From 8405aed76b1a818c0cba76c781ef17850c69e5ea Mon Sep 17 00:00:00 2001
From: Tiago Queiroz <tiago.queiroz@elastic.co>
Date: Fri, 18 Oct 2024 10:48:13 -0400
Subject: [PATCH] Add test for log input and more logging

---
 filebeat/input/systemlogs/input.go            |  3 +-
 filebeat/tests/integration/systemlogs_test.go | 62 +++++++++++++++----
 .../testdata/filebeat_system_module.yml       |  2 +-
 3 files changed, 52 insertions(+), 15 deletions(-)

diff --git a/filebeat/input/systemlogs/input.go b/filebeat/input/systemlogs/input.go
index 9189c7fe8565..12aef63700c2 100644
--- a/filebeat/input/systemlogs/input.go
+++ b/filebeat/input/systemlogs/input.go
@@ -163,11 +163,12 @@ func useJournald(c *conf.C) (bool, error) {
 				"using log input because file(s) was(were) found when testing glob '%s'",
 				g)
 			return false, nil
-
 		}
 	}
 
 	// if no system log files are found, then use jounrald
+	logger.Info("no files were found, using journald input")
+
 	return true, nil
 }
 
diff --git a/filebeat/tests/integration/systemlogs_test.go b/filebeat/tests/integration/systemlogs_test.go
index ec5ec75faed4..aae3010803e9 100644
--- a/filebeat/tests/integration/systemlogs_test.go
+++ b/filebeat/tests/integration/systemlogs_test.go
@@ -23,6 +23,7 @@ import (
 	_ "embed"
 	"fmt"
 	"os"
+	"path"
 	"path/filepath"
 	"testing"
 	"time"
@@ -36,35 +37,70 @@ var systemModuleCfg string
 // TestSystemLogsCanUseJournald aims to ensure the system-logs input can
 // correctly choose and start a journald input when the globs defined in
 // var.paths do not resolve to any file.
-func TestSystemLogsCanUseJournald(t *testing.T) {
+func TestSystemLogsCanUseJournaldInput(t *testing.T) {
 	filebeat := integration.NewBeat(
 		t,
 		"filebeat",
 		"../../filebeat.test",
 	)
+	workDir := filebeat.TempDir()
+	copyModulesDir(t, workDir)
 
 	// As the name says, we want this folder to exist bu t be empty
-	emptyTempFolder := t.TempDir()
-	yamlCfg := fmt.Sprintf(systemModuleCfg, emptyTempFolder, filebeat.TempDir())
+	globWithoutFiles := filepath.Join(t.TempDir(), "*")
+	yamlCfg := fmt.Sprintf(systemModuleCfg, globWithoutFiles, workDir)
 
+	filebeat.WriteConfigFile(yamlCfg)
+	filebeat.Start()
+
+	filebeat.WaitForLogs(
+		"no files were found, using journald input",
+		10*time.Second,
+		"system-logs did not select journald input")
+	filebeat.WaitForLogs(
+		"journalctl started with PID",
+		10*time.Second,
+		"system-logs did not start journald input")
+}
+
+func TestSystemLogsCanUseLogInput(t *testing.T) {
+	filebeat := integration.NewBeat(
+		t,
+		"filebeat",
+		"../../filebeat.test",
+	)
+	workDir := filebeat.TempDir()
+	copyModulesDir(t, workDir)
+
+	logFilePath := path.Join(workDir, "syslog")
+	integration.GenerateLogFile(t, logFilePath, 5, false)
+	yamlCfg := fmt.Sprintf(systemModuleCfg, logFilePath, workDir)
+
+	filebeat.WriteConfigFile(yamlCfg)
+	filebeat.Start()
+
+	filebeat.WaitForLogs(
+		"using log input because file(s) was(were) found",
+		10*time.Second,
+		"system-logs did not select the log input")
+	filebeat.WaitForLogs(
+		"Harvester started for paths:",
+		10*time.Second,
+		"system-logs did not start the log input")
+}
+
+func copyModulesDir(t *testing.T, dst string) {
 	pwd, err := os.Getwd()
 	if err != nil {
-		t.Fatal("cannot get the current directory: %s", err)
+		t.Fatalf("cannot get the current directory: %s", err)
 	}
 	localModules := os.DirFS(filepath.Join(pwd, "../", "../", "module"))
 	localModulesD := os.DirFS(filepath.Join(pwd, "../", "../", "modules.d"))
 
-	if err := os.CopyFS(filepath.Join(filebeat.TempDir(), "module"), localModules); err != nil {
+	if err := os.CopyFS(filepath.Join(dst, "module"), localModules); err != nil {
 		t.Fatalf("cannot copy 'module' folder to test folder: %s", err)
 	}
-	if err := os.CopyFS(filepath.Join(filebeat.TempDir(), "modules.d"), localModulesD); err != nil {
+	if err := os.CopyFS(filepath.Join(dst, "modules.d"), localModulesD); err != nil {
 		t.Fatalf("cannot copy 'modules.d' folder to test folder: %s", err)
 	}
-
-	filebeat.WriteConfigFile(yamlCfg)
-	filebeat.Start()
-	filebeat.WaitForLogs(
-		"journalctl started with PID",
-		10*time.Second,
-		"system-logs did not start journald")
 }
diff --git a/filebeat/tests/integration/testdata/filebeat_system_module.yml b/filebeat/tests/integration/testdata/filebeat_system_module.yml
index c0f4d31ca638..27de8f2a414a 100644
--- a/filebeat/tests/integration/testdata/filebeat_system_module.yml
+++ b/filebeat/tests/integration/testdata/filebeat_system_module.yml
@@ -3,7 +3,7 @@ filebeat.modules:
     syslog:
       enabled: true
       var.paths:
-        - "%s/*"
+        - "%s"
 
 path.home: %s