x-pack/filebeat/input/http_endpoint: fix request trace filename handling

The filename coming from integrations may include a * which is intended
to be replaced with the data stream ID. The code in place does not do
this, so add it.

CHANGELOG.next.asciidoc

@@ -144,6 +144,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Upgrade azure-event-hubs-go and azure-storage-blob-go dependencies. {pull}38861[38861]
 - Fix concurrency/error handling bugs in the AWS S3 input that could drop data and prevent ingestion of large buckets. {pull}39131[39131]
 - Fix EntraID query handling. {issue}39419[39419] {pull}39420[39420]
+- Fix request trace filename handling in http_endpoint input. {pull}39410[39410]
 
 *Heartbeat*
 

x-pack/filebeat/input/http_endpoint/input.go

@@ -16,7 +16,9 @@ import (
 	"net"
 	"net/http"
 	"net/url"
+	"path/filepath"
 	"reflect"
+	"strings"
 	"sync"
 	"time"
 
@@ -104,6 +106,11 @@ func (e *httpEndpoint) Run(ctx v2.Context, pipeline beat.Pipeline) error {
 	metrics := newInputMetrics(ctx.ID)
 	defer metrics.Close()
 
+	if e.config.Tracer != nil {
+		id := sanitizeFileName(ctx.ID)
+		e.config.Tracer.Filename = strings.ReplaceAll(e.config.Tracer.Filename, "*", id)
+	}
+
 	client, err := pipeline.ConnectWith(beat.ClientConfig{
 		EventListener: newEventACKHandler(),
 	})
@@ -119,6 +126,15 @@ func (e *httpEndpoint) Run(ctx v2.Context, pipeline beat.Pipeline) error {
 	return nil
 }
 
+// sanitizeFileName returns name with ":" and "/" replaced with "_", removing repeated instances.
+// The request.tracer.filename may have ":" when a http_endpoint input has cursor config and
+// the macOS Finder will treat this as path-separator and causes to show up strange filepaths.
+func sanitizeFileName(name string) string {
+	name = strings.ReplaceAll(name, ":", string(filepath.Separator))
+	name = filepath.Clean(name)
+	return strings.ReplaceAll(name, string(filepath.Separator), "_")
+}
+
 // servers is the package-level server pool.
 var servers = pool{servers: make(map[string]*server)}