestConverter(t *testing.T) {
@@ -187,6 +190,9 @@ exporters:
     batcher:
       enabled: true
       max_size_items: 1600
+      min_size_items: 0
+    mapping:
+      mode: bodymap       
 receivers:
   filebeatreceiver:
     filebeat:

diff --git a/libbeat/otelbeat/oteltranslate/outputs/elasticsearch/config_otel.go b/libbeat/otelbeat/oteltranslate/outputs/elasticsearch/config_otel.go
@@ -149,6 +149,11 @@ func ToOTelConfig(output *config.C) (map[string]any, error) {
 		"batcher": map[string]any{
 			"enabled":        true,
 			"max_size_items": escfg.BulkMaxSize, // bulk_max_size
+			"min_size_items": 0,                 // 0 means immediately trigger a flush
+		},
+
+		"mapping": map[string]any{
+			"mode": "bodymap",
 		},
 	}