packetbeat/beater: make sure Npcap installation runs before interface…

…s are needed (#30396)

Previously installNpcap was run after Create, which depends on having interfaces up
to establish sniffers, and so was too late. So move the call to the front of Create
to ensure that the library is installed by the time that it is needed.

CHANGELOG.next.asciidoc

@@ -137,7 +137,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...main[Check the HEAD dif
 
 *Packetbeat*
 
-- Add automated OEM Npcap installation handling. {pull}29112[29112]
+- Add automated OEM Npcap installation handling. {pull}29112[29112] {pull}30396[30396]
 - Add support for capturing TLS random number and OCSP status request details. {issue}29962[29962] {pull}30102[30102]
 
 *Functionbeat*

packetbeat/beater/packetbeat.go

@@ -111,12 +111,6 @@ func (pb *packetbeat) Run(b *beat.Beat) error {
 		}
 	}()
 
-	// Install Npcap if needed.
-	err := installNpcap(b)
-	if err != nil {
-		return err
-	}
-
 	if !b.Manager.Enabled() {
 		return pb.runStatic(b, pb.factory)
 	}

packetbeat/beater/processor.go

@@ -113,6 +113,12 @@ func (p *processorFactory) Create(pipeline beat.PipelineConnector, cfg *common.C
 		return nil, err
 	}
 
+	// Install Npcap if needed.
+	err = installNpcap(p.beat)
+	if err != nil {
+		return nil, err
+	}
+
 	publisher, err := publish.NewTransactionPublisher(
 		p.beat.Info.Name,
 		p.beat.Publisher,