From 2a181e07a13c7dad805f69af27f34dc09a9b5467 Mon Sep 17 00:00:00 2001
From: Dan Kortschak <90160302+efd6@users.noreply.github.com>
Date: Sat, 19 Feb 2022 06:48:10 +1030
Subject: [PATCH] packetbeat/beater: make sure Npcap installation runs before
 interfaces are needed in all cases (#30438)

This is a second attempt to ensure that Npcap is correctly installed; running
packetbeat managed by elastic-agent appears to have a different code path to
that when running vanilla packetbeat and does not execute Create in time (at
all?) to have the installer run. So move the installNpcap call to the earliest
time we have all the needed information to ensure that the library is installed
by the time that it is needed.
---
 CHANGELOG.next.asciidoc         | 2 +-
 packetbeat/beater/packetbeat.go | 6 ++++++
 packetbeat/beater/processor.go  | 6 ------
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 33e96f14867..298f376bf42 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -138,7 +138,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...main[Check the HEAD dif
 
 *Packetbeat*
 
-- Add automated OEM Npcap installation handling. {pull}29112[29112] {pull}30396[30396]
+- Add automated OEM Npcap installation handling. {pull}29112[29112] {pull}30438[30438]
 - Add support for capturing TLS random number and OCSP status request details. {issue}29962[29962] {pull}30102[30102]
 
 *Functionbeat*
diff --git a/packetbeat/beater/packetbeat.go b/packetbeat/beater/packetbeat.go
index d72a98d4a5f..2bbc81cc001 100644
--- a/packetbeat/beater/packetbeat.go
+++ b/packetbeat/beater/packetbeat.go
@@ -95,6 +95,12 @@ func New(b *beat.Beat, rawConfig *common.Config) (beat.Beater, error) {
 		return nil, err
 	}
 
+	// Install Npcap if needed.
+	err := installNpcap(b)
+	if err != nil {
+		return nil, err
+	}
+
 	return &packetbeat{
 		config:  rawConfig,
 		factory: factory,
diff --git a/packetbeat/beater/processor.go b/packetbeat/beater/processor.go
index e502b7d1078..a228c90ba09 100644
--- a/packetbeat/beater/processor.go
+++ b/packetbeat/beater/processor.go
@@ -113,12 +113,6 @@ func (p *processorFactory) Create(pipeline beat.PipelineConnector, cfg *common.C
 		return nil, err
 	}
 
-	// Install Npcap if needed.
-	err = installNpcap(p.beat)
-	if err != nil {
-		return nil, err
-	}
-
 	publisher, err := publish.NewTransactionPublisher(
 		p.beat.Info.Name,
 		p.beat.Publisher,