diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index a1d49d7da28..48520f33b07 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -65,6 +65,34 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff] - Fixes "Can only start an input when all related states are finished" error when running under Elastic-Agent {pull}35250[35250] {issue}33653[33653] - [system] sync system/auth dataset with system integration 1.29.0. {pull}35581[35581] - [GCS Input] - Fixed an issue where bucket_timeout was being applied to the entire bucket poll interval and not individual bucket object read operations. Fixed a map write concurrency issue arising from data races when using a high number of workers. Fixed the flaky tests that were present in the GCS test suit. {pull}35605[35605] +- Fix filestream false positive log error "filestream input with ID 'xyz' already exists" {issue}31767[31767] +- Fix error message formatting from filestream input. {pull}35658[35658] +- Fix error when trying to use `include_message` parser {issue}35440[35440] +- Fix handling of IPv6 unspecified addresses in TCP input. {issue}35064[35064] {pull}35637[35637] +- Fixed a minor code error in the GCS input scheduler where a config value was being used directly instead of the source struct. {pull}35729[35729] +- Improve error reporting and fix IPv6 handling of TCP and UDP metric collection. {pull}35772[35772] +- Fix CEL input JSON marshalling of nested objects. {issue}35763[35763] {pull}35774[35774] +- Fix metric collection in GCPPubSub input. {pull}35773[35773] +- Fix end point deregistration in http_endpoint input. {issue}35899[35899] {pull}35903[35903] +- Fix duplicate ID panic in filestream metrics. {issue}35964[35964] {pull}35972[35972] +- Improve error reporting and fix IPv6 handling of TCP and UDP metric collection. {pull}35996[35996] +- Fix handling of NUL-terminated log lines in Fortinet Firewall module. {issue}36026[36026] {pull}36027[36027] +- Make redact field configuration recommended in CEL input and log warning if missing. {pull}36008[36008] +- Fix handling of region name configuration in awss3 input {pull}36034[36034] +- Fixed concurrency and flakey tests issue in azure blob storage input. {issue}35983[35983] {pull}36124[36124] +- Fix panic when sqs input metrics getter is invoked {pull}36101[36101] {issue}36077[36077] +- Make CEL input's `now` global variable static for evaluation lifetime. {pull}36107[36107] +- Update mito CEL extension library to v1.5.0. {pull}36146[36146] +- Filter out duplicate paths resolved from matching globs. {issue}36253[36253] {pull}36256[36256] +- Fix handling of TCP/UDP address resolution during metric initialization. {issue}35064[35064] {pull}36287[36287] +- Fix handling of Juniper SRX structured data when there is no leading junos element. {issue}36270[36270] {pull}36308[36308] +- Remove erroneous error log in GCPPubSub input. {pull}36296[36296] +- Fix Filebeat Cisco module with missing escape character {issue}36325[36325] {pull}36326[36326] +- Fix panic when redact option is not provided to CEL input. {issue}36387[36387] {pull}36388[36388] +- Remove 'onFilteredOut' and 'onDroppedOnPublish' callback logs {issue}36299[36299] {pull}36399[36399] +- Added a fix for Crowdstrike pipeline handling process arrays {pull}36496[36496] +- Ensure winlog input retains metric collection when handling recoverable errors. {issue}36479[36479] {pull}36483[36483] +- Revert error introduced in {pull}35734[35734] when symlinks can't be resolved in filestream. {pull}36557[36557] *Heartbeat* diff --git a/filebeat/input/filestream/fswatch.go b/filebeat/input/filestream/fswatch.go index 39d0275cfef..8986794340d 100644 --- a/filebeat/input/filestream/fswatch.go +++ b/filebeat/input/filestream/fswatch.go @@ -441,7 +441,8 @@ func (s *fileScanner) getIngestTarget(filename string) (it ingestTarget, err err it.originalFilename, err = filepath.EvalSymlinks(it.filename) if err != nil { - return it, fmt.Errorf("failed to resolve the symlink %q: %w", it.filename, err) + s.log.Debugf("finding path to original file has failed %s: %+v", it.filename, err) + it.originalFilename = it.filename } if s.isFileExcluded(it.originalFilename) {