From 6cb51d1173bcccaab69585f84524ea94b08ee2f2 Mon Sep 17 00:00:00 2001 From: Denis <denis.rechkunov@elastic.co> Date: Tue, 18 Jul 2023 16:32:42 +0200 Subject: [PATCH] Fix the wrong event type for a new file (#36098) It's supposed to emit a `create` event, not a `write` event when a previously ignored empty file gets written to. (cherry picked from commit f52d38ac56a752e6a22ef1ff423a990187b1d735) --- filebeat/input/filestream/fswatch.go | 1 + filebeat/input/filestream/fswatch_test.go | 3 +-- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/filebeat/input/filestream/fswatch.go b/filebeat/input/filestream/fswatch.go index 3203b90be1d..a7a5b9bd684 100644 --- a/filebeat/input/filestream/fswatch.go +++ b/filebeat/input/filestream/fswatch.go @@ -202,6 +202,7 @@ func (w *fileWatcher) watch(ctx unison.Canceler) { // no need to react on empty new files if fd.Info.Size() == 0 { w.log.Warnf("file %q has no content yet, skipping", fd.Filename) + delete(paths, path) continue } select { diff --git a/filebeat/input/filestream/fswatch_test.go b/filebeat/input/filestream/fswatch_test.go index 23e2af4bbd4..8326a1bdf04 100644 --- a/filebeat/input/filestream/fswatch_test.go +++ b/filebeat/input/filestream/fswatch_test.go @@ -295,8 +295,7 @@ scanner: e := fw.Event() expEvent := loginp.FSEvent{ NewPath: filename, - OldPath: filename, - Op: loginp.OpWrite, + Op: loginp.OpCreate, Descriptor: loginp.FileDescriptor{ Filename: filename, Info: testFileInfo{path: basename, size: 5}, // +5 bytes appended