From 0c187d55f476a34683991d12b4529fb22f846bea Mon Sep 17 00:00:00 2001
From: Dan Kortschak <90160302+efd6@users.noreply.github.com>
Date: Wed, 16 Feb 2022 07:02:34 +1030
Subject: [PATCH] packetbeat/beater: make sure Npcap installation runs before
 interfaces are needed (#30396)

Previously installNpcap was run after Create, which depends on having interfaces up
to establish sniffers, and so was too late. So move the call to the front of Create
to ensure that the library is installed by the time that it is needed.
---
 CHANGELOG.next.asciidoc         | 2 +-
 packetbeat/beater/packetbeat.go | 6 ------
 packetbeat/beater/processor.go  | 6 ++++++
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index f30f71ad13f..08d1f908ed4 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -137,7 +137,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...main[Check the HEAD dif
 
 *Packetbeat*
 
-- Add automated OEM Npcap installation handling. {pull}29112[29112]
+- Add automated OEM Npcap installation handling. {pull}29112[29112] {pull}30396[30396]
 - Add support for capturing TLS random number and OCSP status request details. {issue}29962[29962] {pull}30102[30102]
 
 *Functionbeat*
diff --git a/packetbeat/beater/packetbeat.go b/packetbeat/beater/packetbeat.go
index 3a1f7d6c2d9..d72a98d4a5f 100644
--- a/packetbeat/beater/packetbeat.go
+++ b/packetbeat/beater/packetbeat.go
@@ -111,12 +111,6 @@ func (pb *packetbeat) Run(b *beat.Beat) error {
 		}
 	}()
 
-	// Install Npcap if needed.
-	err := installNpcap(b)
-	if err != nil {
-		return err
-	}
-
 	if !b.Manager.Enabled() {
 		return pb.runStatic(b, pb.factory)
 	}
diff --git a/packetbeat/beater/processor.go b/packetbeat/beater/processor.go
index a228c90ba09..e502b7d1078 100644
--- a/packetbeat/beater/processor.go
+++ b/packetbeat/beater/processor.go
@@ -113,6 +113,12 @@ func (p *processorFactory) Create(pipeline beat.PipelineConnector, cfg *common.C
 		return nil, err
 	}
 
+	// Install Npcap if needed.
+	err = installNpcap(p.beat)
+	if err != nil {
+		return nil, err
+	}
+
 	publisher, err := publish.NewTransactionPublisher(
 		p.beat.Info.Name,
 		p.beat.Publisher,