-
Notifications
You must be signed in to change notification settings - Fork 4.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[8.x](backport #41381) Fix system module with both filesets enabled #41488
Conversation
The system module did not define an ID at the root of the config, that made the V2 input loader only start the first journald input it saw because they both ended up with the same identifier (type, ID and path). This is fixed by defining an ID at the root of the configuration templates. The journald input now also adds the input_id key to its loggers and a non-fatal error is now logged at debug level. The system-logs input is now marked as experimental instead of stable. Fix lint warnings by moving toJournalConfig to input_linux.go Move TestSystemLogsCanUseLogInput to a file without the linux build constraint so it can run on all OSes supported by the system integration. (cherry picked from commit b1c7478) # Conflicts: # .buildkite/filebeat/filebeat-pipeline.yml
Cherry-pick of b1c7478 has failed:
To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally |
This pull request doesn't have a |
This pull request is now in conflicts. Could you fix it? 🙏
|
Proposed commit message
The system module did not define an ID at the root of the config, that made the V2 input loader only start the first journald input it saw because they both ended up with the same identifier (type, ID and path). This is fixed by defining an ID at the root of the configuration templates.
The journald input now also adds the
input_id
key to its loggers and a non-fatal error is now logged at debug level.The system-logs input is now marked as experimental instead of stable.
Fix lint warnings by moving
toJournalConfig
toinput_linux.go
Move TestSystemLogsCanUseLogInput to a file without the
linux build constraint so it can run on all OSes supported by the
system integration.
Checklist
[ ] I have made corresponding changes to the documentation[ ] I have made corresponding change to the default configuration files[ ] I have added an entry inCHANGELOG.next.asciidoc
orCHANGELOG-developer.next.asciidoc
.## Disruptive User Impact## Author's ChecklistHow to test this PR locally
Run Filebeat with the following
filebeat.yml
andmodules.d/system.yml
(adjust credentials/addresses as necessary)filebeat.yml
modules.d/system.yml
Go to Discover in Kibana, filter by
tags: from-journald
Look at
fileset.name
from the events, make sureauth
andsyslog
are thereRelated issues
## Use cases## Screenshots## LogsThis is an automatic backport of pull request #41381 done by Mergify.