Fix the wrong event type for a new file (#36098)

It's supposed to emit a `create` event, not a `write` event when a previously ignored empty file gets written to.
elastic · Jul 18, 2023 · f52d38a · f52d38a
1 parent 57d649d
commit f52d38a
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/filebeat/input/filestream/fswatch.go b/filebeat/input/filestream/fswatch.go
@@ -202,6 +202,7 @@ func (w *fileWatcher) watch(ctx unison.Canceler) {
 		// no need to react on empty new files
 		if fd.Info.Size() == 0 {
 			w.log.Warnf("file %q has no content yet, skipping", fd.Filename)
+			delete(paths, path)
 			continue
 		}
 		select {

diff --git a/filebeat/input/filestream/fswatch_test.go b/filebeat/input/filestream/fswatch_test.go
@@ -295,8 +295,7 @@ scanner:
 			e := fw.Event()
 			expEvent := loginp.FSEvent{
 				NewPath: filename,
-				OldPath: filename,
-				Op:      loginp.OpWrite,
+				Op:      loginp.OpCreate,
 				Descriptor: loginp.FileDescriptor{
 					Filename: filename,
 					Info:     testFileInfo{name: basename, size: 5}, // +5 bytes appended