From 6cb51d1173bcccaab69585f84524ea94b08ee2f2 Mon Sep 17 00:00:00 2001
From: Denis <denis.rechkunov@elastic.co>
Date: Tue, 18 Jul 2023 16:32:42 +0200
Subject: [PATCH] Fix the wrong event type for a new file (#36098)

It's supposed to emit a `create` event, not a `write` event when a
previously ignored empty file gets written to.

(cherry picked from commit f52d38ac56a752e6a22ef1ff423a990187b1d735)
---
 filebeat/input/filestream/fswatch.go      | 1 +
 filebeat/input/filestream/fswatch_test.go | 3 +--
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/filebeat/input/filestream/fswatch.go b/filebeat/input/filestream/fswatch.go
index 3203b90be1d..a7a5b9bd684 100644
--- a/filebeat/input/filestream/fswatch.go
+++ b/filebeat/input/filestream/fswatch.go
@@ -202,6 +202,7 @@ func (w *fileWatcher) watch(ctx unison.Canceler) {
 		// no need to react on empty new files
 		if fd.Info.Size() == 0 {
 			w.log.Warnf("file %q has no content yet, skipping", fd.Filename)
+			delete(paths, path)
 			continue
 		}
 		select {
diff --git a/filebeat/input/filestream/fswatch_test.go b/filebeat/input/filestream/fswatch_test.go
index 23e2af4bbd4..8326a1bdf04 100644
--- a/filebeat/input/filestream/fswatch_test.go
+++ b/filebeat/input/filestream/fswatch_test.go
@@ -295,8 +295,7 @@ scanner:
 			e := fw.Event()
 			expEvent := loginp.FSEvent{
 				NewPath: filename,
-				OldPath: filename,
-				Op:      loginp.OpWrite,
+				Op:      loginp.OpCreate,
 				Descriptor: loginp.FileDescriptor{
 					Filename: filename,
 					Info:     testFileInfo{path: basename, size: 5}, // +5 bytes appended