From 03008d067d3bbc3bb28507f6243bd78eecbe03ed Mon Sep 17 00:00:00 2001
From: Andrew Stucki <andrew.stucki@elastic.co>
Date: Tue, 5 May 2020 09:24:26 -0400
Subject: [PATCH] Modify test so it doesn't pick up real user events

---
 x-pack/auditbeat/module/system/user/user_test.go | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/x-pack/auditbeat/module/system/user/user_test.go b/x-pack/auditbeat/module/system/user/user_test.go
index a3c30906f39..a8fd6f85238 100644
--- a/x-pack/auditbeat/module/system/user/user_test.go
+++ b/x-pack/auditbeat/module/system/user/user_test.go
@@ -38,10 +38,13 @@ func TestData(t *testing.T) {
 	}
 
 	for _, e := range events {
-		if name, _ := e.RootFields.GetValue("user.name"); name == "elastic" {
+		if name, _ := e.RootFields.GetValue("user.name"); name == "__elastic" {
 			relatedNames, err := e.RootFields.GetValue("related.user")
 			require.NoError(t, err)
-			require.Equal(t, []string{"elastic"}, relatedNames)
+			require.Equal(t, []string{"__elastic"}, relatedNames)
+			groupName, err := e.RootFields.GetValue("user.group.name")
+			require.NoError(t, err)
+			require.Equal(t, "__elastic", groupName)
 			groupID, err := e.RootFields.GetValue("user.group.id")
 			require.NoError(t, err)
 			require.Equal(t, "1001", groupID)
@@ -56,13 +59,13 @@ func TestData(t *testing.T) {
 
 func testUser() *User {
 	return &User{
-		Name: "elastic",
+		Name: "__elastic",
 		UID:  "9999",
 		GID:  "1001",
 		Groups: []*user.Group{
 			&user.Group{
 				Gid:  "1001",
-				Name: "elastic",
+				Name: "__elastic",
 			},
 			&user.Group{
 				Gid:  "1002",