From 3236fdc827550285657826ef5d8b35de49ac143d Mon Sep 17 00:00:00 2001
From: Dan Kortschak <dan.kortschak@elastic.co>
Date: Thu, 10 Feb 2022 11:22:35 +1030
Subject: [PATCH 1/4] mechanical replacement of github.com/pkg/error with
 standard library error handling

This is not completely automatable here due to some semantic differences between
errors.Wrap and fmt.Errorf with the %w verb; the latter will convert a nil error
into a non-nil error, so this must be guarded with a nil error check.

The mechanical transformation was done by running the following commands:
	gofmt -w -r 'errors.Errorf -> fmt.Errorf' .
	gofmt -w -r 'errors.Wrap(e, m) -> fmt.Errorf(m+": %w", e)' .
	gofmt -w -r 'errors.Wrapf(e, m) -> fmt.Errorf(m+": %w", e)' .
	gofmt -w -r 'errors.Wrapf(e, m, a) -> fmt.Errorf(m+": %w", a, e)' .
	gofmt -w -r 'errors.Wrapf(e, m, a, b) -> fmt.Errorf(m+": %w", a, b, e)' .
	gofmt -w -r 'errors.Wrapf(e, m, a, b, c) -> fmt.Errorf(m+": %w", a, b, c, e)' .
	find . -name '*.go' -exec gsed -i -e 's/"+": %w",/: %w",/g' '{}' \;
	find . -name '*.go' -exec gsed -i -e 's!"github.com/pkg/errors"$!"errors"!g' '{}' \;
	goimports -w .
	go mod tidy
	gofumpt -w .

Replaying that will give the changes here modulo some manual changes that are
made in the next commit. There should be no uses of %w in this change that are
not guarded by a nil-check.
---
 auditbeat/cmd/root.go                         |  2 +-
 auditbeat/datastore/datastore.go              |  2 +-
 auditbeat/helper/hasher/hasher.go             | 19 ++++---
 auditbeat/helper/hasher/hasher_test.go        |  5 +-
 auditbeat/module/auditd/audit_linux.go        | 50 +++++++++----------
 auditbeat/module/auditd/audit_linux_test.go   |  2 +-
 auditbeat/module/auditd/audit_unsupported.go  |  4 +-
 auditbeat/module/auditd/config_linux.go       | 13 +++--
 auditbeat/module/auditd/config_linux_test.go  |  2 +-
 auditbeat/module/auditd/golden_files_test.go  | 20 ++++----
 auditbeat/module/auditd/show_linux.go         |  9 ++--
 auditbeat/module/file_integrity/config.go     |  6 +--
 auditbeat/module/file_integrity/event.go      |  7 ++-
 auditbeat/module/file_integrity/event_test.go |  4 +-
 .../file_integrity/eventreader_fsevents.go    |  4 +-
 .../file_integrity/eventreader_fsnotify.go    |  4 +-
 .../module/file_integrity/eventreader_test.go | 13 +++--
 .../file_integrity/eventreader_unsupported.go |  2 +-
 .../module/file_integrity/fileinfo_posix.go   |  4 +-
 .../module/file_integrity/fileinfo_test.go    |  8 +--
 .../module/file_integrity/fileinfo_windows.go | 12 ++---
 .../file_integrity/fileorigin_darwin.go       |  7 +--
 .../module/file_integrity/flatbuffers.go      |  4 +-
 auditbeat/module/file_integrity/metricset.go  | 16 +++---
 .../module/file_integrity/metricset_test.go   | 16 +++---
 auditbeat/module/file_integrity/mime_test.go  |  2 +-
 .../module/file_integrity/monitor/filetree.go |  6 +--
 .../file_integrity/monitor/filetree_test.go   | 45 +++++++++++------
 .../file_integrity/monitor/monitor_test.go    | 20 ++++----
 .../file_integrity/monitor/recursive.go       | 18 +++----
 .../module/file_integrity/scanner_test.go     |  8 +--
 auditbeat/scripts/mage/config.go              |  9 ++--
 auditbeat/scripts/mage/docs.go                |  6 +--
 auditbeat/scripts/mage/package.go             | 15 +++---
 x-pack/auditbeat/module/system/host/host.go   | 15 +++---
 x-pack/auditbeat/module/system/login/login.go |  6 +--
 .../module/system/login/login_test.go         |  3 +-
 x-pack/auditbeat/module/system/login/utmp.go  | 41 ++++++++-------
 .../module/system/package/package.go          | 37 +++++++-------
 .../module/system/package/package_homebrew.go | 13 +++--
 .../module/system/package/package_test.go     |  2 +-
 .../module/system/package/rpm_linux.go        |  6 +--
 .../module/system/package/rpm_others.go       |  2 +-
 .../module/system/process/namepace_linux.go   |  3 +-
 .../module/system/process/process.go          | 25 ++++------
 .../system/socket/dns/afpacket/afpacket.go    | 13 ++---
 .../auditbeat/module/system/socket/dns/dns.go |  5 +-
 .../module/system/socket/guess/cskxmit6.go    | 17 +++----
 .../module/system/socket/guess/guess.go       | 23 ++++-----
 .../module/system/socket/guess/helpers.go     | 14 +++---
 .../module/system/socket/guess/inetsock.go    | 11 ++--
 .../module/system/socket/guess/inetsock6.go   | 17 +++----
 .../module/system/socket/guess/inetsockaf.go  |  3 +-
 .../module/system/socket/guess/skbuff.go      | 28 +++++------
 .../module/system/socket/guess/sockaddrin.go  |  8 +--
 .../module/system/socket/guess/sockaddrin6.go | 18 +++----
 .../module/system/socket/helper/loopback.go   | 13 ++---
 .../auditbeat/module/system/socket/kprobes.go | 25 +++++-----
 .../module/system/socket/socket_linux.go      | 24 ++++-----
 .../auditbeat/module/system/socket/state.go   |  9 ++--
 .../module/system/socket/state_test.go        |  4 +-
 x-pack/auditbeat/module/system/user/user.go   | 23 ++++-----
 .../auditbeat/module/system/user/user_test.go |  4 +-
 .../module/system/user/users_linux.go         | 14 +++---
 x-pack/auditbeat/tracing/cpu.go               |  7 ++-
 x-pack/auditbeat/tracing/events_test.go       | 12 ++---
 x-pack/auditbeat/tracing/perfevent.go         | 16 +++---
 67 files changed, 407 insertions(+), 418 deletions(-)

diff --git a/auditbeat/cmd/root.go b/auditbeat/cmd/root.go
index aa5b523e9768..79c74cf02799 100644
--- a/auditbeat/cmd/root.go
+++ b/auditbeat/cmd/root.go
@@ -54,7 +54,7 @@ var withECSVersion = processing.WithFields(common.MapStr{
 
 // AuditbeatSettings contains the default settings for auditbeat
 func AuditbeatSettings() instance.Settings {
-	var runFlags = pflag.NewFlagSet(Name, pflag.ExitOnError)
+	runFlags := pflag.NewFlagSet(Name, pflag.ExitOnError)
 	return instance.Settings{
 		RunFlags:      runFlags,
 		Name:          Name,
diff --git a/auditbeat/datastore/datastore.go b/auditbeat/datastore/datastore.go
index d3cc9966f3f0..57b2f379f0b0 100644
--- a/auditbeat/datastore/datastore.go
+++ b/auditbeat/datastore/datastore.go
@@ -39,7 +39,7 @@ func OpenBucket(name string) (Bucket, error) {
 	initDatastoreOnce.Do(func() {
 		ds = &boltDatastore{
 			path: paths.Resolve(paths.Data, "beat.db"),
-			mode: 0600,
+			mode: 0o600,
 		}
 	})
 
diff --git a/auditbeat/helper/hasher/hasher.go b/auditbeat/helper/hasher/hasher.go
index cc4c928867e8..8bec9e1d2533 100644
--- a/auditbeat/helper/hasher/hasher.go
+++ b/auditbeat/helper/hasher/hasher.go
@@ -33,7 +33,6 @@ import (
 	"github.com/cespare/xxhash/v2"
 	"github.com/dustin/go-humanize"
 	"github.com/joeshaw/multierror"
-	"github.com/pkg/errors"
 	"golang.org/x/crypto/blake2b"
 	"golang.org/x/crypto/sha3"
 	"golang.org/x/time/rate"
@@ -143,7 +142,7 @@ func (c *Config) Validate() error {
 
 	for _, ht := range c.HashTypes {
 		if !ht.IsValid() {
-			errs = append(errs, errors.Errorf("invalid hash_types value '%v'", ht))
+			errs = append(errs, fmt.Errorf("invalid hash_types value '%v'", ht))
 		}
 	}
 
@@ -151,14 +150,14 @@ func (c *Config) Validate() error {
 
 	c.MaxFileSizeBytes, err = humanize.ParseBytes(c.MaxFileSize)
 	if err != nil {
-		errs = append(errs, errors.Wrap(err, "invalid max_file_size value"))
+		errs = append(errs, fmt.Errorf("invalid max_file_size value: %w", err))
 	} else if c.MaxFileSizeBytes <= 0 {
-		errs = append(errs, errors.Errorf("max_file_size value (%v) must be positive", c.MaxFileSize))
+		errs = append(errs, fmt.Errorf("max_file_size value (%v) must be positive", c.MaxFileSize))
 	}
 
 	c.ScanRateBytesPerSec, err = humanize.ParseBytes(c.ScanRatePerSec)
 	if err != nil {
-		errs = append(errs, errors.Wrap(err, "invalid scan_rate_per_sec value"))
+		errs = append(errs, fmt.Errorf("invalid scan_rate_per_sec value: %w", err))
 	}
 
 	return errs.Err()
@@ -189,14 +188,14 @@ func NewFileHasher(c Config, done <-chan struct{}) (*FileHasher, error) {
 func (hasher *FileHasher) HashFile(path string) (map[HashType]Digest, error) {
 	info, err := os.Stat(path)
 	if err != nil {
-		return nil, errors.Wrapf(err, "failed to stat file %v", path)
+		return nil, fmt.Errorf("failed to stat file %v: %w", path, err)
 	}
 
 	// Throttle reading and hashing rate.
 	if len(hasher.config.HashTypes) > 0 {
 		err = hasher.throttle(info.Size())
 		if err != nil {
-			return nil, errors.Wrapf(err, "failed to hash file %v", path)
+			return nil, fmt.Errorf("failed to hash file %v: %w", path, err)
 		}
 	}
 
@@ -204,7 +203,7 @@ func (hasher *FileHasher) HashFile(path string) (map[HashType]Digest, error) {
 	for _, hashType := range hasher.config.HashTypes {
 		h, valid := validHashes[hashType]
 		if !valid {
-			return nil, errors.Errorf("unknown hash type '%v'", hashType)
+			return nil, fmt.Errorf("unknown hash type '%v'", hashType)
 		}
 
 		hashes = append(hashes, h())
@@ -213,13 +212,13 @@ func (hasher *FileHasher) HashFile(path string) (map[HashType]Digest, error) {
 	if len(hashes) > 0 {
 		f, err := file.ReadOpen(path)
 		if err != nil {
-			return nil, errors.Wrap(err, "failed to open file for hashing")
+			return nil, fmt.Errorf("failed to open file for hashing: %w", err)
 		}
 		defer f.Close()
 
 		hashWriter := multiWriter(hashes)
 		if _, err := io.Copy(hashWriter, f); err != nil {
-			return nil, errors.Wrap(err, "failed to calculate file hashes")
+			return nil, fmt.Errorf("failed to calculate file hashes: %w", err)
 		}
 
 		nameToHash := make(map[HashType]Digest, len(hashes))
diff --git a/auditbeat/helper/hasher/hasher_test.go b/auditbeat/helper/hasher/hasher_test.go
index c9d781b35a42..67c02de81ddf 100644
--- a/auditbeat/helper/hasher/hasher_test.go
+++ b/auditbeat/helper/hasher/hasher_test.go
@@ -23,7 +23,6 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/pkg/errors"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -35,7 +34,7 @@ func TestHasher(t *testing.T) {
 	defer os.RemoveAll(dir)
 
 	file := filepath.Join(dir, "exe")
-	if err = ioutil.WriteFile(file, []byte("test exe\n"), 0600); err != nil {
+	if err = ioutil.WriteFile(file, []byte("test exe\n"), 0o600); err != nil {
 		t.Fatal(err)
 	}
 
@@ -69,7 +68,7 @@ func TestHasherLimits(t *testing.T) {
 	defer os.RemoveAll(dir)
 
 	file := filepath.Join(dir, "exe")
-	if err = ioutil.WriteFile(file, []byte("test exe\n"), 0600); err != nil {
+	if err = ioutil.WriteFile(file, []byte("test exe\n"), 0o600); err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/auditbeat/module/auditd/audit_linux.go b/auditbeat/module/auditd/audit_linux.go
index 82ae7d611286..1ac11f97dd4d 100644
--- a/auditbeat/module/auditd/audit_linux.go
+++ b/auditbeat/module/auditd/audit_linux.go
@@ -18,6 +18,7 @@
 package auditd
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"runtime"
@@ -27,8 +28,6 @@ import (
 	"syscall"
 	"time"
 
-	"github.com/pkg/errors"
-
 	"github.com/elastic/beats/v7/libbeat/common"
 	"github.com/elastic/beats/v7/libbeat/logp"
 	"github.com/elastic/beats/v7/libbeat/monitoring"
@@ -99,7 +98,7 @@ type MetricSet struct {
 func New(base mb.BaseMetricSet) (mb.MetricSet, error) {
 	config := defaultConfig
 	if err := base.Module().UnpackConfig(&config); err != nil {
-		return nil, errors.Wrap(err, "failed to unpack the auditd config")
+		return nil, fmt.Errorf("failed to unpack the auditd config: %w", err)
 	}
 
 	log := logp.NewLogger(moduleName)
@@ -108,7 +107,7 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) {
 
 	client, err := newAuditClient(&config, log)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to create audit client")
+		return nil, fmt.Errorf("failed to create audit client: %w", err)
 	}
 
 	reassemblerGapsMetric.Set(0)
@@ -255,7 +254,7 @@ func (ms *MetricSet) addRules(reporter mb.PushReporterV2) error {
 
 	client, err := libaudit.NewAuditClient(nil)
 	if err != nil {
-		return errors.Wrap(err, "failed to create audit client for adding rules")
+		return fmt.Errorf("failed to create audit client for adding rules: %w", err)
 	}
 	defer closeAuditClient(client)
 
@@ -263,7 +262,7 @@ func (ms *MetricSet) addRules(reporter mb.PushReporterV2) error {
 	// Will result in EPERM.
 	status, err := client.GetStatus()
 	if err != nil {
-		err = errors.Wrap(err, "failed to get audit status before adding rules")
+		err = fmt.Errorf("failed to get audit status before adding rules: %w", err)
 		reporter.Error(err)
 		return err
 	}
@@ -274,7 +273,7 @@ func (ms *MetricSet) addRules(reporter mb.PushReporterV2) error {
 	// Delete existing rules.
 	n, err := client.DeleteRules()
 	if err != nil {
-		return errors.Wrap(err, "failed to delete existing rules")
+		return fmt.Errorf("failed to delete existing rules: %w", err)
 	}
 	ms.log.Infof("Deleted %v pre-existing audit rules.", n)
 
@@ -289,7 +288,7 @@ func (ms *MetricSet) addRules(reporter mb.PushReporterV2) error {
 	for _, rule := range rules {
 		if err = client.AddRule(rule.data); err != nil {
 			// Treat rule add errors as warnings and continue.
-			err = errors.Wrapf(err, "failed to add audit rule '%v'", rule.flags)
+			err = fmt.Errorf("failed to add audit rule '%v': %w", rule.flags, err)
 			reporter.Error(err)
 			ms.log.Warnw("Failure adding audit rule", "error", err)
 			failCount++
@@ -314,7 +313,7 @@ func (ms *MetricSet) initClient() error {
 	// process be in initial PID namespace).
 	status, err := ms.client.GetStatus()
 	if err != nil {
-		return errors.Wrap(err, "failed to get audit status")
+		return fmt.Errorf("failed to get audit status: %w", err)
 	}
 	ms.kernelLost.enabled = true
 	ms.kernelLost.counter = status.Lost
@@ -327,13 +326,13 @@ func (ms *MetricSet) initClient() error {
 
 	if fm, _ := ms.config.failureMode(); status.Failure != fm {
 		if err = ms.client.SetFailure(libaudit.FailureMode(fm), libaudit.NoWait); err != nil {
-			return errors.Wrap(err, "failed to set audit failure mode in kernel")
+			return fmt.Errorf("failed to set audit failure mode in kernel: %w", err)
 		}
 	}
 
 	if status.BacklogLimit != ms.config.BacklogLimit {
 		if err = ms.client.SetBacklogLimit(ms.config.BacklogLimit, libaudit.NoWait); err != nil {
-			return errors.Wrap(err, "failed to set audit backlog limit in kernel")
+			return fmt.Errorf("failed to set audit backlog limit in kernel: %w", err)
 		}
 	}
 
@@ -345,7 +344,7 @@ func (ms *MetricSet) initClient() error {
 		if status.FeatureBitmap&libaudit.AuditFeatureBitmapBacklogWaitTime != 0 {
 			ms.log.Info("Setting kernel backlog wait time to prevent backpressure propagating to the kernel.")
 			if err = ms.client.SetBacklogWaitTime(0, libaudit.NoWait); err != nil {
-				return errors.Wrap(err, "failed to set audit backlog wait time in kernel")
+				return fmt.Errorf("failed to set audit backlog wait time in kernel: %w", err)
 			}
 		} else {
 			if ms.backpressureStrategy == bsAuto {
@@ -365,38 +364,38 @@ func (ms *MetricSet) initClient() error {
 
 	if status.RateLimit != ms.config.RateLimit {
 		if err = ms.client.SetRateLimit(ms.config.RateLimit, libaudit.NoWait); err != nil {
-			return errors.Wrap(err, "failed to set audit rate limit in kernel")
+			return fmt.Errorf("failed to set audit rate limit in kernel: %w", err)
 		}
 	}
 
 	if status.Enabled == 0 {
 		if err = ms.client.SetEnabled(true, libaudit.NoWait); err != nil {
-			return errors.Wrap(err, "failed to enable auditing in the kernel")
+			return fmt.Errorf("failed to enable auditing in the kernel: %w", err)
 		}
 	}
 
 	if err := ms.client.WaitForPendingACKs(); err != nil {
-		return errors.Wrap(err, "failed to wait for ACKs")
+		return fmt.Errorf("failed to wait for ACKs: %w", err)
 	}
 
 	if err := ms.setPID(setPIDMaxRetries); err != nil {
 		if errno, ok := err.(syscall.Errno); ok && errno == syscall.EEXIST && status.PID != 0 {
 			return fmt.Errorf("failed to set audit PID. An audit process is already running (PID %d)", status.PID)
 		}
-		return errors.Wrapf(err, "failed to set audit PID (current audit PID %d)", status.PID)
+		return fmt.Errorf("failed to set audit PID (current audit PID %d): %w", status.PID, err)
 	}
 	return nil
 }
 
 func (ms *MetricSet) setPID(retries int) (err error) {
-	if err = ms.client.SetPID(libaudit.WaitForReply); err == nil || errors.Cause(err) != syscall.ENOBUFS || retries == 0 {
+	if err = ms.client.SetPID(libaudit.WaitForReply); err == nil || !errors.Is(err, syscall.ENOBUFS) || retries == 0 {
 		return err
 	}
 	// At this point the netlink channel is congested (ENOBUFS).
 	// Drain and close the client, then retry with a new client.
 	closeAuditClient(ms.client)
 	if ms.client, err = newAuditClient(&ms.config, ms.log); err != nil {
-		return errors.Wrapf(err, "failed to recover from ENOBUFS")
+		return fmt.Errorf("failed to recover from ENOBUFS: %w", err)
 	}
 	ms.log.Info("Recovering from ENOBUFS ...")
 	return ms.setPID(retries - 1)
@@ -438,7 +437,7 @@ func (ms *MetricSet) receiveEvents(done <-chan struct{}) (<-chan []*auparse.Audi
 	}
 	reassembler, err := libaudit.NewReassembler(int(ms.config.ReassemblerMaxInFlight), ms.config.ReassemblerTimeout, st)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to create Reassembler")
+		return nil, fmt.Errorf("failed to create Reassembler: %w", err)
 	}
 	go maintain(done, reassembler)
 
@@ -450,7 +449,7 @@ func (ms *MetricSet) receiveEvents(done <-chan struct{}) (<-chan []*auparse.Audi
 		for {
 			raw, err := ms.client.Receive(false)
 			if err != nil {
-				if errors.Cause(err) == syscall.EBADF {
+				if errors.Is(err, syscall.EBADF) {
 					// Client has been closed.
 					break
 				}
@@ -941,17 +940,17 @@ func kernelVersion() (major, minor int, full string, err error) {
 	release := string(data[:length])
 	parts := strings.SplitN(release, ".", 3)
 	if len(parts) < 2 {
-		return 0, 0, release, errors.Errorf("failed to parse uname release '%v'", release)
+		return 0, 0, release, fmt.Errorf("failed to parse uname release '%v'", release)
 	}
 
 	major, err = strconv.Atoi(parts[0])
 	if err != nil {
-		return 0, 0, release, errors.Wrapf(err, "failed to parse major version from '%v'", release)
+		return 0, 0, release, fmt.Errorf("failed to parse major version from '%v': %w", release, err)
 	}
 
 	minor, err = strconv.Atoi(parts[1])
 	if err != nil {
-		return 0, 0, release, errors.Wrapf(err, "failed to parse minor version from '%v'", release)
+		return 0, 0, release, fmt.Errorf("failed to parse minor version from '%v': %w", release, err)
 	}
 
 	return major, minor, release, nil
@@ -961,7 +960,7 @@ func determineSocketType(c *Config, log *logp.Logger) (string, error) {
 	client, err := libaudit.NewAuditClient(nil)
 	if err != nil {
 		if c.SocketType == "" {
-			return "", errors.Wrap(err, "failed to create audit client")
+			return "", fmt.Errorf("failed to create audit client: %w", err)
 		}
 		// Ignore errors if a socket type has been specified. It will fail during
 		// further setup and its necessary for unit tests to pass
@@ -971,7 +970,7 @@ func determineSocketType(c *Config, log *logp.Logger) (string, error) {
 	status, err := client.GetStatus()
 	if err != nil {
 		if c.SocketType == "" {
-			return "", errors.Wrap(err, "failed to get audit status")
+			return "", fmt.Errorf("failed to get audit status: %w", err)
 		}
 		return c.SocketType, nil
 	}
@@ -1031,7 +1030,6 @@ func determineSocketType(c *Config, log *logp.Logger) (string, error) {
 		}
 		return unicast, nil
 	}
-
 }
 
 func getBackpressureStrategy(value string, logger *logp.Logger) backpressureStrategy {
diff --git a/auditbeat/module/auditd/audit_linux_test.go b/auditbeat/module/auditd/audit_linux_test.go
index 38a3491fbf93..437acd6df55e 100644
--- a/auditbeat/module/auditd/audit_linux_test.go
+++ b/auditbeat/module/auditd/audit_linux_test.go
@@ -329,7 +329,7 @@ func buildSampleEvent(t testing.TB, lines []string, filename string) {
 		t.Fatal(err)
 	}
 
-	if err := ioutil.WriteFile(filename, output, 0644); err != nil {
+	if err := ioutil.WriteFile(filename, output, 0o644); err != nil {
 		t.Fatal(err)
 	}
 }
diff --git a/auditbeat/module/auditd/audit_unsupported.go b/auditbeat/module/auditd/audit_unsupported.go
index 95aeccbec145..40c9db3bd78a 100644
--- a/auditbeat/module/auditd/audit_unsupported.go
+++ b/auditbeat/module/auditd/audit_unsupported.go
@@ -21,7 +21,7 @@
 package auditd
 
 import (
-	"github.com/pkg/errors"
+	"fmt"
 
 	"github.com/elastic/beats/v7/metricbeat/mb"
 	"github.com/elastic/beats/v7/metricbeat/mb/parse"
@@ -36,5 +36,5 @@ func init() {
 
 // New constructs a new MetricSet.
 func New(base mb.BaseMetricSet) (mb.MetricSet, error) {
-	return nil, errors.Errorf("the %v module is only supported on Linux", metricsetName)
+	return nil, fmt.Errorf("the %v module is only supported on Linux", metricsetName)
 }
diff --git a/auditbeat/module/auditd/config_linux.go b/auditbeat/module/auditd/config_linux.go
index d0d90e86c44d..ffcf9a463f65 100644
--- a/auditbeat/module/auditd/config_linux.go
+++ b/auditbeat/module/auditd/config_linux.go
@@ -29,7 +29,6 @@ import (
 	"time"
 
 	"github.com/joeshaw/multierror"
-	"github.com/pkg/errors"
 
 	"github.com/elastic/go-libaudit/v2/rule"
 	"github.com/elastic/go-libaudit/v2/rule/flags"
@@ -102,7 +101,7 @@ func (c *Config) Validate() error {
 	switch c.SocketType {
 	case "", "unicast", "multicast":
 	default:
-		errs = append(errs, errors.Errorf("invalid socket_type "+
+		errs = append(errs, fmt.Errorf("invalid socket_type "+
 			"'%v' (use unicast, multicast, or don't set a value)", c.SocketType))
 	}
 
@@ -161,7 +160,7 @@ func (c Config) failureMode() (uint32, error) {
 	case "panic":
 		return 2, nil
 	default:
-		return 0, errors.Errorf("invalid failure_mode '%v' (use silent, log, or panic)", c.FailureMode)
+		return 0, fmt.Errorf("invalid failure_mode '%v' (use silent, log, or panic)", c.FailureMode)
 	}
 }
 
@@ -179,21 +178,21 @@ func readRules(reader io.Reader, source string, knownRules ruleSet) (rules []aud
 		// Parse the CLI flags into an intermediate rule specification.
 		r, err := flags.Parse(line)
 		if err != nil {
-			errs = append(errs, errors.Wrapf(err, "at %s: failed to parse rule '%v'", location, line))
+			errs = append(errs, fmt.Errorf("at %s: failed to parse rule '%v': %w", location, line, err))
 			continue
 		}
 
 		// Convert rule specification to a binary rule representation.
 		data, err := rule.Build(r)
 		if err != nil {
-			errs = append(errs, errors.Wrapf(err, "at %s: failed to interpret rule '%v'", location, line))
+			errs = append(errs, fmt.Errorf("at %s: failed to interpret rule '%v': %w", location, line, err))
 			continue
 		}
 
 		// Detect duplicates based on the normalized binary rule representation.
 		existing, found := knownRules[string(data)]
 		if found {
-			errs = append(errs, errors.Errorf("at %s: rule '%v' is a duplicate of '%v' at %s", location, line, existing.rule.flags, existing.source))
+			errs = append(errs, fmt.Errorf("at %s: rule '%v' is a duplicate of '%v' at %s", location, line, existing.rule.flags, existing.source))
 			continue
 		}
 		rule := auditRule{flags: line, data: []byte(data)}
@@ -203,7 +202,7 @@ func readRules(reader io.Reader, source string, knownRules ruleSet) (rules []aud
 	}
 
 	if len(errs) > 0 {
-		return nil, errors.Wrap(errs.Err(), "failed loading rules")
+		return nil, fmt.Errorf("failed loading rules: %w", errs.Err())
 	}
 	return rules, nil
 }
diff --git a/auditbeat/module/auditd/config_linux_test.go b/auditbeat/module/auditd/config_linux_test.go
index 8d677fdfcb73..6d8e913cf4e2 100644
--- a/auditbeat/module/auditd/config_linux_test.go
+++ b/auditbeat/module/auditd/config_linux_test.go
@@ -94,7 +94,7 @@ func TestConfigValidateConnectionType(t *testing.T) {
 }
 
 func TestConfigRuleOrdering(t *testing.T) {
-	const fileMode = 0644
+	const fileMode = 0o644
 	config := defaultConfig
 	config.RulesBlob = strings.Join([]string{
 		makeRuleFlags(0, 0),
diff --git a/auditbeat/module/auditd/golden_files_test.go b/auditbeat/module/auditd/golden_files_test.go
index 79bf4a85546f..47e99cf6b5eb 100644
--- a/auditbeat/module/auditd/golden_files_test.go
+++ b/auditbeat/module/auditd/golden_files_test.go
@@ -124,14 +124,16 @@ func configForGolden() map[string]interface{} {
 	}
 }
 
-type TerminateFn func(mb.Event) bool
-type terminableReporter struct {
-	events []mb.Event
-	ctx    context.Context
-	cancel context.CancelFunc
-	err    error
-	isLast TerminateFn
-}
+type (
+	TerminateFn        func(mb.Event) bool
+	terminableReporter struct {
+		events []mb.Event
+		ctx    context.Context
+		cancel context.CancelFunc
+		err    error
+		isLast TerminateFn
+	}
+)
 
 func (r *terminableReporter) Event(event mb.Event) bool {
 	if r.ctx.Err() != nil {
@@ -215,7 +217,7 @@ func TestGoldenFiles(t *testing.T) {
 				if err != nil {
 					t.Fatal(err)
 				}
-				if err = ioutil.WriteFile(goldenPath, data, 0644); err != nil {
+				if err = ioutil.WriteFile(goldenPath, data, 0o644); err != nil {
 					t.Fatalf("failed writing golden file '%s': %v", goldenPath, err)
 				}
 			}
diff --git a/auditbeat/module/auditd/show_linux.go b/auditbeat/module/auditd/show_linux.go
index 856697086ab6..efc8f8b623a4 100644
--- a/auditbeat/module/auditd/show_linux.go
+++ b/auditbeat/module/auditd/show_linux.go
@@ -21,7 +21,6 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
 
 	"github.com/elastic/go-libaudit/v2"
@@ -69,13 +68,13 @@ func init() {
 func showAuditdRules() error {
 	client, err := libaudit.NewAuditClient(nil)
 	if err != nil {
-		return errors.Wrap(err, "failed to create audit client")
+		return fmt.Errorf("failed to create audit client: %w", err)
 	}
 	defer client.Close()
 
 	rules, err := client.GetRules()
 	if err != nil {
-		return errors.Wrap(err, "failed to list existing rules")
+		return fmt.Errorf("failed to list existing rules: %w", err)
 	}
 
 	for idx, raw := range rules {
@@ -96,13 +95,13 @@ func showAuditdRules() error {
 func showAuditdStatus() error {
 	client, err := libaudit.NewAuditClient(nil)
 	if err != nil {
-		return errors.Wrap(err, "failed to create audit client")
+		return fmt.Errorf("failed to create audit client: %w", err)
 	}
 	defer client.Close()
 
 	status, err := client.GetStatus()
 	if err != nil {
-		return errors.Wrap(err, "failed to get audit status")
+		return fmt.Errorf("failed to get audit status: %w", err)
 	}
 
 	if status.FeatureBitmap == libaudit.AuditFeatureBitmapBacklogWaitTime {
diff --git a/auditbeat/module/file_integrity/config.go b/auditbeat/module/file_integrity/config.go
index 39882fe3e0f7..6fa67303e367 100644
--- a/auditbeat/module/file_integrity/config.go
+++ b/auditbeat/module/file_integrity/config.go
@@ -18,6 +18,7 @@
 package file_integrity
 
 import (
+	"fmt"
 	"math"
 	"path/filepath"
 	"sort"
@@ -25,7 +26,6 @@ import (
 
 	"github.com/dustin/go-humanize"
 	"github.com/joeshaw/multierror"
-	"github.com/pkg/errors"
 
 	"github.com/elastic/beats/v7/libbeat/common/match"
 )
@@ -110,7 +110,7 @@ nextHash:
 				continue nextHash
 			}
 		}
-		errs = append(errs, errors.Errorf("invalid hash_types value '%v'", ht))
+		errs = append(errs, fmt.Errorf("invalid hash_types value '%v'", ht))
 	}
 
 	c.MaxFileSizeBytes, err = humanize.ParseBytes(c.MaxFileSize)
@@ -122,7 +122,7 @@ nextHash:
 
 	c.ScanRateBytesPerSec, err = humanize.ParseBytes(c.ScanRatePerSec)
 	if err != nil {
-		errs = append(errs, errors.Wrap(err, "invalid scan_rate_per_sec value"))
+		errs = append(errs, fmt.Errorf("invalid scan_rate_per_sec value: %w", err))
 	}
 	return errs.Err()
 }
diff --git a/auditbeat/module/file_integrity/event.go b/auditbeat/module/file_integrity/event.go
index 1bfc807dfa6d..aa4123c2b1f4 100644
--- a/auditbeat/module/file_integrity/event.go
+++ b/auditbeat/module/file_integrity/event.go
@@ -36,7 +36,6 @@ import (
 	"time"
 
 	"github.com/cespare/xxhash/v2"
-	"github.com/pkg/errors"
 	"golang.org/x/crypto/blake2b"
 	"golang.org/x/crypto/sha3"
 
@@ -449,13 +448,13 @@ func hashFile(name string, maxSize uint64, hashType ...HashType) (nameToHash map
 		case XXH64:
 			hashes = append(hashes, xxhash.New())
 		default:
-			return nil, 0, errors.Errorf("unknown hash type '%v'", name)
+			return nil, 0, fmt.Errorf("unknown hash type '%v'", name)
 		}
 	}
 
 	f, err := file.ReadOpen(name)
 	if err != nil {
-		return nil, 0, errors.Wrap(err, "failed to open file for hashing")
+		return nil, 0, fmt.Errorf("failed to open file for hashing: %w", err)
 	}
 	defer f.Close()
 
@@ -469,7 +468,7 @@ func hashFile(name string, maxSize uint64, hashType ...HashType) (nameToHash map
 	}
 	written, err := io.Copy(hashWriter, r)
 	if err != nil {
-		return nil, 0, errors.Wrap(err, "failed to calculate file hashes")
+		return nil, 0, fmt.Errorf("failed to calculate file hashes: %w", err)
 	}
 
 	// The file grew larger than configured limit.
diff --git a/auditbeat/module/file_integrity/event_test.go b/auditbeat/module/file_integrity/event_test.go
index de14b3e2d13b..b45bd4895fc7 100644
--- a/auditbeat/module/file_integrity/event_test.go
+++ b/auditbeat/module/file_integrity/event_test.go
@@ -47,7 +47,7 @@ func testEvent() *Event {
 			Inode:  123,
 			UID:    500,
 			GID:    500,
-			Mode:   0600,
+			Mode:   0o600,
 			CTime:  testEventTime,
 			MTime:  testEventTime,
 			SetGID: true,
@@ -94,7 +94,7 @@ func TestDiffEvents(t *testing.T) {
 
 	t.Run("updated metadata", func(t *testing.T) {
 		e := testEvent()
-		e.Info.Mode = 0644
+		e.Info.Mode = 0o644
 
 		action, changed := diffEvents(testEvent(), e)
 		assert.True(t, changed)
diff --git a/auditbeat/module/file_integrity/eventreader_fsevents.go b/auditbeat/module/file_integrity/eventreader_fsevents.go
index 7dc7b0975afb..ac4309da53e4 100644
--- a/auditbeat/module/file_integrity/eventreader_fsevents.go
+++ b/auditbeat/module/file_integrity/eventreader_fsevents.go
@@ -21,13 +21,13 @@
 package file_integrity
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
 	"time"
 
 	"github.com/fsnotify/fsevents"
-	"github.com/pkg/errors"
 
 	"github.com/elastic/beats/v7/libbeat/logp"
 )
@@ -204,7 +204,7 @@ func getFileInfo(path string) (os.FileInfo, error) {
 		path = resolved
 	}
 	info, err := os.Lstat(path)
-	return info, errors.Wrap(err, "failed to stat")
+	return info, fmt.Errorf("failed to stat: %w", err)
 }
 
 func (r *fsreader) isWatched(path string) bool {
diff --git a/auditbeat/module/file_integrity/eventreader_fsnotify.go b/auditbeat/module/file_integrity/eventreader_fsnotify.go
index 7f3de5beb990..59aa48a029b6 100644
--- a/auditbeat/module/file_integrity/eventreader_fsnotify.go
+++ b/auditbeat/module/file_integrity/eventreader_fsnotify.go
@@ -21,12 +21,12 @@
 package file_integrity
 
 import (
+	"fmt"
 	"path/filepath"
 	"syscall"
 	"time"
 
 	"github.com/fsnotify/fsnotify"
-	"github.com/pkg/errors"
 
 	"github.com/elastic/beats/v7/auditbeat/module/file_integrity/monitor"
 	"github.com/elastic/beats/v7/libbeat/logp"
@@ -57,7 +57,7 @@ func (r *reader) Start(done <-chan struct{}) (<-chan Event, error) {
 	if err := r.watcher.Start(); err != nil {
 		// Ensure that watcher is closed so that we don't leak watchers
 		r.watcher.Close()
-		return nil, errors.Wrap(err, "unable to start watcher")
+		return nil, fmt.Errorf("unable to start watcher: %w", err)
 	}
 
 	queueDone := make(chan struct{})
diff --git a/auditbeat/module/file_integrity/eventreader_test.go b/auditbeat/module/file_integrity/eventreader_test.go
index 53db8b28c3e2..6caaa3a05510 100644
--- a/auditbeat/module/file_integrity/eventreader_test.go
+++ b/auditbeat/module/file_integrity/eventreader_test.go
@@ -28,7 +28,6 @@ import (
 	"testing"
 	"time"
 
-	"github.com/pkg/errors"
 	"github.com/stretchr/testify/assert"
 )
 
@@ -73,7 +72,7 @@ func TestEventReader(t *testing.T) {
 
 	// Create a new file.
 	txt1 := filepath.Join(dir, "test1.txt")
-	var fileMode os.FileMode = 0640
+	var fileMode os.FileMode = 0o640
 	mustRun(t, "created", func(t *testing.T) {
 		if err = ioutil.WriteFile(txt1, []byte("hello"), fileMode); err != nil {
 			t.Fatal(err)
@@ -129,14 +128,14 @@ func TestEventReader(t *testing.T) {
 			t.Skip()
 		}
 
-		if err = os.Chmod(txt2, 0644); err != nil {
+		if err = os.Chmod(txt2, 0o644); err != nil {
 			t.Fatal(err)
 		}
 
 		event := readTimeout(t, events)
 		assertSameFile(t, txt2, event.Path)
 		assert.EqualValues(t, AttributesModified, AttributesModified&event.Action)
-		assert.EqualValues(t, 0644, event.Info.Mode)
+		assert.EqualValues(t, 0o644, event.Info.Mode)
 	})
 
 	// Append data to the file.
@@ -153,7 +152,7 @@ func TestEventReader(t *testing.T) {
 		assertSameFile(t, txt2, event.Path)
 		assert.EqualValues(t, Updated, Updated&event.Action)
 		if runtime.GOOS != "windows" {
-			assert.EqualValues(t, 0644, event.Info.Mode)
+			assert.EqualValues(t, 0o644, event.Info.Mode)
 		}
 	})
 
@@ -182,7 +181,7 @@ func TestEventReader(t *testing.T) {
 	// Create a sub-directory.
 	subDir := filepath.Join(dir, "subdir")
 	mustRun(t, "dir created", func(t *testing.T) {
-		if err = os.Mkdir(subDir, 0755); err != nil {
+		if err = os.Mkdir(subDir, 0o755); err != nil {
 			t.Fatal(err)
 		}
 
@@ -243,7 +242,7 @@ func TestEventReader(t *testing.T) {
 func TestRaces(t *testing.T) {
 	t.Skip("Flaky test: about 1/20 of builds fails https://github.com/elastic/beats/issues/21303")
 	const (
-		fileMode os.FileMode = 0640
+		fileMode os.FileMode = 0o640
 		N                    = 100
 	)
 
diff --git a/auditbeat/module/file_integrity/eventreader_unsupported.go b/auditbeat/module/file_integrity/eventreader_unsupported.go
index 5fa39b2fa2cd..0fe95102c2ce 100644
--- a/auditbeat/module/file_integrity/eventreader_unsupported.go
+++ b/auditbeat/module/file_integrity/eventreader_unsupported.go
@@ -20,7 +20,7 @@
 
 package file_integrity
 
-import "github.com/pkg/errors"
+import "errors"
 
 func NewEventReader(c Config) (EventProducer, error) {
 	return errors.New("file auditing metricset is not implemented on this system")
diff --git a/auditbeat/module/file_integrity/fileinfo_posix.go b/auditbeat/module/file_integrity/fileinfo_posix.go
index a49cf1e5bd6c..536a9d2a4dc7 100644
--- a/auditbeat/module/file_integrity/fileinfo_posix.go
+++ b/auditbeat/module/file_integrity/fileinfo_posix.go
@@ -21,13 +21,13 @@
 package file_integrity
 
 import (
+	"fmt"
 	"os"
 	"os/user"
 	"strconv"
 	"syscall"
 
 	"github.com/joeshaw/multierror"
-	"github.com/pkg/errors"
 )
 
 // NewMetadata returns a new Metadata object. If an error is returned it is
@@ -36,7 +36,7 @@ import (
 func NewMetadata(path string, info os.FileInfo) (*Metadata, error) {
 	stat, ok := info.Sys().(*syscall.Stat_t)
 	if !ok {
-		return nil, errors.Errorf("unexpected fileinfo sys type %T for %v", info.Sys(), path)
+		return nil, fmt.Errorf("unexpected fileinfo sys type %T for %v", info.Sys(), path)
 	}
 
 	fileInfo := &Metadata{
diff --git a/auditbeat/module/file_integrity/fileinfo_test.go b/auditbeat/module/file_integrity/fileinfo_test.go
index ea3a16b65ed1..0375e06777b8 100644
--- a/auditbeat/module/file_integrity/fileinfo_test.go
+++ b/auditbeat/module/file_integrity/fileinfo_test.go
@@ -86,7 +86,7 @@ func TestNewMetadata(t *testing.T) {
 		assert.Equal(t, group.Name, meta.Group)
 		assert.Empty(t, meta.SID)
 
-		assert.EqualValues(t, 0600, meta.Mode)
+		assert.EqualValues(t, 0o600, meta.Mode)
 	}
 
 	assert.EqualValues(t, len("metadata test"), meta.Size, "size")
@@ -127,9 +127,9 @@ func TestSetUIDSetGIDBits(t *testing.T) {
 	}
 
 	for _, flags := range []os.FileMode{
-		0600 | os.ModeSetuid,
-		0600 | os.ModeSetgid,
-		0600 | os.ModeSetuid | os.ModeSetuid,
+		0o600 | os.ModeSetuid,
+		0o600 | os.ModeSetgid,
+		0o600 | os.ModeSetuid | os.ModeSetuid,
 	} {
 		msg := fmt.Sprintf("checking flags %04o", flags)
 		if err = os.Chmod(f.Name(), flags); err != nil {
diff --git a/auditbeat/module/file_integrity/fileinfo_windows.go b/auditbeat/module/file_integrity/fileinfo_windows.go
index 0766e61ae3f1..cb98b598bc7a 100644
--- a/auditbeat/module/file_integrity/fileinfo_windows.go
+++ b/auditbeat/module/file_integrity/fileinfo_windows.go
@@ -28,7 +28,6 @@ import (
 	"unsafe"
 
 	"github.com/joeshaw/multierror"
-	"github.com/pkg/errors"
 
 	"github.com/elastic/beats/v7/libbeat/common/file"
 )
@@ -39,7 +38,7 @@ import (
 func NewMetadata(path string, info os.FileInfo) (*Metadata, error) {
 	attrs, ok := info.Sys().(*syscall.Win32FileAttributeData)
 	if !ok {
-		return nil, errors.Errorf("unexpected fileinfo sys type %T for %v", info.Sys(), path)
+		return nil, fmt.Errorf("unexpected fileinfo sys type %T for %v", info.Sys(), path)
 	}
 
 	var errs multierror.Errors
@@ -69,12 +68,11 @@ func NewMetadata(path string, info os.FileInfo) (*Metadata, error) {
 	var err error
 	if !info.IsDir() {
 		if fileInfo.SID, fileInfo.Owner, err = fileOwner(path); err != nil {
-			errs = append(errs, errors.Wrap(err, "fileOwner failed"))
+			errs = append(errs, fmt.Errorf("fileOwner failed: %w", err))
 		}
-
 	}
 	if fileInfo.Origin, err = GetFileOrigin(path); err != nil {
-		errs = append(errs, errors.Wrap(err, "GetFileOrigin failed"))
+		errs = append(errs, fmt.Errorf("GetFileOrigin failed: %w", err))
 	}
 	return fileInfo, errs.Err()
 }
@@ -86,11 +84,11 @@ func fileOwner(path string) (sid, owner string, err error) {
 
 	pathW, err := syscall.UTF16PtrFromString(path)
 	if err != nil {
-		return sid, owner, errors.Wrapf(err, "failed to convert path:'%s' to UTF16", path)
+		return sid, owner, fmt.Errorf("failed to convert path:'%s' to UTF16: %w", path, err)
 	}
 	if err = GetNamedSecurityInfo(pathW, FileObject,
 		OwnerSecurityInformation, &securityID, nil, nil, nil, &securityDescriptor); err != nil {
-		return "", "", errors.Wrapf(err, "failed on GetSecurityInfo for %v", path)
+		return "", "", fmt.Errorf("failed on GetSecurityInfo for %v: %w", path, err)
 	}
 	defer syscall.LocalFree((syscall.Handle)(unsafe.Pointer(securityDescriptor)))
 
diff --git a/auditbeat/module/file_integrity/fileorigin_darwin.go b/auditbeat/module/file_integrity/fileorigin_darwin.go
index 6efae8bd8564..740987f25fe8 100644
--- a/auditbeat/module/file_integrity/fileorigin_darwin.go
+++ b/auditbeat/module/file_integrity/fileorigin_darwin.go
@@ -27,10 +27,11 @@ package file_integrity
 import "C"
 
 import (
+	"errors"
+	"fmt"
 	"syscall"
 	"unsafe"
 
-	"github.com/pkg/errors"
 	"howett.net/plist"
 )
 
@@ -93,8 +94,8 @@ func GetFileOrigin(path string) ([]string, error) {
 
 	// Decode plist format. A list of strings is expected
 	var urls []string
-	if _, err = plist.Unmarshal(data, &urls); err != nil {
-		return nil, errors.Wrap(err, "plist unmarshal failed")
+	if _, err := plist.Unmarshal(data, &urls); err != nil {
+		return nil, fmt.Errorf("plist unmarshal failed: %w", err)
 	}
 
 	// The returned list seems to be padded with empty strings when some of
diff --git a/auditbeat/module/file_integrity/flatbuffers.go b/auditbeat/module/file_integrity/flatbuffers.go
index 09de9f0b5e4e..97b039fea904 100644
--- a/auditbeat/module/file_integrity/flatbuffers.go
+++ b/auditbeat/module/file_integrity/flatbuffers.go
@@ -18,12 +18,12 @@
 package file_integrity
 
 import (
+	"fmt"
 	"os"
 	"sync"
 	"time"
 
 	flatbuffers "github.com/google/flatbuffers/go"
-	"github.com/pkg/errors"
 
 	"github.com/elastic/beats/v7/auditbeat/module/file_integrity/schema"
 )
@@ -332,7 +332,7 @@ func fbDecodeHash(e *schema.Event) map[HashType]Digest {
 			length = hash.Xxh64Length()
 			producer = hash.Xxh64
 		default:
-			panic(errors.Errorf("unhandled hash type: %v", hashType))
+			panic(fmt.Errorf("unhandled hash type: %v", hashType))
 		}
 
 		if length > 0 {
diff --git a/auditbeat/module/file_integrity/metricset.go b/auditbeat/module/file_integrity/metricset.go
index cd836f472d52..258ed3a47dcc 100644
--- a/auditbeat/module/file_integrity/metricset.go
+++ b/auditbeat/module/file_integrity/metricset.go
@@ -19,11 +19,11 @@ package file_integrity
 
 import (
 	"bytes"
+	"fmt"
 	"os"
 	"path/filepath"
 	"time"
 
-	"github.com/pkg/errors"
 	bolt "go.etcd.io/bbolt"
 
 	"github.com/elastic/beats/v7/auditbeat/datastore"
@@ -89,7 +89,7 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) {
 
 	r, err := NewEventReader(config)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to initialize file event reader")
+		return nil, fmt.Errorf("failed to initialize file event reader: %w", err)
 	}
 
 	ms := &MetricSet{
@@ -154,7 +154,7 @@ func (ms *MetricSet) Close() error {
 func (ms *MetricSet) init(reporter mb.PushReporterV2) bool {
 	bucket, err := datastore.OpenBucket(bucketName)
 	if err != nil {
-		err = errors.Wrap(err, "failed to open persistent datastore")
+		err = fmt.Errorf("failed to open persistent datastore: %w", err)
 		reporter.Error(err)
 		ms.log.Errorw("Failed to initialize", "error", err)
 		return false
@@ -163,7 +163,7 @@ func (ms *MetricSet) init(reporter mb.PushReporterV2) bool {
 
 	ms.fsnotifyChan, err = ms.reader.Start(reporter.Done())
 	if err != nil {
-		err = errors.Wrap(err, "failed to start fsnotify event producer")
+		err = fmt.Errorf("failed to start fsnotify event producer: %w", err)
 		reporter.Error(err)
 		ms.log.Errorw("Failed to initialize", "error", err)
 		return false
@@ -173,7 +173,7 @@ func (ms *MetricSet) init(reporter mb.PushReporterV2) bool {
 	if ms.config.ScanAtStart {
 		ms.scanner, err = NewFileSystemScanner(ms.config, ms.findNewPaths())
 		if err != nil {
-			err = errors.Wrap(err, "failed to initialize file scanner")
+			err = fmt.Errorf("failed to initialize file scanner: %w", err)
 			reporter.Error(err)
 			ms.log.Errorw("Failed to initialize", "error", err)
 			return false
@@ -181,7 +181,7 @@ func (ms *MetricSet) init(reporter mb.PushReporterV2) bool {
 
 		ms.scanChan, err = ms.scanner.Start(reporter.Done())
 		if err != nil {
-			err = errors.Wrap(err, "failed to start file scanner")
+			err = fmt.Errorf("failed to start file scanner: %w", err)
 			reporter.Error(err)
 			ms.log.Errorw("Failed to initialize", "error", err)
 			return false
@@ -370,7 +370,7 @@ func store(b datastore.Bucket, e *Event) error {
 	data := fbEncodeEvent(builder, e)
 
 	if err := b.Store(e.Path, data); err != nil {
-		return errors.Wrapf(err, "failed to locally store event for %v", e.Path)
+		return fmt.Errorf("failed to locally store event for %v: %w", e.Path, err)
 	}
 	return nil
 }
@@ -385,7 +385,7 @@ func load(b datastore.Bucket, path string) (*Event, error) {
 		return nil
 	})
 	if err != nil {
-		return nil, errors.Wrapf(err, "failed to load locally persisted event for %v", path)
+		return nil, fmt.Errorf("failed to load locally persisted event for %v: %w", path, err)
 	}
 	return e, nil
 }
diff --git a/auditbeat/module/file_integrity/metricset_test.go b/auditbeat/module/file_integrity/metricset_test.go
index 13e27cf82ea4..a28a2adb90a3 100644
--- a/auditbeat/module/file_integrity/metricset_test.go
+++ b/auditbeat/module/file_integrity/metricset_test.go
@@ -49,7 +49,7 @@ func TestData(t *testing.T) {
 	go func() {
 		time.Sleep(100 * time.Millisecond)
 		file := filepath.Join(dir, "file.data")
-		ioutil.WriteFile(file, []byte("hello world"), 0600)
+		ioutil.WriteFile(file, []byte("hello world"), 0o600)
 	}()
 
 	ms := mbtest.NewPushMetricSetV2(t, getConfig(dir))
@@ -136,8 +136,8 @@ func TestActions(t *testing.T) {
 	}
 
 	// Create some files in first directory
-	ioutil.WriteFile(createdFilepath, []byte("hello world"), 0600)
-	ioutil.WriteFile(updatedFilepath, []byte("hello world"), 0600)
+	ioutil.WriteFile(createdFilepath, []byte("hello world"), 0o600)
+	ioutil.WriteFile(updatedFilepath, []byte("hello world"), 0o600)
 
 	ms := mbtest.NewPushMetricSetV2(t, getConfig(dir, newDir))
 	events := mbtest.RunPushMetricSetV2(10*time.Second, 5, ms)
@@ -201,7 +201,7 @@ func TestExcludedFiles(t *testing.T) {
 	go func() {
 		for _, f := range []string{"FILE.TXT", "FILE.TXT.SWP", "file.txt.swo", ".git/HEAD", ".gitignore"} {
 			file := filepath.Join(dir, f)
-			ioutil.WriteFile(file, []byte("hello world"), 0600)
+			ioutil.WriteFile(file, []byte("hello world"), 0o600)
 		}
 	}()
 
@@ -252,7 +252,7 @@ func TestIncludedExcludedFiles(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	err = os.Mkdir(filepath.Join(dir, ".ssh"), 0700)
+	err = os.Mkdir(filepath.Join(dir, ".ssh"), 0o700)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -264,7 +264,7 @@ func TestIncludedExcludedFiles(t *testing.T) {
 
 	for _, f := range []string{"FILE.TXT", ".ssh/known_hosts", ".ssh/known_hosts.swp"} {
 		file := filepath.Join(dir, f)
-		err := ioutil.WriteFile(file, []byte("hello world"), 0600)
+		err := ioutil.WriteFile(file, []byte("hello world"), 0o600)
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -493,7 +493,7 @@ func (e expectedEvents) validate(t *testing.T) {
 	}
 	defer store.Close()
 	defer os.Remove(store.Name())
-	ds := datastore.New(store.Name(), 0644)
+	ds := datastore.New(store.Name(), 0o644)
 	bucket, err := ds.OpenBucket(bucketName)
 	if err != nil {
 		t.Fatal(err)
@@ -765,7 +765,7 @@ func TestEventDelete(t *testing.T) {
 	}
 	defer store.Close()
 	defer os.Remove(store.Name())
-	ds := datastore.New(store.Name(), 0644)
+	ds := datastore.New(store.Name(), 0o644)
 	bucket, err := ds.OpenBucket(bucketName)
 	if err != nil {
 		t.Fatal(err)
diff --git a/auditbeat/module/file_integrity/mime_test.go b/auditbeat/module/file_integrity/mime_test.go
index a4779c96fe8a..cefc0cda8a79 100644
--- a/auditbeat/module/file_integrity/mime_test.go
+++ b/auditbeat/module/file_integrity/mime_test.go
@@ -54,7 +54,7 @@ func TestGetMimeType(t *testing.T) {
 
 	for extension, sample := range mimeSamples {
 		samplePath := filepath.Join(dir, "sample."+extension)
-		if err := ioutil.WriteFile(samplePath, sample, 0700); err != nil {
+		if err := ioutil.WriteFile(samplePath, sample, 0o700); err != nil {
 			t.Fatal(err)
 		}
 	}
diff --git a/auditbeat/module/file_integrity/monitor/filetree.go b/auditbeat/module/file_integrity/monitor/filetree.go
index fcd9b94176d7..2ff72c12cb0c 100644
--- a/auditbeat/module/file_integrity/monitor/filetree.go
+++ b/auditbeat/module/file_integrity/monitor/filetree.go
@@ -34,10 +34,8 @@ const (
 	PostOrder
 )
 
-var (
-	// PathSeparator can be used to override the operating system separator.
-	PathSeparator = string(os.PathSeparator)
-)
+// PathSeparator can be used to override the operating system separator.
+var PathSeparator = string(os.PathSeparator)
 
 // FileTree represents a directory in a filesystem-tree structure.
 type FileTree map[string]FileTree
diff --git a/auditbeat/module/file_integrity/monitor/filetree_test.go b/auditbeat/module/file_integrity/monitor/filetree_test.go
index 9b7a6650035b..0442aa9fdc5b 100644
--- a/auditbeat/module/file_integrity/monitor/filetree_test.go
+++ b/auditbeat/module/file_integrity/monitor/filetree_test.go
@@ -50,24 +50,36 @@ func TestVisit(t *testing.T) {
 		result []string
 		isDir  []bool
 	}{
-		{"/",
+		{
+			"/",
 			[]string{"/", "/tmp", "/usr", "/usr/bin", "/usr/bin/python", "/usr/bin/tar", "/usr/lib", "/usr/lib/libz.a"},
-			[]bool{true, true, true, true, false, false, true, false}},
-		{"/usr",
+			[]bool{true, true, true, true, false, false, true, false},
+		},
+		{
+			"/usr",
 			[]string{"/usr", "/usr/bin", "/usr/bin/python", "/usr/bin/tar", "/usr/lib", "/usr/lib/libz.a"},
-			[]bool{true, true, false, false, true, false}},
-		{"/usr/bin",
+			[]bool{true, true, false, false, true, false},
+		},
+		{
+			"/usr/bin",
 			[]string{"/usr/bin", "/usr/bin/python", "/usr/bin/tar"},
-			[]bool{true, false, false}},
-		{"/usr/lib",
+			[]bool{true, false, false},
+		},
+		{
+			"/usr/lib",
 			[]string{"/usr/lib", "/usr/lib/libz.a"},
-			[]bool{true, false}},
-		{"/tmp/",
+			[]bool{true, false},
+		},
+		{
+			"/tmp/",
 			[]string{"/tmp"},
-			[]bool{true}},
-		{"/usr/bin/python",
+			[]bool{true},
+		},
+		{
+			"/usr/bin/python",
 			[]string{"/usr/bin/python"},
-			[]bool{false}},
+			[]bool{false},
+		},
 	} {
 		for _, order := range []VisitOrder{PreOrder, PostOrder} {
 			failMsg := fmt.Sprintf("test entry %d for path '%s' order:%v", testIdx, testData.dir, order)
@@ -148,14 +160,17 @@ func TestVisitCancel(t *testing.T) {
 		expected []visitParams
 	}{
 		{PreOrder, "/a", []visitParams{
-			{"/", true}}},
+			{"/", true},
+		}},
 		{PostOrder, "/a", []visitParams{
 			{"/a/b/file", false},
-			{"/a/b", true}}},
+			{"/a/b", true},
+		}},
 		{PreOrder, "/a/b/file", []visitParams{
 			{"/", true},
 			{"/a", true},
-			{"/a/b", true}}},
+			{"/a/b", true},
+		}},
 	} {
 		failMsg := fmt.Sprintf("test at index %d", idx)
 		var result []visitParams
diff --git a/auditbeat/module/file_integrity/monitor/monitor_test.go b/auditbeat/module/file_integrity/monitor/monitor_test.go
index 3842948ce0ba..37a2fe7fdb0e 100644
--- a/auditbeat/module/file_integrity/monitor/monitor_test.go
+++ b/auditbeat/module/file_integrity/monitor/monitor_test.go
@@ -59,7 +59,7 @@ func TestNonRecursive(t *testing.T) {
 	testDirOps(t, dir, watcher)
 
 	subdir := filepath.Join(dir, "subdir")
-	os.Mkdir(subdir, 0750)
+	os.Mkdir(subdir, 0o750)
 
 	ev, err := readTimeout(t, watcher)
 	assertNoError(t, err)
@@ -68,7 +68,7 @@ func TestNonRecursive(t *testing.T) {
 
 	// subdirs are not watched
 	subfile := filepath.Join(subdir, "file.dat")
-	assertNoError(t, ioutil.WriteFile(subfile, []byte("foo"), 0640))
+	assertNoError(t, ioutil.WriteFile(subfile, []byte("foo"), 0o640))
 
 	_, err = readTimeout(t, watcher)
 	assert.Error(t, err)
@@ -107,7 +107,7 @@ func TestRecursive(t *testing.T) {
 	testDirOps(t, dir, watcher)
 
 	subdir := filepath.Join(dir, "subdir")
-	os.Mkdir(subdir, 0750)
+	os.Mkdir(subdir, 0o750)
 
 	ev, err := readTimeout(t, watcher)
 	assertNoError(t, err)
@@ -161,7 +161,7 @@ func TestRecursiveNoFollowSymlink(t *testing.T) {
 	// Create a file in the other dir
 
 	file := filepath.Join(linkedDir, "not.seen")
-	assertNoError(t, ioutil.WriteFile(file, []byte("hello"), 0640))
+	assertNoError(t, ioutil.WriteFile(file, []byte("hello"), 0o640))
 
 	// No event is received
 	ev, err := readTimeout(t, watcher)
@@ -203,8 +203,8 @@ func TestRecursiveSubdirPermissions(t *testing.T) {
 
 	for _, name := range []string{"a", "b", "c"} {
 		path := filepath.Join(outDir, name)
-		assertNoError(t, os.Mkdir(path, 0755))
-		assertNoError(t, ioutil.WriteFile(filepath.Join(path, name), []byte("Hello"), 0644))
+		assertNoError(t, os.Mkdir(path, 0o755))
+		assertNoError(t, ioutil.WriteFile(filepath.Join(path, name), []byte("Hello"), 0o644))
 	}
 
 	// Make a subdir not accessible
@@ -299,8 +299,8 @@ func TestRecursiveExcludedPaths(t *testing.T) {
 
 	for _, name := range []string{"a", "b", "c"} {
 		path := filepath.Join(outDir, name)
-		assertNoError(t, os.Mkdir(path, 0755))
-		assertNoError(t, ioutil.WriteFile(filepath.Join(path, name), []byte("Hello"), 0644))
+		assertNoError(t, os.Mkdir(path, 0o755))
+		assertNoError(t, ioutil.WriteFile(filepath.Join(path, name), []byte("Hello"), 0o644))
 	}
 
 	// excludes file/dir named "b"
@@ -371,7 +371,7 @@ func testDirOps(t *testing.T, dir string, watcher Watcher) {
 	fpath2 := filepath.Join(dir, "file2.txt")
 
 	// Create
-	assertNoError(t, ioutil.WriteFile(fpath, []byte("hello"), 0640))
+	assertNoError(t, ioutil.WriteFile(fpath, []byte("hello"), 0o640))
 
 	ev, err := readTimeout(t, watcher)
 	assertNoError(t, err)
@@ -382,7 +382,7 @@ func testDirOps(t *testing.T, dir string, watcher Watcher) {
 	// Repeat the write if no event is received. Under macOS often
 	// the write fails to generate a write event for non-recursive watcher
 	for i := 0; i < 3; i++ {
-		f, err := os.OpenFile(fpath, os.O_RDWR|os.O_APPEND, 0640)
+		f, err := os.OpenFile(fpath, os.O_RDWR|os.O_APPEND, 0o640)
 		assertNoError(t, err)
 		f.WriteString(" world\n")
 		f.Sync()
diff --git a/auditbeat/module/file_integrity/monitor/recursive.go b/auditbeat/module/file_integrity/monitor/recursive.go
index 14cc99379d54..aa41cdd75a2f 100644
--- a/auditbeat/module/file_integrity/monitor/recursive.go
+++ b/auditbeat/module/file_integrity/monitor/recursive.go
@@ -18,12 +18,12 @@
 package monitor
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 
 	"github.com/fsnotify/fsnotify"
 	"github.com/joeshaw/multierror"
-	"github.com/pkg/errors"
 
 	"github.com/elastic/beats/v7/libbeat/logp"
 )
@@ -96,7 +96,7 @@ func (watcher *recursiveWatcher) addRecursive(path string) error {
 		}
 
 		if fnErr != nil {
-			errs = append(errs, errors.Wrapf(fnErr, "error walking path '%s'", path))
+			errs = append(errs, fmt.Errorf("error walking path '%s': %w", path, fnErr))
 			// If FileInfo is not nil, the directory entry can be processed
 			// even if there was some error
 			if info == nil {
@@ -107,7 +107,7 @@ func (watcher *recursiveWatcher) addRecursive(path string) error {
 		if info.IsDir() {
 			if err = watcher.tree.AddDir(path); err == nil {
 				if err = watcher.inner.Add(path); err != nil {
-					errs = append(errs, errors.Wrapf(err, "failed adding watcher to '%s'", path))
+					errs = append(errs, fmt.Errorf("failed adding watcher to '%s': %w", path, err))
 					return nil
 				}
 			}
@@ -119,7 +119,7 @@ func (watcher *recursiveWatcher) addRecursive(path string) error {
 	watcher.log.Debugw("Added recursive watch", "path", path)
 
 	if err != nil {
-		errs = append(errs, errors.Wrapf(err, "failed to walk path '%s'", path))
+		errs = append(errs, fmt.Errorf("failed to walk path '%s': %w", path, err))
 	}
 	return errs.Err()
 }
@@ -166,7 +166,7 @@ func (watcher *recursiveWatcher) forwardEvents() error {
 			case fsnotify.Create:
 				err := watcher.addRecursive(event.Name)
 				if err != nil {
-					watcher.inner.Errors <- errors.Wrapf(err, "failed to add created path '%s'", event.Name)
+					watcher.inner.Errors <- fmt.Errorf("failed to add created path '%s': %w", event.Name, err)
 				}
 				err = watcher.tree.Visit(event.Name, PreOrder, func(path string, _ bool) error {
 					watcher.deliver(fsnotify.Event{
@@ -176,7 +176,7 @@ func (watcher *recursiveWatcher) forwardEvents() error {
 					return nil
 				})
 				if err != nil {
-					watcher.inner.Errors <- errors.Wrapf(err, "failed to visit created path '%s'", event.Name)
+					watcher.inner.Errors <- fmt.Errorf("failed to visit created path '%s': %w", event.Name, err)
 				}
 
 			case fsnotify.Remove:
@@ -188,12 +188,12 @@ func (watcher *recursiveWatcher) forwardEvents() error {
 					return nil
 				})
 				if err != nil {
-					watcher.inner.Errors <- errors.Wrapf(err, "failed to visit removed path '%s'", event.Name)
+					watcher.inner.Errors <- fmt.Errorf("failed to visit removed path '%s': %w", event.Name, err)
 				}
 
 				err = watcher.tree.Remove(event.Name)
 				if err != nil {
-					watcher.inner.Errors <- errors.Wrapf(err, "failed to visit removed path '%s'", event.Name)
+					watcher.inner.Errors <- fmt.Errorf("failed to visit removed path '%s': %w", event.Name, err)
 				}
 
 			// Handling rename (move) as a special case to give this recursion
@@ -203,7 +203,7 @@ func (watcher *recursiveWatcher) forwardEvents() error {
 			case fsnotify.Rename:
 				err := watcher.tree.Remove(event.Name)
 				if err != nil {
-					watcher.inner.Errors <- errors.Wrapf(err, "failed to remove path '%s'", event.Name)
+					watcher.inner.Errors <- fmt.Errorf("failed to remove path '%s': %w", event.Name, err)
 				}
 				fallthrough
 
diff --git a/auditbeat/module/file_integrity/scanner_test.go b/auditbeat/module/file_integrity/scanner_test.go
index 7c53eda8e2da..74bfb46aea88 100644
--- a/auditbeat/module/file_integrity/scanner_test.go
+++ b/auditbeat/module/file_integrity/scanner_test.go
@@ -126,11 +126,11 @@ func setupTestDir(t *testing.T) string {
 		t.Fatal(err)
 	}
 
-	if err = ioutil.WriteFile(filepath.Join(dir, "a"), []byte("file a"), 0600); err != nil {
+	if err = ioutil.WriteFile(filepath.Join(dir, "a"), []byte("file a"), 0o600); err != nil {
 		t.Fatal(err)
 	}
 
-	if err = ioutil.WriteFile(filepath.Join(dir, "b"), []byte("file b"), 0600); err != nil {
+	if err = ioutil.WriteFile(filepath.Join(dir, "b"), []byte("file b"), 0o600); err != nil {
 		t.Fatal(err)
 	}
 
@@ -138,11 +138,11 @@ func setupTestDir(t *testing.T) string {
 		t.Fatal(err)
 	}
 
-	if err = os.Mkdir(filepath.Join(dir, "subdir"), 0700); err != nil {
+	if err = os.Mkdir(filepath.Join(dir, "subdir"), 0o700); err != nil {
 		t.Fatal(err)
 	}
 
-	if err = ioutil.WriteFile(filepath.Join(dir, "subdir", "c"), []byte("file c"), 0600); err != nil {
+	if err = ioutil.WriteFile(filepath.Join(dir, "subdir", "c"), []byte("file c"), 0o600); err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/auditbeat/scripts/mage/config.go b/auditbeat/scripts/mage/config.go
index d6a1f6b14248..f9c4cb434b86 100644
--- a/auditbeat/scripts/mage/config.go
+++ b/auditbeat/scripts/mage/config.go
@@ -18,10 +18,9 @@
 package mage
 
 import (
+	"fmt"
 	"path/filepath"
 
-	"github.com/pkg/errors"
-
 	devtools "github.com/elastic/beats/v7/dev-tools/mage"
 )
 
@@ -56,12 +55,12 @@ func configFileParams(dirs ...string) (devtools.ConfigFileParams, error) {
 
 	configFiles, err := devtools.FindFiles(globs...)
 	if err != nil {
-		return devtools.ConfigFileParams{}, errors.Wrap(err, "failed to find config templates")
+		return devtools.ConfigFileParams{}, fmt.Errorf("failed to find config templates: %w", err)
 	}
 	if len(configFiles) == 0 {
-		return devtools.ConfigFileParams{}, errors.Errorf("no config files found in %v", globs)
+		return devtools.ConfigFileParams{}, fmt.Errorf("no config files found in %v", globs)
 	}
-	devtools.MustFileConcat("build/config.modules.yml.tmpl", 0644, configFiles...)
+	devtools.MustFileConcat("build/config.modules.yml.tmpl", 0o644, configFiles...)
 
 	p := devtools.DefaultConfigFileParams()
 	p.Templates = append(p.Templates, devtools.OSSBeatDir("_meta/config/*.tmpl"))
diff --git a/auditbeat/scripts/mage/docs.go b/auditbeat/scripts/mage/docs.go
index d28d1df62587..d26c8759b887 100644
--- a/auditbeat/scripts/mage/docs.go
+++ b/auditbeat/scripts/mage/docs.go
@@ -18,12 +18,12 @@
 package mage
 
 import (
+	"fmt"
 	"os"
 	"path/filepath"
 	"strings"
 
 	"github.com/magefile/mage/sh"
-	"github.com/pkg/errors"
 
 	devtools "github.com/elastic/beats/v7/dev-tools/mage"
 )
@@ -40,7 +40,7 @@ func ModuleDocs() error {
 	for _, path := range dirsWithModules {
 		files, err := devtools.FindFiles(filepath.Join(path, configTemplateGlob))
 		if err != nil {
-			return errors.Wrap(err, "failed to find config templates")
+			return fmt.Errorf("failed to find config templates: %w", err)
 		}
 
 		configFiles = append(configFiles, files...)
@@ -65,7 +65,7 @@ func ModuleDocs() error {
 		if err := os.RemoveAll(filepath.Join(path, "docs/modules")); err != nil {
 			return err
 		}
-		if err := os.MkdirAll(filepath.Join(path, "docs/modules"), 0755); err != nil {
+		if err := os.MkdirAll(filepath.Join(path, "docs/modules"), 0o755); err != nil {
 			return err
 		}
 	}
diff --git a/auditbeat/scripts/mage/package.go b/auditbeat/scripts/mage/package.go
index 94b2a7cde6d5..fbe43fa9d3b3 100644
--- a/auditbeat/scripts/mage/package.go
+++ b/auditbeat/scripts/mage/package.go
@@ -18,7 +18,8 @@
 package mage
 
 import (
-	"github.com/pkg/errors"
+	"errors"
+	"fmt"
 
 	devtools "github.com/elastic/beats/v7/dev-tools/mage"
 )
@@ -40,7 +41,7 @@ const (
 func CustomizePackaging(pkgFlavor PackagingFlavor) {
 	var (
 		shortConfig = devtools.PackageFile{
-			Mode:   0600,
+			Mode:   0o600,
 			Source: "{{.PackageDir}}/auditbeat.yml",
 			Dep: func(spec devtools.PackageSpec) error {
 				return generateConfig(pkgFlavor, devtools.ShortConfigType, spec)
@@ -48,7 +49,7 @@ func CustomizePackaging(pkgFlavor PackagingFlavor) {
 			Config: true,
 		}
 		referenceConfig = devtools.PackageFile{
-			Mode:   0644,
+			Mode:   0o644,
 			Source: "{{.PackageDir}}/auditbeat.reference.yml",
 			Dep: func(spec devtools.PackageSpec) error {
 				return generateConfig(pkgFlavor, devtools.ReferenceConfigType, spec)
@@ -61,7 +62,7 @@ func CustomizePackaging(pkgFlavor PackagingFlavor) {
 		defaultSampleRulesTarget = "audit.rules.d/sample-rules.conf.disabled"
 	)
 	sampleRules := devtools.PackageFile{
-		Mode:   0644,
+		Mode:   0o644,
 		Source: sampleRulesSource,
 		Dep: func(spec devtools.PackageSpec) error {
 			if spec.OS != "linux" {
@@ -76,7 +77,7 @@ func CustomizePackaging(pkgFlavor PackagingFlavor) {
 			)
 
 			if err := devtools.Copy(origin, spec.MustExpand(sampleRulesSource)); err != nil {
-				return errors.Wrap(err, "failed to copy sample rules")
+				return fmt.Errorf("failed to copy sample rules: %w", err)
 			}
 			return nil
 		},
@@ -96,7 +97,7 @@ func CustomizePackaging(pkgFlavor PackagingFlavor) {
 				sampleRulesTarget = "/etc/{{.BeatName}}/" + defaultSampleRulesTarget
 			case devtools.Docker:
 			default:
-				panic(errors.Errorf("unhandled package type: %v", pkgType))
+				panic(fmt.Errorf("unhandled package type: %v", pkgType))
 			}
 
 			if args.OS == "linux" {
@@ -115,7 +116,7 @@ func generateConfig(pkgFlavor PackagingFlavor, ct devtools.ConfigFileType, spec
 	case XPackPackaging:
 		args = XPackConfigFileParams()
 	default:
-		panic(errors.Errorf("Invalid packaging flavor (either oss or xpack): %v", pkgFlavor))
+		panic(fmt.Errorf("Invalid packaging flavor (either oss or xpack): %v", pkgFlavor))
 	}
 
 	// PackageDir isn't exported but we can grab it's value this way.
diff --git a/x-pack/auditbeat/module/system/host/host.go b/x-pack/auditbeat/module/system/host/host.go
index 3a4bb38dee9c..30df5acc64e8 100644
--- a/x-pack/auditbeat/module/system/host/host.go
+++ b/x-pack/auditbeat/module/system/host/host.go
@@ -17,7 +17,6 @@ import (
 
 	"github.com/cespare/xxhash/v2"
 	"github.com/joeshaw/multierror"
-	"github.com/pkg/errors"
 
 	"github.com/elastic/beats/v7/auditbeat/datastore"
 	"github.com/elastic/beats/v7/libbeat/common"
@@ -189,12 +188,12 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) {
 
 	config := defaultConfig()
 	if err := base.Module().UnpackConfig(&config); err != nil {
-		return nil, errors.Wrapf(err, "failed to unpack the %v/%v config", moduleName, metricsetName)
+		return nil, fmt.Errorf("failed to unpack the %v/%v config: %w", moduleName, metricsetName, err)
 	}
 
 	bucket, err := datastore.OpenBucket(bucketName)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to open persistent datastore")
+		return nil, fmt.Errorf("failed to open persistent datastore: %w", err)
 	}
 
 	ms := &MetricSet{
@@ -207,7 +206,7 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) {
 	// Load state (lastHost) from disk
 	err = ms.restoreStateFromDisk()
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to restore state from disk")
+		return nil, fmt.Errorf("failed to restore state from disk: %w", err)
 	}
 
 	return ms, nil
@@ -319,7 +318,7 @@ func (ms *MetricSet) reportChanges(report mb.ReporterV2) error {
 func getHost() (*Host, error) {
 	sysinfoHost, err := sysinfo.Host()
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to load host information")
+		return nil, fmt.Errorf("failed to load host information: %w", err)
 	}
 
 	ips, macs, err := getNetInfo()
@@ -432,12 +431,12 @@ func (ms *MetricSet) saveStateToDisk() error {
 	if ms.lastHost != nil {
 		err := encoder.Encode(*ms.lastHost)
 		if err != nil {
-			return errors.Wrap(err, "error encoding host information")
+			return fmt.Errorf("error encoding host information: %w", err)
 		}
 
 		err = ms.bucket.Store(bucketKeyLastHost, buf.Bytes())
 		if err != nil {
-			return errors.Wrap(err, "error writing host information to disk")
+			return fmt.Errorf("error writing host information to disk: %w", err)
 		}
 
 		ms.log.Debug("Wrote host information to disk.")
@@ -464,7 +463,7 @@ func (ms *MetricSet) restoreStateFromDisk() error {
 		if err == nil {
 			ms.lastHost = &lastHost
 		} else if err != io.EOF {
-			return errors.Wrap(err, "error decoding host information")
+			return fmt.Errorf("error decoding host information: %w", err)
 		}
 	}
 
diff --git a/x-pack/auditbeat/module/system/login/login.go b/x-pack/auditbeat/module/system/login/login.go
index 82c1e384ab79..19d1753e23b3 100644
--- a/x-pack/auditbeat/module/system/login/login.go
+++ b/x-pack/auditbeat/module/system/login/login.go
@@ -12,8 +12,6 @@ import (
 	"net"
 	"time"
 
-	"github.com/pkg/errors"
-
 	"github.com/elastic/beats/v7/auditbeat/datastore"
 	"github.com/elastic/beats/v7/libbeat/common"
 	"github.com/elastic/beats/v7/libbeat/common/cfgwarn"
@@ -97,12 +95,12 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) {
 
 	config := defaultConfig()
 	if err := base.Module().UnpackConfig(&config); err != nil {
-		return nil, errors.Wrapf(err, "failed to unpack the %v/%v config", moduleName, metricsetName)
+		return nil, fmt.Errorf("failed to unpack the %v/%v config: %w", moduleName, metricsetName, err)
 	}
 
 	bucket, err := datastore.OpenBucket(bucketName)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to open persistent datastore")
+		return nil, fmt.Errorf("failed to open persistent datastore: %w", err)
 	}
 
 	ms := &MetricSet{
diff --git a/x-pack/auditbeat/module/system/login/login_test.go b/x-pack/auditbeat/module/system/login/login_test.go
index e0a6fe357678..fcdb5f6983a7 100644
--- a/x-pack/auditbeat/module/system/login/login_test.go
+++ b/x-pack/auditbeat/module/system/login/login_test.go
@@ -97,7 +97,7 @@ func TestWtmp(t *testing.T) {
 		"Timestamp is not equal: %+v", events[0].Timestamp)
 
 	// Append logout event to wtmp file and check that it's read
-	wtmpFile, err := os.OpenFile(wtmpFilepath, os.O_APPEND|os.O_WRONLY, 0644)
+	wtmpFile, err := os.OpenFile(wtmpFilepath, os.O_APPEND|os.O_WRONLY, 0o644)
 	if err != nil {
 		t.Fatalf("error opening %v: %v", wtmpFilepath, err)
 	}
@@ -264,7 +264,6 @@ func checkFieldValue(t *testing.T, mapstr common.MapStr, fieldName string, field
 		default:
 			assert.Equal(t, fieldValue, v)
 		}
-
 	}
 }
 
diff --git a/x-pack/auditbeat/module/system/login/utmp.go b/x-pack/auditbeat/module/system/login/utmp.go
index ee0b8b2f5fcf..f547562db577 100644
--- a/x-pack/auditbeat/module/system/login/utmp.go
+++ b/x-pack/auditbeat/module/system/login/utmp.go
@@ -10,6 +10,7 @@ package login
 import (
 	"bytes"
 	"encoding/gob"
+	"fmt"
 	"io"
 	"net"
 	"os"
@@ -19,8 +20,6 @@ import (
 	"strconv"
 	"syscall"
 
-	"github.com/pkg/errors"
-
 	"github.com/elastic/beats/v7/auditbeat/datastore"
 	"github.com/elastic/beats/v7/libbeat/logp"
 )
@@ -77,7 +76,7 @@ func NewUtmpFileReader(log *logp.Logger, bucket datastore.Bucket, config config)
 	// Load state (file records, tty mapping) from disk
 	err := r.restoreStateFromDisk()
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to restore state from disk")
+		return nil, fmt.Errorf("failed to restore state from disk: %w", err)
 	}
 
 	return r, nil
@@ -103,13 +102,13 @@ func (r *UtmpFileReader) ReadNew() (<-chan LoginRecord, <-chan error) {
 
 		wtmpFiles, err := r.findFiles(r.config.WtmpFilePattern, Wtmp)
 		if err != nil {
-			errorC <- errors.Wrap(err, "failed to expand file pattern")
+			errorC <- fmt.Errorf("failed to expand file pattern: %w", err)
 			return
 		}
 
 		btmpFiles, err := r.findFiles(r.config.BtmpFilePattern, Btmp)
 		if err != nil {
-			errorC <- errors.Wrap(err, "failed to expand file pattern")
+			errorC <- fmt.Errorf("failed to expand file pattern: %w", err)
 			return
 		}
 
@@ -127,7 +126,7 @@ func (r *UtmpFileReader) ReadNew() (<-chan LoginRecord, <-chan error) {
 func (r *UtmpFileReader) findFiles(filePattern string, utmpType UtmpType) ([]UtmpFile, error) {
 	paths, err := filepath.Glob(filePattern)
 	if err != nil {
-		return nil, errors.Wrapf(err, "failed to expand file pattern %v", filePattern)
+		return nil, fmt.Errorf("failed to expand file pattern %v: %w", filePattern, err)
 	}
 
 	// Sort paths in reverse order (oldest/most-rotated file first)
@@ -142,7 +141,7 @@ func (r *UtmpFileReader) findFiles(filePattern string, utmpType UtmpType) ([]Utm
 				r.log.Debugf("File %v does not exist anymore.", path)
 				continue
 			} else {
-				return nil, errors.Wrapf(err, "unexpected error when looking up file %v", path)
+				return nil, fmt.Errorf("unexpected error when looking up file %v: %w", path, err)
 			}
 		}
 
@@ -196,7 +195,7 @@ func (r *UtmpFileReader) readNewInFile(loginRecordC chan<- LoginRecord, errorC c
 		// Empty new file - save but don't read.
 		err := r.updateSavedUtmpFile(utmpFile, nil)
 		if err != nil {
-			errorC <- errors.Wrapf(err, "error updating file record for file %v", utmpFile.Path)
+			errorC <- fmt.Errorf("error updating file record for file %v: %w", utmpFile.Path, err)
 		}
 		return
 	}
@@ -206,7 +205,7 @@ func (r *UtmpFileReader) readNewInFile(loginRecordC chan<- LoginRecord, errorC c
 
 		f, err := os.Open(utmpFile.Path)
 		if err != nil {
-			errorC <- errors.Wrapf(err, "error opening file %v", utmpFile.Path)
+			errorC <- fmt.Errorf("error opening file %v: %w", utmpFile.Path, err)
 			return
 		}
 		defer func() {
@@ -214,7 +213,7 @@ func (r *UtmpFileReader) readNewInFile(loginRecordC chan<- LoginRecord, errorC c
 			// otherwise we will just keep trying to re-read very frequently forever.
 			err := r.updateSavedUtmpFile(utmpFile, f)
 			if err != nil {
-				errorC <- errors.Wrapf(err, "error updating file record for file %v", utmpFile.Path)
+				errorC <- fmt.Errorf("error updating file record for file %v: %w", utmpFile.Path, err)
 			}
 
 			f.Close()
@@ -225,7 +224,7 @@ func (r *UtmpFileReader) readNewInFile(loginRecordC chan<- LoginRecord, errorC c
 		if size >= oldSize && utmpFile.Offset <= size {
 			_, err = f.Seek(utmpFile.Offset, 0)
 			if err != nil {
-				errorC <- errors.Wrapf(err, "error setting offset %d for file %v", utmpFile.Offset, utmpFile.Path)
+				errorC <- fmt.Errorf("error setting offset %d for file %v: %w", utmpFile.Offset, utmpFile.Path, err)
 			}
 		}
 
@@ -234,7 +233,7 @@ func (r *UtmpFileReader) readNewInFile(loginRecordC chan<- LoginRecord, errorC c
 		if size < oldSize || utmpFile.Offset > size || err != nil {
 			_, err = f.Seek(0, 0)
 			if err != nil {
-				errorC <- errors.Wrapf(err, "error setting offset 0 for file %v", utmpFile.Path)
+				errorC <- fmt.Errorf("error setting offset 0 for file %v: %w", utmpFile.Path, err)
 
 				// Even that did not work, so return.
 				return
@@ -244,7 +243,7 @@ func (r *UtmpFileReader) readNewInFile(loginRecordC chan<- LoginRecord, errorC c
 		for {
 			utmp, err := ReadNextUtmp(f)
 			if err != nil && err != io.EOF {
-				errorC <- errors.Wrapf(err, "error reading entry in UTMP file %v", utmpFile.Path)
+				errorC <- fmt.Errorf("error reading entry in UTMP file %v: %w", utmpFile.Path, err)
 				return
 			}
 
@@ -279,7 +278,7 @@ func (r *UtmpFileReader) updateSavedUtmpFile(utmpFile UtmpFile, f *os.File) erro
 	if f != nil {
 		offset, err := f.Seek(0, 1)
 		if err != nil {
-			return errors.Wrap(err, "error calling Seek")
+			return fmt.Errorf("error calling Seek: %w", err)
 		}
 		utmpFile.Offset = offset
 	}
@@ -314,7 +313,7 @@ func (r *UtmpFileReader) processBadLoginRecord(utmp *Utmp) (*LoginRecord, error)
 		record.Hostname = utmp.UtHost
 	default:
 		// This should not happen.
-		return nil, errors.Errorf("UTMP record with unexpected type %v in bad login file", utmp.UtType)
+		return nil, fmt.Errorf("UTMP record with unexpected type %v in bad login file", utmp.UtType)
 	}
 
 	return &record, nil
@@ -470,13 +469,13 @@ func (r *UtmpFileReader) saveFileRecordsToDisk() error {
 	for _, utmpFile := range r.savedUtmpFiles {
 		err := encoder.Encode(utmpFile)
 		if err != nil {
-			return errors.Wrap(err, "error encoding UTMP file record")
+			return fmt.Errorf("error encoding UTMP file record: %w", err)
 		}
 	}
 
 	err := r.bucket.Store(bucketKeyFileRecords, buf.Bytes())
 	if err != nil {
-		return errors.Wrap(err, "error writing UTMP file records to disk")
+		return fmt.Errorf("error writing UTMP file records to disk: %w", err)
 	}
 
 	r.log.Debugf("Wrote %d UTMP file records to disk", len(r.savedUtmpFiles))
@@ -490,13 +489,13 @@ func (r *UtmpFileReader) saveLoginSessionsToDisk() error {
 	for _, loginRecord := range r.loginSessions {
 		err := encoder.Encode(loginRecord)
 		if err != nil {
-			return errors.Wrap(err, "error encoding login record")
+			return fmt.Errorf("error encoding login record: %w", err)
 		}
 	}
 
 	err := r.bucket.Store(bucketKeyLoginSessions, buf.Bytes())
 	if err != nil {
-		return errors.Wrap(err, "error writing login records to disk")
+		return fmt.Errorf("error writing login records to disk: %w", err)
 	}
 
 	r.log.Debugf("Wrote %d open login sessions to disk", len(r.loginSessions))
@@ -540,7 +539,7 @@ func (r *UtmpFileReader) restoreFileRecordsFromDisk() error {
 				// Read all
 				break
 			} else {
-				return errors.Wrap(err, "error decoding file record")
+				return fmt.Errorf("error decoding file record: %w", err)
 			}
 		}
 	}
@@ -572,7 +571,7 @@ func (r *UtmpFileReader) restoreLoginSessionsFromDisk() error {
 				// Read all
 				break
 			} else {
-				return errors.Wrap(err, "error decoding login record")
+				return fmt.Errorf("error decoding login record: %w", err)
 			}
 		}
 	}
diff --git a/x-pack/auditbeat/module/system/package/package.go b/x-pack/auditbeat/module/system/package/package.go
index b4eddbb726f9..8909fbdafbfe 100644
--- a/x-pack/auditbeat/module/system/package/package.go
+++ b/x-pack/auditbeat/module/system/package/package.go
@@ -23,7 +23,6 @@ import (
 	"github.com/cespare/xxhash/v2"
 	"github.com/gofrs/uuid"
 	"github.com/joeshaw/multierror"
-	"github.com/pkg/errors"
 
 	"github.com/elastic/beats/v7/auditbeat/datastore"
 	"github.com/elastic/beats/v7/libbeat/common"
@@ -203,12 +202,12 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) {
 
 	config := defaultConfig()
 	if err := base.Module().UnpackConfig(&config); err != nil {
-		return nil, errors.Wrapf(err, "failed to unpack the %v/%v config", moduleName, metricsetName)
+		return nil, fmt.Errorf("failed to unpack the %v/%v config: %w", moduleName, metricsetName, err)
 	}
 
 	bucket, err := datastore.OpenBucket(bucketName)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to open persistent datastore")
+		return nil, fmt.Errorf("failed to open persistent datastore: %w", err)
 	}
 
 	ms := &MetricSet{
@@ -238,7 +237,7 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) {
 	// Load from disk: Packages
 	packages, err := ms.restorePackagesFromDisk()
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to restore packages from disk")
+		return nil, fmt.Errorf("failed to restore packages from disk: %w", err)
 	}
 	ms.log.Debugf("Restored %d packages from disk", len(packages))
 
@@ -286,12 +285,12 @@ func (ms *MetricSet) reportState(report mb.ReporterV2) error {
 
 	packages, err := ms.getPackages()
 	if err != nil {
-		return errors.Wrap(err, "failed to get packages")
+		return fmt.Errorf("failed to get packages: %w", err)
 	}
 
 	stateID, err := uuid.NewV4()
 	if err != nil {
-		return errors.Wrap(err, "error generating state ID")
+		return fmt.Errorf("error generating state ID: %w", err)
 	}
 	for _, pkg := range packages {
 		event := ms.packageEvent(pkg, eventTypeState, eventActionExistingPackage)
@@ -309,7 +308,7 @@ func (ms *MetricSet) reportState(report mb.ReporterV2) error {
 	}
 	err = ms.bucket.Store(bucketKeyStateTimestamp, timeBytes)
 	if err != nil {
-		return errors.Wrap(err, "error writing state timestamp to disk")
+		return fmt.Errorf("error writing state timestamp to disk: %w", err)
 	}
 
 	return ms.savePackagesToDisk(packages)
@@ -319,7 +318,7 @@ func (ms *MetricSet) reportState(report mb.ReporterV2) error {
 func (ms *MetricSet) reportChanges(report mb.ReporterV2) error {
 	packages, err := ms.getPackages()
 	if err != nil {
-		return errors.Wrap(err, "failed to get packages")
+		return fmt.Errorf("failed to get packages: %w", err)
 	}
 
 	newInCache, missingFromCache := ms.cache.DiffAndUpdateCache(convertToCacheable(packages))
@@ -449,7 +448,7 @@ func (ms *MetricSet) restorePackagesFromDisk() (packages []*Package, err error)
 				// Read all packages
 				break
 			} else {
-				return nil, errors.Wrap(err, "error decoding packages")
+				return nil, fmt.Errorf("error decoding packages: %w", err)
 			}
 		}
 	}
@@ -465,13 +464,13 @@ func (ms *MetricSet) savePackagesToDisk(packages []*Package) error {
 	for _, pkg := range packages {
 		err := encoder.Encode(*pkg)
 		if err != nil {
-			return errors.Wrap(err, "error encoding packages")
+			return fmt.Errorf("error encoding packages: %w", err)
 		}
 	}
 
 	err := ms.bucket.Store(bucketKeyPackages, buf.Bytes())
 	if err != nil {
-		return errors.Wrap(err, "error writing packages to disk")
+		return fmt.Errorf("error writing packages to disk: %w", err)
 	}
 	return nil
 }
@@ -485,13 +484,13 @@ func (ms *MetricSet) getPackages() (packages []*Package, err error) {
 
 		rpmPackages, err := listRPMPackages()
 		if err != nil {
-			return nil, errors.Wrap(err, "error getting RPM packages")
+			return nil, fmt.Errorf("error getting RPM packages: %w", err)
 		}
 		ms.log.Debugf("RPM packages: %v", len(rpmPackages))
 
 		packages = append(packages, rpmPackages...)
 	} else if err != nil && !os.IsNotExist(err) {
-		return nil, errors.Wrapf(err, "error opening %v", rpmPath)
+		return nil, fmt.Errorf("error opening %v: %w", rpmPath, err)
 	}
 
 	_, err = os.Stat(dpkgPath)
@@ -500,13 +499,13 @@ func (ms *MetricSet) getPackages() (packages []*Package, err error) {
 
 		dpkgPackages, err := ms.listDebPackages()
 		if err != nil {
-			return nil, errors.Wrap(err, "error getting DEB packages")
+			return nil, fmt.Errorf("error getting DEB packages: %w", err)
 		}
 		ms.log.Debugf("DEB packages: %v", len(dpkgPackages))
 
 		packages = append(packages, dpkgPackages...)
 	} else if err != nil && !os.IsNotExist(err) {
-		return nil, errors.Wrapf(err, "error opening %v", dpkgPath)
+		return nil, fmt.Errorf("error opening %v: %w", dpkgPath, err)
 	}
 
 	_, err = os.Stat(homebrewCellarPath)
@@ -515,13 +514,13 @@ func (ms *MetricSet) getPackages() (packages []*Package, err error) {
 
 		homebrewPackages, err := listBrewPackages()
 		if err != nil {
-			return nil, errors.Wrap(err, "error getting Homebrew packages")
+			return nil, fmt.Errorf("error getting Homebrew packages: %w", err)
 		}
 		ms.log.Debugf("Homebrew packages: %v", len(homebrewPackages))
 
 		packages = append(packages, homebrewPackages...)
 	} else if err != nil && !os.IsNotExist(err) {
-		return nil, errors.Wrapf(err, "error opening %v", homebrewCellarPath)
+		return nil, fmt.Errorf("error opening %v: %w", homebrewCellarPath, err)
 	}
 
 	if !foundPackageManager && !ms.suppressNoPackageWarnings {
@@ -540,7 +539,7 @@ func (ms *MetricSet) listDebPackages() ([]*Package, error) {
 
 	file, err := os.Open(dpkgStatusFile)
 	if err != nil {
-		return nil, errors.Wrapf(err, "error opening %s", dpkgStatusFile)
+		return nil, fmt.Errorf("error opening %s: %w", dpkgStatusFile, err)
 	}
 	defer file.Close()
 
@@ -611,7 +610,7 @@ func (ms *MetricSet) listDebPackages() ([]*Package, error) {
 	}
 
 	if err = scanner.Err(); err != nil {
-		return nil, errors.Wrapf(err, "error scanning file %v", dpkgStatusFile)
+		return nil, fmt.Errorf("error scanning file %v: %w", dpkgStatusFile, err)
 	}
 
 	// Append last package if file ends without newline
diff --git a/x-pack/auditbeat/module/system/package/package_homebrew.go b/x-pack/auditbeat/module/system/package/package_homebrew.go
index 8227e5e0241b..a04bb9de17c6 100644
--- a/x-pack/auditbeat/module/system/package/package_homebrew.go
+++ b/x-pack/auditbeat/module/system/package/package_homebrew.go
@@ -10,12 +10,11 @@ package pkg
 import (
 	"bufio"
 	"encoding/json"
+	"fmt"
 	"io/ioutil"
 	"os"
 	"path"
 	"strings"
-
-	"github.com/pkg/errors"
 )
 
 // InstallReceiptSource represents the "source" object in Homebrew's INSTALL_RECEIPT.json.
@@ -42,7 +41,7 @@ func listBrewPackages() ([]*Package, error) {
 		pkgPath := path.Join(homebrewCellarPath, packageDir.Name())
 		versions, err := ioutil.ReadDir(pkgPath)
 		if err != nil {
-			return nil, errors.Wrapf(err, "error reading directory: %s", pkgPath)
+			return nil, fmt.Errorf("error reading directory: %s: %w", pkgPath, err)
 		}
 
 		for _, version := range versions {
@@ -61,12 +60,12 @@ func listBrewPackages() ([]*Package, error) {
 			installReceiptPath := path.Join(homebrewCellarPath, pkg.Name, pkg.Version, "INSTALL_RECEIPT.json")
 			contents, err := ioutil.ReadFile(installReceiptPath)
 			if err != nil {
-				pkg.error = errors.Wrapf(err, "error reading %v", installReceiptPath)
+				pkg.error = fmt.Errorf("error reading %v: %w", installReceiptPath, err)
 			} else {
 				var installReceipt InstallReceipt
 				err = json.Unmarshal(contents, &installReceipt)
 				if err != nil {
-					pkg.error = errors.Wrapf(err, "error unmarshalling JSON in %v", installReceiptPath)
+					pkg.error = fmt.Errorf("error unmarshalling JSON in %v: %w", installReceiptPath, err)
 				} else {
 					formulaPath = installReceipt.Source.Path
 				}
@@ -79,7 +78,7 @@ func listBrewPackages() ([]*Package, error) {
 
 			file, err := os.Open(formulaPath)
 			if err != nil {
-				pkg.error = errors.Wrapf(err, "error reading %v", formulaPath)
+				pkg.error = fmt.Errorf("error reading %v: %w", formulaPath, err)
 			} else {
 				defer file.Close()
 
@@ -98,7 +97,7 @@ func listBrewPackages() ([]*Package, error) {
 					}
 				}
 				if err = scanner.Err(); err != nil {
-					pkg.error = errors.Wrapf(err, "error parsing %v", formulaPath)
+					pkg.error = fmt.Errorf("error parsing %v: %w", formulaPath, err)
 				}
 			}
 
diff --git a/x-pack/auditbeat/module/system/package/package_test.go b/x-pack/auditbeat/module/system/package/package_test.go
index 25b53a3feb82..e745d1e76324 100644
--- a/x-pack/auditbeat/module/system/package/package_test.go
+++ b/x-pack/auditbeat/module/system/package/package_test.go
@@ -193,7 +193,7 @@ func TestPackageGobEncodeDecode(t *testing.T) {
 	if *flagUpdateGob {
 		// NOTE: If you are updating this file then you may have introduced a
 		// a breaking change.
-		if err := ioutil.WriteFile(gobTestFile, buf.Bytes(), 0644); err != nil {
+		if err := ioutil.WriteFile(gobTestFile, buf.Bytes(), 0o644); err != nil {
 			t.Fatal(err)
 		}
 	}
diff --git a/x-pack/auditbeat/module/system/package/rpm_linux.go b/x-pack/auditbeat/module/system/package/rpm_linux.go
index 3215bcf9c168..58e9a9a4a897 100644
--- a/x-pack/auditbeat/module/system/package/rpm_linux.go
+++ b/x-pack/auditbeat/module/system/package/rpm_linux.go
@@ -214,11 +214,11 @@ func (lib *librpm) close() error {
 // version number.  getLibrpmNames looks at the elf header for the rpm
 // binary to determine what version of librpm.so it is linked against.
 func getLibrpmNames() []string {
-	var rpmPaths = []string{
+	rpmPaths := []string{
 		"/usr/bin/rpm",
 		"/bin/rpm",
 	}
-	var libNames = []string{
+	libNames := []string{
 		"librpm.so",
 	}
 	var rpmElf *elf.File
@@ -249,7 +249,6 @@ func getLibrpmNames() []string {
 }
 
 func openLibrpm() (*librpm, error) {
-
 	var librpm librpm
 	var err error
 
@@ -383,7 +382,6 @@ func listRPMPackages() ([]*Package, error) {
 }
 
 func packageFromHeader(header C.Header, openedLibrpm *librpm) (*Package, error) {
-
 	header = C.my_headerLink(openedLibrpm.headerLink, header)
 	if header == nil {
 		return nil, fmt.Errorf("Error calling headerLink")
diff --git a/x-pack/auditbeat/module/system/package/rpm_others.go b/x-pack/auditbeat/module/system/package/rpm_others.go
index 8e441026ff3b..77cd42f42142 100644
--- a/x-pack/auditbeat/module/system/package/rpm_others.go
+++ b/x-pack/auditbeat/module/system/package/rpm_others.go
@@ -8,7 +8,7 @@
 
 package pkg
 
-import "github.com/pkg/errors"
+import "errors"
 
 func listRPMPackages() ([]*Package, error) {
 	return nil, errors.New("listing RPM packages is only supported on Linux")
diff --git a/x-pack/auditbeat/module/system/process/namepace_linux.go b/x-pack/auditbeat/module/system/process/namepace_linux.go
index 148f22910b40..62146f7a203a 100644
--- a/x-pack/auditbeat/module/system/process/namepace_linux.go
+++ b/x-pack/auditbeat/module/system/process/namepace_linux.go
@@ -8,11 +8,10 @@
 package process
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"syscall"
-
-	"github.com/pkg/errors"
 )
 
 // isNsSharedWith returns whether the process with the given pid shares the
diff --git a/x-pack/auditbeat/module/system/process/process.go b/x-pack/auditbeat/module/system/process/process.go
index 74b48ad61183..8895222cec80 100644
--- a/x-pack/auditbeat/module/system/process/process.go
+++ b/x-pack/auditbeat/module/system/process/process.go
@@ -15,7 +15,6 @@ import (
 
 	"github.com/cespare/xxhash/v2"
 	"github.com/gofrs/uuid"
-	"github.com/pkg/errors"
 
 	"github.com/elastic/beats/v7/auditbeat/datastore"
 	"github.com/elastic/beats/v7/auditbeat/helper/hasher"
@@ -148,12 +147,12 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) {
 
 	config := defaultConfig
 	if err := base.Module().UnpackConfig(&config); err != nil {
-		return nil, errors.Wrapf(err, "failed to unpack the %v/%v config", moduleName, metricsetName)
+		return nil, fmt.Errorf("failed to unpack the %v/%v config: %w", moduleName, metricsetName, err)
 	}
 
 	bucket, err := datastore.OpenBucket(bucketName)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to open persistent datastore")
+		return nil, fmt.Errorf("failed to open persistent datastore: %w", err)
 	}
 
 	hasher, err := hasher.NewFileHasher(config.HasherConfig, nil)
@@ -231,13 +230,13 @@ func (ms *MetricSet) reportState(report mb.ReporterV2) error {
 
 	processes, err := ms.getProcesses()
 	if err != nil {
-		return errors.Wrap(err, "failed to get process infos")
+		return fmt.Errorf("failed to get process infos: %w", err)
 	}
 	ms.log.Debugf("Found %v processes", len(processes))
 
 	stateID, err := uuid.NewV4()
 	if err != nil {
-		return errors.Wrap(err, "error generating state ID")
+		return fmt.Errorf("error generating state ID: %w", err)
 	}
 	for _, p := range processes {
 		ms.enrichProcess(p)
@@ -264,7 +263,7 @@ func (ms *MetricSet) reportState(report mb.ReporterV2) error {
 	}
 	err = ms.bucket.Store(bucketKeyStateTimestamp, timeBytes)
 	if err != nil {
-		return errors.Wrap(err, "error writing state timestamp to disk")
+		return fmt.Errorf("error writing state timestamp to disk: %w", err)
 	}
 
 	return nil
@@ -274,7 +273,7 @@ func (ms *MetricSet) reportState(report mb.ReporterV2) error {
 func (ms *MetricSet) reportChanges(report mb.ReporterV2) error {
 	processes, err := ms.getProcesses()
 	if err != nil {
-		return errors.Wrap(err, "failed to get processes")
+		return fmt.Errorf("failed to get processes: %w", err)
 	}
 	ms.log.Debugf("Found %v processes", len(processes))
 
@@ -322,8 +321,7 @@ func (ms *MetricSet) enrichProcess(process *Process) {
 		sharedMntNS, err := isNsSharedWith(process.Info.PID, "mnt")
 		if err != nil {
 			if process.Error == nil {
-				process.Error = errors.Wrapf(err, "failed to get namespaces for %v PID %v", process.Info.Exe,
-					process.Info.PID)
+				process.Error = fmt.Errorf("failed to get namespaces for %v PID %v: %w", process.Info.Exe, process.Info.PID, err)
 			}
 			return
 		}
@@ -333,8 +331,7 @@ func (ms *MetricSet) enrichProcess(process *Process) {
 		hashes, err := ms.hasher.HashFile(process.Info.Exe)
 		if err != nil {
 			if process.Error == nil {
-				process.Error = errors.Wrapf(err, "failed to hash executable %v for PID %v", process.Info.Exe,
-					process.Info.PID)
+				process.Error = fmt.Errorf("failed to hash executable %v for PID %v: %w", process.Info.Exe, process.Info.PID, err)
 			}
 			return
 		}
@@ -442,7 +439,7 @@ func (ms *MetricSet) getProcesses() ([]*Process, error) {
 
 	sysinfoProcs, err := sysinfo.Processes()
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to fetch processes")
+		return nil, fmt.Errorf("failed to fetch processes: %w", err)
 	}
 
 	for _, sysinfoProc := range sysinfoProcs {
@@ -473,7 +470,7 @@ func (ms *MetricSet) getProcesses() ([]*Process, error) {
 			// Record what we can and continue
 			process = &Process{
 				Info:  pInfo,
-				Error: errors.Wrapf(err, "failed to load process information for PID %d", sysinfoProc.PID()),
+				Error: fmt.Errorf("failed to load process information for PID %d: %w", sysinfoProc.PID(), err),
 			}
 			process.Info.PID = sysinfoProc.PID() // in case pInfo did not contain it
 		} else {
@@ -485,7 +482,7 @@ func (ms *MetricSet) getProcesses() ([]*Process, error) {
 		userInfo, err := sysinfoProc.User()
 		if err != nil {
 			if process.Error == nil {
-				process.Error = errors.Wrapf(err, "failed to load user for PID %d", sysinfoProc.PID())
+				process.Error = fmt.Errorf("failed to load user for PID %d: %w", sysinfoProc.PID(), err)
 			}
 		} else {
 			process.UserInfo = &userInfo
diff --git a/x-pack/auditbeat/module/system/socket/dns/afpacket/afpacket.go b/x-pack/auditbeat/module/system/socket/dns/afpacket/afpacket.go
index 9c430bb2023f..1eb4ede3735c 100644
--- a/x-pack/auditbeat/module/system/socket/dns/afpacket/afpacket.go
+++ b/x-pack/auditbeat/module/system/socket/dns/afpacket/afpacket.go
@@ -9,13 +9,14 @@ package afpacket
 
 import (
 	"context"
+	"errors"
+	"fmt"
 	"net"
 	"os"
 	"time"
 
 	"github.com/dustin/go-humanize"
 	"github.com/miekg/dns"
-	"github.com/pkg/errors"
 	"golang.org/x/net/bpf"
 
 	"github.com/elastic/beats/v7/metricbeat/mb"
@@ -59,7 +60,7 @@ func init() {
 func newAFPacketSniffer(base mb.BaseMetricSet, log *logp.Logger) (parent.Sniffer, error) {
 	config := defaultConfig()
 	if err := base.Module().UnpackConfig(&config); err != nil {
-		return nil, errors.Wrap(err, "failed to unpack af_packet config")
+		return nil, fmt.Errorf("failed to unpack af_packet config: %w", err)
 	}
 
 	frameSize, blockSize, numBlocks, err := afpacketComputeSize(8*humanize.MiByte, config.Snaplen, os.Getpagesize())
@@ -83,12 +84,12 @@ func newAFPacketSniffer(base mb.BaseMetricSet, log *logp.Logger) (parent.Sniffer
 
 	tPacket, err := afpacket.NewTPacket(opts...)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed creating af_packet sniffer")
+		return nil, fmt.Errorf("failed creating af_packet sniffer: %w", err)
 	}
 
 	if err = tPacket.SetBPF(udpSrcPort53Filter); err != nil {
 		tPacket.Close()
-		return nil, errors.Wrapf(err, "failed setting BPF filter")
+		return nil, fmt.Errorf("failed setting BPF filter: %w", err)
 	}
 
 	c := &dnsCapture{
@@ -226,8 +227,8 @@ func (c *dnsCapture) run(ctx context.Context, consumer parent.Consumer) {
 // The restriction is that the block_size must be divisible by both the
 // frame size and page size.
 func afpacketComputeSize(targetSize int, snaplen int, pageSize int) (
-	frameSize int, blockSize int, numBlocks int, err error) {
-
+	frameSize int, blockSize int, numBlocks int, err error,
+) {
 	if snaplen < pageSize {
 		frameSize = pageSize / (pageSize / snaplen)
 	} else {
diff --git a/x-pack/auditbeat/module/system/socket/dns/dns.go b/x-pack/auditbeat/module/system/socket/dns/dns.go
index 87c7a01d4490..b1efec3d8f8d 100644
--- a/x-pack/auditbeat/module/system/socket/dns/dns.go
+++ b/x-pack/auditbeat/module/system/socket/dns/dns.go
@@ -6,10 +6,9 @@ package dns
 
 import (
 	"context"
+	"fmt"
 	"net"
 
-	"github.com/pkg/errors"
-
 	"github.com/elastic/beats/v7/libbeat/logp"
 	"github.com/elastic/beats/v7/metricbeat/mb"
 )
@@ -52,7 +51,7 @@ func (noopSniffer) Monitor(context.Context, Consumer) error {
 func NewSniffer(base mb.BaseMetricSet, log *logp.Logger) (Sniffer, error) {
 	config := defaultConfig()
 	if err := base.Module().UnpackConfig(&config); err != nil {
-		return nil, errors.Wrap(err, "failed to unpack dns config")
+		return nil, fmt.Errorf("failed to unpack dns config: %w", err)
 	}
 	if !config.Enabled {
 		return noopSniffer{}, nil
diff --git a/x-pack/auditbeat/module/system/socket/guess/cskxmit6.go b/x-pack/auditbeat/module/system/socket/guess/cskxmit6.go
index bc86aa817b55..9c17f5136e80 100644
--- a/x-pack/auditbeat/module/system/socket/guess/cskxmit6.go
+++ b/x-pack/auditbeat/module/system/socket/guess/cskxmit6.go
@@ -11,7 +11,6 @@ import (
 	"fmt"
 	"unsafe"
 
-	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
 
 	"github.com/elastic/beats/v7/libbeat/common"
@@ -107,7 +106,7 @@ func (g *guessInet6CskXmit) Prepare(ctx Context) (err error) {
 	g.acceptedFd = -1
 	g.loopback, err = helper.NewIPv6Loopback()
 	if err != nil {
-		return errors.Wrap(err, "detect IPv6 loopback failed")
+		return fmt.Errorf("detect IPv6 loopback failed: %w", err)
 	}
 	defer func() {
 		if err != nil {
@@ -116,26 +115,26 @@ func (g *guessInet6CskXmit) Prepare(ctx Context) (err error) {
 	}()
 	clientIP, err := g.loopback.AddRandomAddress()
 	if err != nil {
-		return errors.Wrap(err, "failed adding first device address")
+		return fmt.Errorf("failed adding first device address: %w", err)
 	}
 	serverIP, err := g.loopback.AddRandomAddress()
 	if err != nil {
-		return errors.Wrap(err, "failed adding second device address")
+		return fmt.Errorf("failed adding second device address: %w", err)
 	}
 	copy(g.clientAddr.Addr[:], clientIP)
 	copy(g.serverAddr.Addr[:], serverIP)
 
 	if g.client, g.clientAddr, err = createSocket6WithProto(unix.SOCK_STREAM, g.clientAddr); err != nil {
-		return errors.Wrap(err, "error creating server")
+		return fmt.Errorf("error creating server: %w", err)
 	}
 	if g.server, g.serverAddr, err = createSocket6WithProto(unix.SOCK_STREAM, g.serverAddr); err != nil {
-		return errors.Wrap(err, "error creating client")
+		return fmt.Errorf("error creating client: %w", err)
 	}
 	if err = unix.Listen(g.server, 1); err != nil {
-		return errors.Wrap(err, "error in listen")
+		return fmt.Errorf("error in listen: %w", err)
 	}
 	if err = unix.Connect(g.client, &g.serverAddr); err != nil {
-		return errors.Wrap(err, "connect failed")
+		return fmt.Errorf("connect failed: %w", err)
 	}
 	return nil
 }
@@ -156,7 +155,7 @@ func (g *guessInet6CskXmit) Terminate() error {
 func (g *guessInet6CskXmit) Trigger() error {
 	fd, _, err := unix.Accept(g.server)
 	if err != nil {
-		return errors.Wrap(err, "accept failed")
+		return fmt.Errorf("accept failed: %w", err)
 	}
 	_, err = unix.Write(fd, []byte("hello world"))
 	return err
diff --git a/x-pack/auditbeat/module/system/socket/guess/guess.go b/x-pack/auditbeat/module/system/socket/guess/guess.go
index e9040bb6a66e..c31233b6d3d2 100644
--- a/x-pack/auditbeat/module/system/socket/guess/guess.go
+++ b/x-pack/auditbeat/module/system/socket/guess/guess.go
@@ -8,11 +8,10 @@
 package guess
 
 import (
+	"errors"
 	"fmt"
 	"time"
 
-	"github.com/pkg/errors"
-
 	"github.com/elastic/beats/v7/libbeat/common"
 	"github.com/elastic/beats/v7/x-pack/auditbeat/module/system/socket/helper"
 	"github.com/elastic/beats/v7/x-pack/auditbeat/tracing"
@@ -98,7 +97,7 @@ func Guess(guesser Guesser, installer helper.ProbeInstaller, ctx Context) (resul
 		result, err = guessOnce(guesser, installer, ctx)
 	}
 	if err != nil {
-		return nil, errors.Wrapf(err, "%s failed", guesser.Name())
+		return nil, fmt.Errorf("%s failed: %w", guesser.Name(), err)
 	}
 	return result, nil
 }
@@ -132,7 +131,7 @@ func guessEventually(guess EventualGuesser, installer helper.ProbeInstaller, ctx
 
 func guessOnce(guesser Guesser, installer helper.ProbeInstaller, ctx Context) (result common.MapStr, err error) {
 	if err := guesser.Prepare(ctx); err != nil {
-		return nil, errors.Wrap(err, "prepare failed")
+		return nil, fmt.Errorf("prepare failed: %w", err)
 	}
 	defer func() {
 		if err := guesser.Terminate(); err != nil {
@@ -141,7 +140,7 @@ func guessOnce(guesser Guesser, installer helper.ProbeInstaller, ctx Context) (r
 	}()
 	probes, err := guesser.Probes()
 	if err != nil {
-		return nil, errors.Wrap(err, "failed generating probes")
+		return nil, fmt.Errorf("failed generating probes: %w", err)
 	}
 
 	decoders := make([]tracing.Decoder, 0, len(probes))
@@ -150,7 +149,7 @@ func guessOnce(guesser Guesser, installer helper.ProbeInstaller, ctx Context) (r
 	for _, pdesc := range probes {
 		format, decoder, err := installer.Install(pdesc)
 		if err != nil {
-			return nil, errors.Wrapf(err, "failed to add kprobe '%s'", pdesc.Probe.String())
+			return nil, fmt.Errorf("failed to add kprobe '%s': %w", pdesc.Probe.String(), err)
 		}
 		formats = append(formats, format)
 		decoders = append(decoders, decoder)
@@ -177,18 +176,18 @@ func guessOnce(guesser Guesser, installer helper.ProbeInstaller, ctx Context) (r
 		tracing.WithTID(thread.TID),
 		tracing.WithPollTimeout(time.Millisecond*10))
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to create perfchannel")
+		return nil, fmt.Errorf("failed to create perfchannel: %w", err)
 	}
 	defer perfchan.Close()
 
 	for i := range probes {
 		if err := perfchan.MonitorProbe(formats[i], decoders[i]); err != nil {
-			return nil, errors.Wrap(err, "failed to monitor probe")
+			return nil, fmt.Errorf("failed to monitor probe: %w", err)
 		}
 	}
 
 	if err := perfchan.Run(); err != nil {
-		return nil, errors.Wrap(err, "failed to run perf channel")
+		return nil, fmt.Errorf("failed to run perf channel: %w", err)
 	}
 
 	timer := time.NewTimer(ctx.Timeout)
@@ -211,7 +210,7 @@ func guessOnce(guesser Guesser, installer helper.ProbeInstaller, ctx Context) (r
 	select {
 	case r := <-thread.C():
 		if r.Err != nil {
-			return nil, errors.Wrap(r.Err, "trigger execution failed")
+			return nil, fmt.Errorf("trigger execution failed: %w", r.Err)
 		}
 	case <-timer.C:
 		return nil, errors.New("timeout while waiting for trigger to complete")
@@ -233,7 +232,7 @@ func guessOnce(guesser Guesser, installer helper.ProbeInstaller, ctx Context) (r
 
 		case err := <-perfchan.ErrC():
 			if err != nil {
-				return nil, errors.Wrap(err, "error received from perf channel")
+				return nil, fmt.Errorf("error received from perf channel: %w", err)
 			}
 
 		case <-perfchan.LostC():
@@ -265,7 +264,7 @@ func GuessAll(installer helper.ProbeInstaller, ctx Context) (err error) {
 			if cond, isCond := guesser.(ConditionalGuesser); isCond {
 				mustRun, err := cond.Condition(ctx)
 				if err != nil {
-					return errors.Wrapf(err, "condition failed for %s", cond.Name())
+					return fmt.Errorf("condition failed for %s: %w", cond.Name(), err)
 				}
 				if !mustRun {
 					ctx.Log.Debugf("Guess %s skipped.", cond.Name())
diff --git a/x-pack/auditbeat/module/system/socket/guess/helpers.go b/x-pack/auditbeat/module/system/socket/guess/helpers.go
index d0b9a2875bfb..aa802fa252af 100644
--- a/x-pack/auditbeat/module/system/socket/guess/helpers.go
+++ b/x-pack/auditbeat/module/system/socket/guess/helpers.go
@@ -9,10 +9,10 @@ package guess
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
 	"math/rand"
 
-	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
 
 	"github.com/elastic/beats/v7/libbeat/common"
@@ -29,17 +29,17 @@ func createSocketWithProto(proto int, bindAddr unix.SockaddrInet4) (fd int, addr
 	}
 	if err = unix.Bind(fd, &bindAddr); err != nil {
 		unix.Close(fd)
-		return -1, addr, errors.Wrap(err, "bind failed")
+		return -1, addr, fmt.Errorf("bind failed: %w", err)
 	}
 	sa, err := unix.Getsockname(fd)
 	if err != nil {
 		unix.Close(fd)
-		return -1, addr, errors.Wrap(err, "getsockname failed")
+		return -1, addr, fmt.Errorf("getsockname failed: %w", err)
 	}
 	addrptr, ok := sa.(*unix.SockaddrInet4)
 	if !ok {
 		unix.Close(fd)
-		return -1, addr, errors.Wrap(err, "getsockname didn't return a struct sockaddr_in")
+		return -1, addr, errors.New("getsockname didn't return a struct sockaddr_in")
 	}
 	return fd, *addrptr, nil
 }
@@ -56,15 +56,15 @@ func createSocket6WithProto(proto int, bindAddr unix.SockaddrInet6) (fd int, add
 		}
 	}()
 	if err = unix.Bind(fd, &bindAddr); err != nil {
-		return -1, addr, errors.Wrap(err, "bind failed")
+		return -1, addr, fmt.Errorf("bind failed: %w", err)
 	}
 	sa, err := unix.Getsockname(fd)
 	if err != nil {
-		return -1, addr, errors.Wrap(err, "getsockname failed")
+		return -1, addr, fmt.Errorf("getsockname failed: %w", err)
 	}
 	addrptr, ok := sa.(*unix.SockaddrInet6)
 	if !ok {
-		return -1, addr, errors.Wrap(err, "getsockname didn't return a struct sockaddr_in")
+		return -1, addr, errors.New("getsockname didn't return a struct sockaddr_in")
 	}
 	return fd, *addrptr, nil
 }
diff --git a/x-pack/auditbeat/module/system/socket/guess/inetsock.go b/x-pack/auditbeat/module/system/socket/guess/inetsock.go
index 8e435d42b030..8139bcf3ba77 100644
--- a/x-pack/auditbeat/module/system/socket/guess/inetsock.go
+++ b/x-pack/auditbeat/module/system/socket/guess/inetsock.go
@@ -10,8 +10,8 @@ package guess
 import (
 	"bytes"
 	"encoding/binary"
+	"fmt"
 
-	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
 
 	"github.com/elastic/beats/v7/libbeat/common"
@@ -105,13 +105,13 @@ func (g *guessInetSockIPv4) Prepare(ctx Context) (err error) {
 		g.remote.Addr = randomLocalIP()
 	}
 	if g.server, g.local, err = createSocket(g.local); err != nil {
-		return errors.Wrap(err, "error creating server")
+		return fmt.Errorf("error creating server: %w", err)
 	}
 	if g.client, g.remote, err = createSocket(g.remote); err != nil {
-		return errors.Wrap(err, "error creating client")
+		return fmt.Errorf("error creating client: %w", err)
 	}
 	if err = unix.Listen(g.server, 1); err != nil {
-		return errors.Wrap(err, "error in listen")
+		return fmt.Errorf("error in listen: %w", err)
 	}
 	return nil
 }
@@ -204,7 +204,8 @@ func (g *guessInetSockIPv4) Reduce(results []common.MapStr) (result common.MapSt
 
 	for _, key := range []string{
 		"INET_SOCK_LADDR", "INET_SOCK_LPORT",
-		"INET_SOCK_RADDR", "INET_SOCK_RPORT"} {
+		"INET_SOCK_RADDR", "INET_SOCK_RPORT",
+	} {
 		list, err := getListField(result, key)
 		if err != nil {
 			return nil, err
diff --git a/x-pack/auditbeat/module/system/socket/guess/inetsock6.go b/x-pack/auditbeat/module/system/socket/guess/inetsock6.go
index b61486849bc2..a66e5d144179 100644
--- a/x-pack/auditbeat/module/system/socket/guess/inetsock6.go
+++ b/x-pack/auditbeat/module/system/socket/guess/inetsock6.go
@@ -12,7 +12,6 @@ import (
 	"fmt"
 	"strings"
 
-	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
 
 	"github.com/elastic/beats/v7/libbeat/common"
@@ -234,7 +233,7 @@ func (g *guessInetSockIPv6) Prepare(ctx Context) (err error) {
 	}
 	g.loopback, err = helper.NewIPv6Loopback()
 	if err != nil {
-		return errors.Wrap(err, "detect IPv6 loopback failed")
+		return fmt.Errorf("detect IPv6 loopback failed: %w", err)
 	}
 	defer func() {
 		if err != nil {
@@ -243,23 +242,23 @@ func (g *guessInetSockIPv6) Prepare(ctx Context) (err error) {
 	}()
 	clientIP, err := g.loopback.AddRandomAddress()
 	if err != nil {
-		return errors.Wrap(err, "failed adding first device address")
+		return fmt.Errorf("failed adding first device address: %w", err)
 	}
 	serverIP, err := g.loopback.AddRandomAddress()
 	if err != nil {
-		return errors.Wrap(err, "failed adding second device address")
+		return fmt.Errorf("failed adding second device address: %w", err)
 	}
 	copy(g.clientAddr.Addr[:], clientIP)
 	copy(g.serverAddr.Addr[:], serverIP)
 
 	if g.client, g.clientAddr, err = createSocket6WithProto(unix.SOCK_STREAM, g.clientAddr); err != nil {
-		return errors.Wrap(err, "error creating server")
+		return fmt.Errorf("error creating server: %w", err)
 	}
 	if g.server, g.serverAddr, err = createSocket6WithProto(unix.SOCK_STREAM, g.serverAddr); err != nil {
-		return errors.Wrap(err, "error creating client")
+		return fmt.Errorf("error creating client: %w", err)
 	}
 	if err = unix.Listen(g.server, 1); err != nil {
-		return errors.Wrap(err, "error in listen")
+		return fmt.Errorf("error in listen: %w", err)
 	}
 	return nil
 }
@@ -267,11 +266,11 @@ func (g *guessInetSockIPv6) Prepare(ctx Context) (err error) {
 // Trigger connects the client to the server, causing an inet_csk_accept call.
 func (g *guessInetSockIPv6) Trigger() error {
 	if err := unix.Connect(g.client, &g.serverAddr); err != nil {
-		return errors.Wrap(err, "connect failed")
+		return fmt.Errorf("connect failed: %w", err)
 	}
 	fd, _, err := unix.Accept(g.server)
 	if err != nil {
-		return errors.Wrap(err, "accept failed")
+		return fmt.Errorf("accept failed: %w", err)
 	}
 	unix.Close(fd)
 	return nil
diff --git a/x-pack/auditbeat/module/system/socket/guess/inetsockaf.go b/x-pack/auditbeat/module/system/socket/guess/inetsockaf.go
index 293a79eff91f..fd53364c892f 100644
--- a/x-pack/auditbeat/module/system/socket/guess/inetsockaf.go
+++ b/x-pack/auditbeat/module/system/socket/guess/inetsockaf.go
@@ -8,7 +8,8 @@
 package guess
 
 import (
-	"github.com/pkg/errors"
+	"errors"
+
 	"golang.org/x/sys/unix"
 
 	"github.com/elastic/beats/v7/libbeat/common"
diff --git a/x-pack/auditbeat/module/system/socket/guess/skbuff.go b/x-pack/auditbeat/module/system/socket/guess/skbuff.go
index a90a49644a46..be2a9bd678d6 100644
--- a/x-pack/auditbeat/module/system/socket/guess/skbuff.go
+++ b/x-pack/auditbeat/module/system/socket/guess/skbuff.go
@@ -10,11 +10,11 @@ package guess
 import (
 	"encoding/binary"
 	"encoding/hex"
+	"errors"
 	"fmt"
 	"math/rand"
 	"unsafe"
 
-	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
 
 	"github.com/elastic/beats/v7/libbeat/common"
@@ -135,7 +135,7 @@ func (g *guessSkBuffLen) Extract(ev interface{}) (common.MapStr, bool) {
 		uIntSize          = 4
 		n                 = skbuffDumpSize / uIntSize
 		maxOverhead       = 128
-		minHeadersSize    = 0 //20 /* min IP*/ + 20 /* min TCP */
+		minHeadersSize    = 0 // 20 /* min IP*/ + 20 /* min TCP */
 		ipHeaderSizeChunk = 4
 	)
 	target := uint32(g.written)
@@ -281,14 +281,14 @@ func (g *guessSkBuffProto) Prepare(ctx Context) (err error) {
 	g.ctx = ctx
 	g.hasIPv6, err = isIPv6Enabled(ctx.Vars)
 	if err != nil {
-		return errors.Wrap(err, "unable to determine if IPv6 is enabled")
+		return fmt.Errorf("unable to determine if IPv6 is enabled: %w", err)
 	}
 	g.doIPv6 = g.hasIPv6 && !g.doIPv6
 	g.msg = make([]byte, 0x123)
 	if g.doIPv6 {
 		g.loopback, err = helper.NewIPv6Loopback()
 		if err != nil {
-			return errors.Wrap(err, "detect IPv6 loopback failed")
+			return fmt.Errorf("detect IPv6 loopback failed: %w", err)
 		}
 		defer func() {
 			if err != nil {
@@ -297,20 +297,20 @@ func (g *guessSkBuffProto) Prepare(ctx Context) (err error) {
 		}()
 		clientIP, err := g.loopback.AddRandomAddress()
 		if err != nil {
-			return errors.Wrap(err, "failed adding first device address")
+			return fmt.Errorf("failed adding first device address: %w", err)
 		}
 		serverIP, err := g.loopback.AddRandomAddress()
 		if err != nil {
-			return errors.Wrap(err, "failed adding second device address")
+			return fmt.Errorf("failed adding second device address: %w", err)
 		}
 		copy(g.clientAddr.Addr[:], clientIP)
 		copy(g.serverAddr.Addr[:], serverIP)
 
 		if g.client, g.clientAddr, err = createSocket6WithProto(unix.SOCK_DGRAM, g.clientAddr); err != nil {
-			return errors.Wrap(err, "error creating server")
+			return fmt.Errorf("error creating server: %w", err)
 		}
 		if g.server, g.serverAddr, err = createSocket6WithProto(unix.SOCK_DGRAM, g.serverAddr); err != nil {
-			return errors.Wrap(err, "error creating client")
+			return fmt.Errorf("error creating client: %w", err)
 		}
 	} else {
 		g.cs.SetupUDP()
@@ -334,17 +334,17 @@ func (g *guessSkBuffProto) Terminate() (err error) {
 func (g *guessSkBuffProto) Trigger() error {
 	if g.doIPv6 {
 		if err := unix.Sendto(g.client, g.msg, 0, &g.serverAddr); err != nil {
-			return errors.Wrap(err, "failed to send ipv4")
+			return fmt.Errorf("failed to send ipv4: %w", err)
 		}
 		if _, _, err := unix.Recvfrom(g.server, g.msg, 0); err != nil {
-			return errors.Wrap(err, "failed to receive ipv4")
+			return fmt.Errorf("failed to receive ipv4: %w", err)
 		}
 	} else {
 		if err := unix.Sendto(g.cs.client, g.msg, 0, &g.cs.srvAddr); err != nil {
-			return errors.Wrap(err, "failed to send ipv4")
+			return fmt.Errorf("failed to send ipv4: %w", err)
 		}
 		if _, _, err := unix.Recvfrom(g.cs.server, g.msg, 0); err != nil {
-			return errors.Wrap(err, "failed to receive ipv4")
+			return fmt.Errorf("failed to receive ipv4: %w", err)
 		}
 	}
 	return nil
@@ -591,10 +591,10 @@ func (g *guessSkBuffDataPtr) Terminate() error {
 // Trigger causes a packet to be received at server socket.
 func (g *guessSkBuffDataPtr) Trigger() error {
 	if err := unix.Sendto(g.cs.client, g.payload, 0, &g.cs.srvAddr); err != nil {
-		return errors.Wrap(err, "failed to send ipv4")
+		return fmt.Errorf("failed to send ipv4: %w", err)
 	}
 	if _, _, err := unix.Recvfrom(g.cs.server, g.payload, 0); err != nil {
-		return errors.Wrap(err, "failed to receive ipv4")
+		return fmt.Errorf("failed to receive ipv4: %w", err)
 	}
 	return nil
 }
diff --git a/x-pack/auditbeat/module/system/socket/guess/sockaddrin.go b/x-pack/auditbeat/module/system/socket/guess/sockaddrin.go
index 2817a41e5d9e..78ab0197983f 100644
--- a/x-pack/auditbeat/module/system/socket/guess/sockaddrin.go
+++ b/x-pack/auditbeat/module/system/socket/guess/sockaddrin.go
@@ -10,8 +10,8 @@ package guess
 import (
 	"bytes"
 	"encoding/binary"
+	"fmt"
 
-	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
 
 	"github.com/elastic/beats/v7/libbeat/common"
@@ -92,13 +92,13 @@ func (g *guessSockaddrIn) Prepare(ctx Context) (err error) {
 		g.remote.Addr = randomLocalIP()
 	}
 	if g.server, g.local, err = createSocket(g.local); err != nil {
-		return errors.Wrap(err, "error creating server")
+		return fmt.Errorf("error creating server: %w", err)
 	}
 	if g.client, g.remote, err = createSocket(g.remote); err != nil {
-		return errors.Wrap(err, "error creating client")
+		return fmt.Errorf("error creating client: %w", err)
 	}
 	if err = unix.Listen(g.server, 1); err != nil {
-		return errors.Wrap(err, "error in listen")
+		return fmt.Errorf("error in listen: %w", err)
 	}
 	return nil
 }
diff --git a/x-pack/auditbeat/module/system/socket/guess/sockaddrin6.go b/x-pack/auditbeat/module/system/socket/guess/sockaddrin6.go
index 0ce53e84883c..5a2af0f7f5db 100644
--- a/x-pack/auditbeat/module/system/socket/guess/sockaddrin6.go
+++ b/x-pack/auditbeat/module/system/socket/guess/sockaddrin6.go
@@ -9,8 +9,8 @@ package guess
 
 import (
 	"encoding/binary"
+	"fmt"
 
-	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
 
 	"github.com/elastic/beats/v7/libbeat/common"
@@ -89,7 +89,7 @@ func (g *guessSockaddrIn6) Prepare(ctx Context) (err error) {
 	g.ctx = ctx
 	g.loopback, err = helper.NewIPv6Loopback()
 	if err != nil {
-		return errors.Wrap(err, "detect IPv6 loopback failed")
+		return fmt.Errorf("detect IPv6 loopback failed: %w", err)
 	}
 	defer func() {
 		if err != nil {
@@ -98,23 +98,23 @@ func (g *guessSockaddrIn6) Prepare(ctx Context) (err error) {
 	}()
 	clientIP, err := g.loopback.AddRandomAddress()
 	if err != nil {
-		return errors.Wrap(err, "failed adding first device address")
+		return fmt.Errorf("failed adding first device address: %w", err)
 	}
 	serverIP, err := g.loopback.AddRandomAddress()
 	if err != nil {
-		return errors.Wrap(err, "failed adding second device address")
+		return fmt.Errorf("failed adding second device address: %w", err)
 	}
 	copy(g.clientAddr.Addr[:], clientIP)
 	copy(g.serverAddr.Addr[:], serverIP)
 
 	if g.client, g.clientAddr, err = createSocket6WithProto(unix.SOCK_STREAM, g.clientAddr); err != nil {
-		return errors.Wrap(err, "error creating server")
+		return fmt.Errorf("error creating server: %w", err)
 	}
 	if g.server, g.serverAddr, err = createSocket6WithProto(unix.SOCK_STREAM, g.serverAddr); err != nil {
-		return errors.Wrap(err, "error creating client")
+		return fmt.Errorf("error creating client: %w", err)
 	}
 	if err = unix.Listen(g.server, 1); err != nil {
-		return errors.Wrap(err, "error in listen")
+		return fmt.Errorf("error in listen: %w", err)
 	}
 	return nil
 }
@@ -132,11 +132,11 @@ func (g *guessSockaddrIn6) Terminate() error {
 // Trigger performs a connection attempt on the random address.
 func (g *guessSockaddrIn6) Trigger() error {
 	if err := unix.Connect(g.client, &g.serverAddr); err != nil {
-		return errors.Wrap(err, "connect failed")
+		return fmt.Errorf("connect failed: %w", err)
 	}
 	fd, _, err := unix.Accept(g.server)
 	if err != nil {
-		return errors.Wrap(err, "accept failed")
+		return fmt.Errorf("accept failed: %w", err)
 	}
 	unix.Close(fd)
 	return nil
diff --git a/x-pack/auditbeat/module/system/socket/helper/loopback.go b/x-pack/auditbeat/module/system/socket/helper/loopback.go
index 4cc0ca3eb56d..ae576052213f 100644
--- a/x-pack/auditbeat/module/system/socket/helper/loopback.go
+++ b/x-pack/auditbeat/module/system/socket/helper/loopback.go
@@ -8,13 +8,14 @@
 package helper
 
 import (
+	"errors"
+	"fmt"
 	"math/rand"
 	"net"
 	"time"
 	"unsafe"
 
 	"github.com/joeshaw/multierror"
-	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
 )
 
@@ -47,7 +48,7 @@ func NewIPv6Loopback() (lo IPv6Loopback, err error) {
 	lo.fd = -1
 	devs, err := net.Interfaces()
 	if err != nil {
-		return lo, errors.Wrap(err, "cannot list interfaces")
+		return lo, fmt.Errorf("cannot list interfaces: %w", err)
 	}
 	for _, dev := range devs {
 		addrs, err := dev.Addrs()
@@ -60,14 +61,14 @@ func NewIPv6Loopback() (lo IPv6Loopback, err error) {
 				lo.fd, err = unix.Socket(unix.AF_INET6, unix.SOCK_DGRAM, unix.IPPROTO_IP)
 				if err != nil {
 					lo.fd = -1
-					return lo, errors.Wrap(err, "ipv6 socket failed")
+					return lo, fmt.Errorf("ipv6 socket failed: %w", err)
 				}
 				copy(lo.ifreq.name[:], dev.Name)
 				lo.ifreq.name[len(dev.Name)] = 0
 				_, _, errno := unix.Syscall(unix.SYS_IOCTL, uintptr(lo.fd), unix.SIOCGIFINDEX, uintptr(unsafe.Pointer(&lo.ifreq)))
 				if errno != 0 {
 					unix.Close(lo.fd)
-					return lo, errors.Wrap(errno, "ioctl(SIOCGIFINDEX) failed")
+					return lo, fmt.Errorf("ioctl(SIOCGIFINDEX) failed: %w", errno)
 				}
 				return lo, nil
 			}
@@ -88,7 +89,7 @@ func (lo *IPv6Loopback) AddRandomAddress() (addr net.IP, err error) {
 	req.prefix = 128
 	_, _, e := unix.Syscall(unix.SYS_IOCTL, uintptr(lo.fd), unix.SIOCSIFADDR, uintptr(unsafe.Pointer(&req)))
 	if e != 0 {
-		return nil, errors.Wrap(e, "ioctl SIOCSIFADDR failed")
+		return nil, fmt.Errorf("ioctl SIOCSIFADDR failed: %w", e)
 	}
 	lo.addresses = append(lo.addresses, addr)
 
@@ -97,7 +98,7 @@ func (lo *IPv6Loopback) AddRandomAddress() (addr net.IP, err error) {
 	// available to bind.
 	fd, err := unix.Socket(unix.AF_INET6, unix.SOCK_DGRAM, 0)
 	if err != nil {
-		return addr, errors.Wrap(err, "socket ipv6 dgram failed")
+		return addr, fmt.Errorf("socket ipv6 dgram failed: %w", err)
 	}
 	defer unix.Close(fd)
 	var bindAddr unix.SockaddrInet6
diff --git a/x-pack/auditbeat/module/system/socket/kprobes.go b/x-pack/auditbeat/module/system/socket/kprobes.go
index 67d86d6237d6..f56d542020a5 100644
--- a/x-pack/auditbeat/module/system/socket/kprobes.go
+++ b/x-pack/auditbeat/module/system/socket/kprobes.go
@@ -8,12 +8,12 @@
 package socket
 
 import (
+	"errors"
 	"fmt"
 	"strings"
 	"unsafe"
 
 	"github.com/joeshaw/multierror"
-	"github.com/pkg/errors"
 
 	"github.com/elastic/beats/v7/libbeat/common"
 	"github.com/elastic/beats/v7/x-pack/auditbeat/module/system/socket/helper"
@@ -51,14 +51,14 @@ func (p *probeInstaller) Install(pdef helper.ProbeDef) (format tracing.ProbeForm
 		return format, decoder, errors.New("nil decoder in probe definition")
 	}
 	if err = p.traceFS.AddKProbe(pdef.Probe); err != nil {
-		return format, decoder, errors.Wrapf(err, "failed installing probe '%s'", pdef.Probe.String())
+		return format, decoder, fmt.Errorf("failed installing probe '%s': %w", pdef.Probe.String(), err)
 	}
 	p.installed = append(p.installed, pdef.Probe)
 	if format, err = p.traceFS.LoadProbeFormat(pdef.Probe); err != nil {
-		return format, decoder, errors.Wrap(err, "failed to load probe format")
+		return format, decoder, fmt.Errorf("failed to load probe format: %w", err)
 	}
 	if decoder, err = pdef.Decoder(format); err != nil {
-		return format, decoder, errors.Wrap(err, "failed to create decoder")
+		return format, decoder, fmt.Errorf("failed to create decoder: %w", err)
 	}
 	return
 }
@@ -79,13 +79,13 @@ func (p *probeInstaller) UninstallInstalled() error {
 func (p *probeInstaller) UninstallIf(condition helper.ProbeCondition) error {
 	kprobes, err := p.traceFS.ListKProbes()
 	if err != nil {
-		return errors.Wrap(err, "failed to list installed kprobes")
+		return fmt.Errorf("failed to list installed kprobes: %w", err)
 	}
 	var errs multierror.Errors
 	for _, probe := range kprobes {
 		if condition(probe) {
 			if err := p.traceFS.RemoveKProbe(probe); err != nil {
-				errs = append(errs, errors.Wrapf(err, "unable to remove kprobe '%s'", probe.String()))
+				errs = append(errs, fmt.Errorf("unable to remove kprobe '%s': %w", probe.String(), err))
 			}
 		}
 	}
@@ -137,10 +137,9 @@ func WithFilterPort(portnum uint16) ProbeTransform {
 
 // KProbes shared with IPv4 and IPv6.
 var sharedKProbes = []helper.ProbeDef{
-
-	/***************************************************************************
-	 * RUNNING PROCESSES
-	 **************************************************************************/
+	//***************************************************************************
+	//* RUNNING PROCESSES
+	//***************************************************************************
 
 	{
 		Probe: tracing.Probe{
@@ -370,9 +369,9 @@ var ipv4OnlyKProbes = []helper.ProbeDef{
 
 // KProbes used when IPv6 is enabled.
 var ipv6KProbes = []helper.ProbeDef{
-	/***************************************************************************
-	 * IPv6
-	 **************************************************************************/
+	//***************************************************************************
+	//* IPv6
+	//***************************************************************************
 
 	// IPv6 socket created. Good for associating sockets with pids.
 	// ** This is a struct socket* not a struct sock* **
diff --git a/x-pack/auditbeat/module/system/socket/socket_linux.go b/x-pack/auditbeat/module/system/socket/socket_linux.go
index 7ba99f7a4551..f6d38003b881 100644
--- a/x-pack/auditbeat/module/system/socket/socket_linux.go
+++ b/x-pack/auditbeat/module/system/socket/socket_linux.go
@@ -10,6 +10,7 @@ package socket
 import (
 	"context"
 	"encoding/binary"
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -21,7 +22,6 @@ import (
 	"syscall"
 	"time"
 
-	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
 
 	"github.com/elastic/beats/v7/libbeat/common"
@@ -103,7 +103,7 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) {
 
 	config := defaultConfig
 	if err := base.Module().UnpackConfig(&config); err != nil {
-		return nil, errors.Wrapf(err, "failed to unpack the %s config", fullName)
+		return nil, fmt.Errorf("failed to unpack the %s config: %w", fullName, err)
 	}
 	if instance != nil {
 		// Do not instantiate a new dataset if the config hasn't changed.
@@ -127,7 +127,7 @@ func newSocketMetricset(config Config, base mb.BaseMetricSet) (*MetricSet, error
 	logger := logp.NewLogger(metricsetName)
 	sniffer, err := dns.NewSniffer(base, logger)
 	if err != nil {
-		return nil, errors.Wrap(err, "unable to create DNS sniffer")
+		return nil, fmt.Errorf("unable to create DNS sniffer: %w", err)
 	}
 	ms := &MetricSet{
 		SystemMetricSet: system.NewSystemMetricSet(base),
@@ -142,7 +142,7 @@ func newSocketMetricset(config Config, base mb.BaseMetricSet) (*MetricSet, error
 	// Setup the metricset before Run() so that startup can be halted in case of
 	// error.
 	if err = ms.Setup(); err != nil {
-		return nil, errors.Wrapf(err, "%s dataset setup failed", fullName)
+		return nil, fmt.Errorf("%s dataset setup failed: %w", fullName, err)
 	}
 	return ms, nil
 }
@@ -168,14 +168,14 @@ func (m *MetricSet) Run(r mb.PushReporterV2) {
 			m.log.Errorf("Unable to store DNS transaction %+v: %v", tr, err)
 		}
 	}); err != nil {
-		err = errors.Wrap(err, "unable to start DNS sniffer")
+		err = fmt.Errorf("unable to start DNS sniffer: %w", err)
 		r.Error(err)
 		m.log.Error(err)
 		return
 	}
 
 	if err := m.perfChannel.Run(); err != nil {
-		err = errors.Wrap(err, "unable to start perf channel")
+		err = fmt.Errorf("unable to start perf channel: %w", err)
 		r.Error(err)
 		m.log.Error(err)
 		return
@@ -309,7 +309,7 @@ func (m *MetricSet) Setup() (err error) {
 		traceFS, err = tracing.NewTraceFSWithPath(*m.config.TraceFSPath)
 	}
 	if err != nil {
-		return errors.Wrap(err, "tracefs/debugfs is not mounted or not writeable")
+		return fmt.Errorf("tracefs/debugfs is not mounted or not writeable: %w", err)
 	}
 
 	//
@@ -366,7 +366,7 @@ func (m *MetricSet) Setup() (err error) {
 	// remove existing Auditbeat KProbes that match the current PID.
 	//
 	if err = m.installer.UninstallIf(isThisAuditbeat); err != nil {
-		return errors.Wrapf(err, "unable to delete existing KProbes for group %s", groupName)
+		return fmt.Errorf("unable to delete existing KProbes for group %s: %w", groupName, err)
 	}
 
 	//
@@ -420,7 +420,7 @@ func (m *MetricSet) Setup() (err error) {
 			Vars:    m.templateVars,
 			Timeout: m.config.GuessTimeout,
 		}); err != nil {
-		return errors.Wrap(err, "unable to guess one or more required parameters")
+		return fmt.Errorf("unable to guess one or more required parameters: %w", err)
 	}
 
 	if m.isDebug {
@@ -446,7 +446,7 @@ func (m *MetricSet) Setup() (err error) {
 		tracing.WithTID(perf.AllThreads),
 		tracing.WithTimestamp())
 	if err != nil {
-		return errors.Wrapf(err, "unable to create perf channel")
+		return fmt.Errorf("unable to create perf channel: %w", err)
 	}
 
 	//
@@ -455,10 +455,10 @@ func (m *MetricSet) Setup() (err error) {
 	for _, probeDef := range getKProbes(hasIPv6) {
 		format, decoder, err := m.installer.Install(probeDef)
 		if err != nil {
-			return errors.Wrapf(err, "unable to register probe %s", probeDef.Probe.String())
+			return fmt.Errorf("unable to register probe %s: %w", probeDef.Probe.String(), err)
 		}
 		if err = m.perfChannel.MonitorProbe(format, decoder); err != nil {
-			return errors.Wrapf(err, "unable to monitor probe %s", probeDef.Probe.String())
+			return fmt.Errorf("unable to monitor probe %s: %w", probeDef.Probe.String(), err)
 		}
 	}
 	return nil
diff --git a/x-pack/auditbeat/module/system/socket/state.go b/x-pack/auditbeat/module/system/socket/state.go
index 74c09ec7d1cd..c1e6865c2c28 100644
--- a/x-pack/auditbeat/module/system/socket/state.go
+++ b/x-pack/auditbeat/module/system/socket/state.go
@@ -9,6 +9,7 @@ package socket
 
 import (
 	"encoding/binary"
+	"errors"
 	"fmt"
 	"net"
 	"os"
@@ -17,7 +18,6 @@ import (
 	"sync/atomic"
 	"time"
 
-	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
 
 	"github.com/elastic/beats/v7/libbeat/common"
@@ -438,8 +438,10 @@ func (s *state) DoneFlows() linkedList {
 	return r
 }
 
-var lastEvents uint64
-var lastTime time.Time
+var (
+	lastEvents uint64
+	lastTime   time.Time
+)
 
 func (s *state) logState() {
 	s.Lock()
@@ -470,7 +472,6 @@ func (s *state) logState() {
 	} else {
 		s.log.Warnf("%s. Warnings: %v", msg, errs)
 	}
-
 }
 
 func (s *state) reapLoop() {
diff --git a/x-pack/auditbeat/module/system/socket/state_test.go b/x-pack/auditbeat/module/system/socket/state_test.go
index 79f7838840eb..7327d31e8a2c 100644
--- a/x-pack/auditbeat/module/system/socket/state_test.go
+++ b/x-pack/auditbeat/module/system/socket/state_test.go
@@ -9,6 +9,7 @@ package socket
 
 import (
 	"encoding/binary"
+	"errors"
 	"fmt"
 	"net"
 	"os"
@@ -17,7 +18,6 @@ import (
 	"time"
 
 	"github.com/joeshaw/multierror"
-	"github.com/pkg/errors"
 	"github.com/stretchr/testify/assert"
 	"golang.org/x/sys/unix"
 
@@ -511,7 +511,7 @@ func feedEvents(evs []event, st *state, t *testing.T) error {
 		t.Logf("Delivering event %d: %s", idx, ev.String())
 		// TODO: err
 		if err := ev.Update(st); err != nil {
-			return errors.Wrapf(err, "error feeding event '%s'", ev.String())
+			return fmt.Errorf("error feeding event '%s': %w", ev.String(), err)
 		}
 	}
 	return nil
diff --git a/x-pack/auditbeat/module/system/user/user.go b/x-pack/auditbeat/module/system/user/user.go
index 69fb25e7187f..e51c970b290e 100644
--- a/x-pack/auditbeat/module/system/user/user.go
+++ b/x-pack/auditbeat/module/system/user/user.go
@@ -22,7 +22,6 @@ import (
 	"github.com/cespare/xxhash/v2"
 	"github.com/gofrs/uuid"
 	"github.com/joeshaw/multierror"
-	"github.com/pkg/errors"
 
 	"github.com/elastic/beats/v7/auditbeat/datastore"
 	"github.com/elastic/beats/v7/libbeat/common"
@@ -237,12 +236,12 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) {
 
 	config := defaultConfig()
 	if err := base.Module().UnpackConfig(&config); err != nil {
-		return nil, errors.Wrapf(err, "failed to unpack the %v/%v config", moduleName, metricsetName)
+		return nil, fmt.Errorf("failed to unpack the %v/%v config: %w", moduleName, metricsetName, err)
 	}
 
 	bucket, err := datastore.OpenBucket(bucketName)
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to open persistent datastore")
+		return nil, fmt.Errorf("failed to open persistent datastore: %w", err)
 	}
 
 	ms := &MetricSet{
@@ -278,7 +277,7 @@ func New(base mb.BaseMetricSet) (mb.MetricSet, error) {
 	// Load from disk: Users
 	users, err := ms.restoreUsersFromDisk()
 	if err != nil {
-		return nil, errors.Wrap(err, "failed to restore users from disk")
+		return nil, fmt.Errorf("failed to restore users from disk: %w", err)
 	}
 	ms.log.Debugf("Restored %d users from disk", len(users))
 
@@ -322,14 +321,14 @@ func (ms *MetricSet) reportState(report mb.ReporterV2) error {
 
 	users, err := GetUsers(ms.config.DetectPasswordChanges)
 	if err != nil {
-		errs = append(errs, errors.Wrap(err, "error while getting users"))
+		errs = append(errs, fmt.Errorf("error while getting users: %w", err))
 	}
 
 	ms.log.Debugf("Found %v users", len(users))
 	if len(users) > 0 {
 		stateID, err := uuid.NewV4()
 		if err != nil {
-			errs = append(errs, errors.Wrap(err, "error generating state ID"))
+			errs = append(errs, fmt.Errorf("error generating state ID: %w", err))
 		}
 
 		for _, user := range users {
@@ -350,7 +349,7 @@ func (ms *MetricSet) reportState(report mb.ReporterV2) error {
 		} else {
 			err = ms.bucket.Store(bucketKeyStateTimestamp, timeBytes)
 			if err != nil {
-				errs = append(errs, errors.Wrap(err, "error writing state timestamp to disk"))
+				errs = append(errs, fmt.Errorf("error writing state timestamp to disk: %w", err))
 			}
 		}
 
@@ -383,7 +382,7 @@ func (ms *MetricSet) reportChanges(report mb.ReporterV2) error {
 
 	users, err := GetUsers(ms.config.DetectPasswordChanges)
 	if err != nil {
-		errs = append(errs, errors.Wrap(err, "error while getting users"))
+		errs = append(errs, fmt.Errorf("error while getting users: %w", err))
 	}
 	ms.log.Debugf("Found %v users", len(users))
 
@@ -561,7 +560,7 @@ func (ms *MetricSet) restoreUsersFromDisk() (users []*User, err error) {
 				// Read all users
 				break
 			} else {
-				return nil, errors.Wrap(err, "error decoding users")
+				return nil, fmt.Errorf("error decoding users: %w", err)
 			}
 		}
 	}
@@ -577,13 +576,13 @@ func (ms *MetricSet) saveUsersToDisk(users []*User) error {
 	for _, user := range users {
 		err := encoder.Encode(*user)
 		if err != nil {
-			return errors.Wrap(err, "error encoding users")
+			return fmt.Errorf("error encoding users: %w", err)
 		}
 	}
 
 	err := ms.bucket.Store(bucketKeyUsers, buf.Bytes())
 	if err != nil {
-		return errors.Wrap(err, "error writing users to disk")
+		return fmt.Errorf("error writing users to disk: %w", err)
 	}
 	return nil
 }
@@ -593,7 +592,7 @@ func (ms *MetricSet) haveFilesChanged() (bool, error) {
 	var stats syscall.Stat_t
 	for _, path := range ms.userFiles {
 		if err := syscall.Stat(path, &stats); err != nil {
-			return true, errors.Wrapf(err, "failed to stat %v", path)
+			return true, fmt.Errorf("failed to stat %v: %w", path, err)
 		}
 
 		ctime := time.Unix(int64(stats.Ctim.Sec), int64(stats.Ctim.Nsec))
diff --git a/x-pack/auditbeat/module/system/user/user_test.go b/x-pack/auditbeat/module/system/user/user_test.go
index 65e8ae455f07..81e2b5be7ef1 100644
--- a/x-pack/auditbeat/module/system/user/user_test.go
+++ b/x-pack/auditbeat/module/system/user/user_test.go
@@ -64,11 +64,11 @@ func testUser() *User {
 		UID:  "9999",
 		GID:  "1001",
 		Groups: []*user.Group{
-			&user.Group{
+			{
 				Gid:  "1001",
 				Name: "__elastic",
 			},
-			&user.Group{
+			{
 				Gid:  "1002",
 				Name: "docker",
 			},
diff --git a/x-pack/auditbeat/module/system/user/users_linux.go b/x-pack/auditbeat/module/system/user/users_linux.go
index f564c282cbda..e3412339c497 100644
--- a/x-pack/auditbeat/module/system/user/users_linux.go
+++ b/x-pack/auditbeat/module/system/user/users_linux.go
@@ -19,6 +19,7 @@ import "C"
 
 import (
 	"crypto/sha512"
+	"fmt"
 	"os/user"
 	"runtime"
 	"strconv"
@@ -27,12 +28,9 @@ import (
 	"time"
 
 	"github.com/joeshaw/multierror"
-	"github.com/pkg/errors"
 )
 
-var (
-	epoch = time.Date(1970, 1, 1, 0, 0, 0, 0, time.UTC)
-)
+var epoch = time.Date(1970, 1, 1, 0, 0, 0, 0, time.UTC)
 
 // GetUsers retrieves a list of users using information from
 // /etc/passwd, /etc/group, and - if configured - /etc/shadow.
@@ -84,7 +82,7 @@ func readPasswdFile(readPasswords bool) ([]*User, error) {
 			// getpwent() can return ENOENT even when there is no error,
 			// see https://github.com/systemd/systemd/issues/9585.
 			if err != nil && err != syscall.ENOENT {
-				return users, errors.Wrap(err, "error getting user")
+				return users, fmt.Errorf("error getting user: %w", err)
 			}
 
 			// No more entries
@@ -135,7 +133,7 @@ func enrichWithGroups(users []*User) error {
 
 		groupIds, err := goUser.GroupIds()
 		if err != nil {
-			return errors.Wrapf(err, "error getting group IDs for user %v (UID: %v)", u.Name, u.UID)
+			return fmt.Errorf("error getting group IDs for user %v (UID: %v): %w", u.Name, u.UID, err)
 		}
 
 		for _, gid := range groupIds {
@@ -143,7 +141,7 @@ func enrichWithGroups(users []*User) error {
 			if !found {
 				group, err = user.LookupGroupId(gid)
 				if err != nil {
-					return errors.Wrapf(err, "error looking up group ID %v for user %v (UID: %v)", gid, u.Name, u.UID)
+					return fmt.Errorf("error looking up group ID %v for user %v (UID: %v): %w", gid, u.Name, u.UID, err)
 				}
 				gidCache[gid] = group
 			}
@@ -204,7 +202,7 @@ func readShadowFile() (map[string]shadowFileEntry, error) {
 
 		if spwd == nil {
 			if err != nil {
-				return shadowEntries, errors.Wrap(err, "error while reading shadow file")
+				return shadowEntries, fmt.Errorf("error while reading shadow file: %w", err)
 			}
 
 			// No more entries
diff --git a/x-pack/auditbeat/tracing/cpu.go b/x-pack/auditbeat/tracing/cpu.go
index 800d08ebe9a9..506f22fcc635 100644
--- a/x-pack/auditbeat/tracing/cpu.go
+++ b/x-pack/auditbeat/tracing/cpu.go
@@ -9,11 +9,10 @@ package tracing
 
 import (
 	"bytes"
+	"fmt"
 	"io/ioutil"
 	"strconv"
 	"strings"
-
-	"github.com/pkg/errors"
 )
 
 const (
@@ -97,7 +96,7 @@ func NewCPUSetFromExpression(contents string) (CPUSet, error) {
 		for _, numStr := range parts {
 			num16, err := strconv.ParseInt(numStr, 10, 16)
 			if err != nil || num16 < 0 {
-				return CPUSet{}, errors.Errorf("failed to parse integer '%s' from range '%s' at '%s'", numStr, expr, contents)
+				return CPUSet{}, fmt.Errorf("failed to parse integer '%s' from range '%s' at '%s'", numStr, expr, contents)
 			}
 			num := int(num16)
 			r = append(r, num)
@@ -124,7 +123,7 @@ func NewCPUSetFromExpression(contents string) (CPUSet, error) {
 			to = r[1]
 		}
 		if from == -1 || to < from {
-			return CPUSet{}, errors.Errorf("invalid cpu range %v in '%s'", r, contents)
+			return CPUSet{}, fmt.Errorf("invalid cpu range %v in '%s'", r, contents)
 		}
 		for i := from; i <= to; i++ {
 			if !mask[i] {
diff --git a/x-pack/auditbeat/tracing/events_test.go b/x-pack/auditbeat/tracing/events_test.go
index 180761f7700e..90c649f47289 100644
--- a/x-pack/auditbeat/tracing/events_test.go
+++ b/x-pack/auditbeat/tracing/events_test.go
@@ -209,7 +209,7 @@ func TestKProbeReal(t *testing.T) {
 	probe := Probe{
 		Name:    "test_kprobe",
 		Address: "sys_connect",
-		//Fetchargs: "exe=$comm fd=%di +0(%si) +8(%si) +16(%si) +24(%si) +99999(%ax):string",
+		// Fetchargs: "exe=$comm fd=%di +0(%si) +8(%si) +16(%si) +24(%si) +99999(%ax):string",
 		Fetchargs: "ax=%ax bx=%bx:u8 cx=%cx:u32 dx=%dx:s16",
 	}
 	err = evs.AddKProbe(probe)
@@ -220,19 +220,19 @@ func TestKProbeReal(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	//fmt.Fprintf(os.Stderr, "desc=%+v\n", desc)
+	// fmt.Fprintf(os.Stderr, "desc=%+v\n", desc)
 	var decoder Decoder
 	const useStructDecoder = false
 	if useStructDecoder {
 		type myStruct struct {
-			//Exe string `kprobe:"exe"`
+			// Exe string `kprobe:"exe"`
 			PID uint32 `kprobe:"common_pid"`
 			AX  int64  `kprobe:"ax"`
 			BX  uint8  `kprobe:"bx"`
 			CX  int32  `kprobe:"cx"`
 			DX  uint16 `kprobe:"dx"`
 		}
-		var allocFn = func() interface{} {
+		allocFn := func() interface{} {
 			return new(myStruct)
 		}
 		if decoder, err = NewStructDecoder(desc, allocFn); err != nil {
@@ -308,7 +308,7 @@ func TestKProbeEventsList(t *testing.T) {
 	}
 	defer os.RemoveAll(tmpDir)
 
-	if err := os.MkdirAll(tmpDir, 0700); err != nil {
+	if err := os.MkdirAll(tmpDir, 0o700); err != nil {
 		t.Fatal(err)
 	}
 	file, err := os.Create(filepath.Join(tmpDir, "kprobe_events"))
@@ -365,7 +365,7 @@ func TestKProbeEventsAddRemoveKProbe(t *testing.T) {
 	}
 	defer os.RemoveAll(tmpDir)
 
-	if err := os.MkdirAll(tmpDir, 0700); err != nil {
+	if err := os.MkdirAll(tmpDir, 0o700); err != nil {
 		t.Fatal(err)
 	}
 	file, err := os.Create(filepath.Join(tmpDir, "kprobe_events"))
diff --git a/x-pack/auditbeat/tracing/perfevent.go b/x-pack/auditbeat/tracing/perfevent.go
index 79112a1c8859..016fb1d1e022 100644
--- a/x-pack/auditbeat/tracing/perfevent.go
+++ b/x-pack/auditbeat/tracing/perfevent.go
@@ -9,6 +9,7 @@ package tracing
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"os"
 	"sync"
@@ -17,7 +18,6 @@ import (
 	"unsafe"
 
 	"github.com/joeshaw/multierror"
-	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
 
 	"github.com/elastic/go-perf"
@@ -120,7 +120,7 @@ func NewPerfChannel(cfg ...PerfChannelConf) (channel *PerfChannel, err error) {
 	// at runtime (CPU hotplug).
 	channel.cpus, err = NewCPUSetFromFile(OnlineCPUsPath)
 	if err != nil {
-		return nil, errors.Wrap(err, "error listing online CPUs")
+		return nil, fmt.Errorf("error listing online CPUs: %w", err)
 	}
 	if channel.cpus.NumCPU() < 1 {
 		return nil, errors.New("couldn't list online CPUs")
@@ -247,7 +247,7 @@ func (c *PerfChannel) MonitorProbe(format ProbeFormat, decoder Decoder) error {
 			fbytes := []byte(format.Probe.Filter + "\x00")
 			_, _, errNo := unix.Syscall(unix.SYS_IOCTL, uintptr(fd), unix.PERF_EVENT_IOC_SET_FILTER, uintptr(unsafe.Pointer(&fbytes[0])))
 			if errNo != 0 {
-				return errors.Wrapf(errNo, "unable to set filter '%s'", format.Probe.Filter)
+				return fmt.Errorf("unable to set filter '%s': %w", format.Probe.Filter, errNo)
 			}
 		}
 		c.streams[cid] = stream{probeID: format.ID, decoder: decoder}
@@ -255,7 +255,7 @@ func (c *PerfChannel) MonitorProbe(format ProbeFormat, decoder Decoder) error {
 
 		if !doGroup {
 			if err := ev.MapRingNumPages(c.mappedPages); err != nil {
-				return errors.Wrap(err, "perf channel mapring failed")
+				return fmt.Errorf("perf channel mapring failed: %w", err)
 			}
 		}
 	}
@@ -292,7 +292,7 @@ func (c *PerfChannel) Run() error {
 
 	for _, ev := range c.events {
 		if err := ev.Enable(); err != nil {
-			return errors.Wrap(err, "perf channel enable failed")
+			return fmt.Errorf("perf channel enable failed: %w", err)
 		}
 	}
 	c.wg.Add(1)
@@ -312,10 +312,10 @@ func (c *PerfChannel) Close() error {
 	var errs multierror.Errors
 	for _, ev := range c.events {
 		if err := ev.Disable(); err != nil {
-			errs = append(errs, errors.Wrap(err, "failed to disable event channel"))
+			errs = append(errs, fmt.Errorf("failed to disable event channel: %w", err))
 		}
 		if err := ev.Close(); err != nil {
-			errs = append(errs, errors.Wrap(err, "failed to close event channel"))
+			errs = append(errs, fmt.Errorf("failed to close event channel: %w", err))
 		}
 	}
 	return errs.Err()
@@ -446,7 +446,7 @@ func (m *recordMerger) nextSample(ctx context.Context) (sr *perf.SampleRecord, o
 		// No sample was available. Block until one of the ringbuffers has data.
 		_, closed, err := pollAll(m.evs, m.timeout)
 		if err != nil {
-			m.channel.errC <- errors.Wrap(err, "poll failed")
+			m.channel.errC <- fmt.Errorf("poll failed: %w", err)
 			return nil, false
 		}
 		// Some of the ring buffers closed. Report termination.

From 5a53f65ef34de482fab4553822c82c905b9bf898 Mon Sep 17 00:00:00 2001
From: Dan Kortschak <dan.kortschak@elastic.co>
Date: Thu, 10 Feb 2022 11:38:05 +1030
Subject: [PATCH 2/4] manual replacement of github.com/pkg/error with standard
 library error handling

This is the manual part of the change and includes some complete removal of errors
and some silently passed bugs resulting from the use of Wrap.

In one place the exact semantics of errors.Cause is implemented to fit in with a
testing strategy.
---
 auditbeat/helper/hasher/hasher_test.go          | 17 ++++++++++++++++-
 auditbeat/module/auditd/audit_linux.go          |  5 ++++-
 auditbeat/module/file_integrity/config.go       |  8 +++++---
 auditbeat/module/file_integrity/event.go        | 11 +++++++----
 .../module/file_integrity/eventreader_test.go   |  3 ++-
 .../module/file_integrity/fileorigin_darwin.go  | 16 ++++++++++++----
 .../module/system/socket/guess/guess.go         |  5 ++++-
 .../module/system/socket/helper/loopback.go     |  5 ++++-
 8 files changed, 54 insertions(+), 16 deletions(-)

diff --git a/auditbeat/helper/hasher/hasher_test.go b/auditbeat/helper/hasher/hasher_test.go
index 67c02de81ddf..a50d3cc0c079 100644
--- a/auditbeat/helper/hasher/hasher_test.go
+++ b/auditbeat/helper/hasher/hasher_test.go
@@ -87,5 +87,20 @@ func TestHasherLimits(t *testing.T) {
 	hashes, err := hasher.HashFile(file)
 	assert.Empty(t, hashes)
 	assert.Error(t, err)
-	assert.IsType(t, FileTooLargeError{}, errors.Cause(err))
+	assert.IsType(t, FileTooLargeError{}, cause(err))
+}
+
+func cause(err error) error {
+	type unwrapper interface {
+		Unwrap() error
+	}
+
+	for err != nil {
+		w, ok := err.(unwrapper)
+		if !ok {
+			break
+		}
+		err = w.Unwrap()
+	}
+	return err
 }
diff --git a/auditbeat/module/auditd/audit_linux.go b/auditbeat/module/auditd/audit_linux.go
index 1ac11f97dd4d..63febb6fcec9 100644
--- a/auditbeat/module/auditd/audit_linux.go
+++ b/auditbeat/module/auditd/audit_linux.go
@@ -306,7 +306,10 @@ func (ms *MetricSet) initClient() error {
 		// required to ensure that auditing is enabled if the process is only
 		// given CAP_AUDIT_READ.
 		err := ms.client.SetEnabled(true, libaudit.NoWait)
-		return errors.Wrap(err, "failed to enable auditing in the kernel")
+		if err != nil {
+			return fmt.Errorf("failed to enable auditing in the kernel: %w", err)
+		}
+		return nil
 	}
 
 	// Unicast client initialization (requires CAP_AUDIT_CONTROL and that the
diff --git a/auditbeat/module/file_integrity/config.go b/auditbeat/module/file_integrity/config.go
index 6fa67303e367..f1fa35ebdca0 100644
--- a/auditbeat/module/file_integrity/config.go
+++ b/auditbeat/module/file_integrity/config.go
@@ -114,10 +114,12 @@ nextHash:
 	}
 
 	c.MaxFileSizeBytes, err = humanize.ParseBytes(c.MaxFileSize)
-	if err != nil || c.MaxFileSizeBytes > MaxValidFileSizeLimit {
-		errs = append(errs, errors.Wrap(err, "invalid max_file_size value"))
+	if err != nil {
+		errs = append(errs, fmt.Errorf("invalid max_file_size value: %w", err))
+	} else if c.MaxFileSizeBytes > MaxValidFileSizeLimit {
+		errs = append(errs, fmt.Errorf("invalid max_file_size value: %s is too large (max=%s)", c.MaxFileSize, humanize.Bytes(MaxValidFileSizeLimit)))
 	} else if c.MaxFileSizeBytes <= 0 {
-		errs = append(errs, errors.Errorf("max_file_size value (%v) must be positive", c.MaxFileSize))
+		errs = append(errs, fmt.Errorf("max_file_size value (%v) must be positive", c.MaxFileSize))
 	}
 
 	c.ScanRateBytesPerSec, err = humanize.ParseBytes(c.ScanRatePerSec)
diff --git a/auditbeat/module/file_integrity/event.go b/auditbeat/module/file_integrity/event.go
index aa4123c2b1f4..5e423d04feca 100644
--- a/auditbeat/module/file_integrity/event.go
+++ b/auditbeat/module/file_integrity/event.go
@@ -213,11 +213,14 @@ func NewEvent(
 	hashTypes []HashType,
 ) Event {
 	info, err := os.Lstat(path)
-	if err != nil && os.IsNotExist(err) {
-		// deleted file is signaled by info == nil
-		err = nil
+	if err != nil {
+		if os.IsNotExist(err) {
+			// deleted file is signaled by info == nil
+			err = nil
+		} else {
+			err = fmt.Errorf("failed to lstat: %w", err)
+		}
 	}
-	err = errors.Wrap(err, "failed to lstat")
 	return NewEventFromFileInfo(path, info, err, action, source, maxFileSize, hashTypes)
 }
 
diff --git a/auditbeat/module/file_integrity/eventreader_test.go b/auditbeat/module/file_integrity/eventreader_test.go
index 6caaa3a05510..f18d0817df33 100644
--- a/auditbeat/module/file_integrity/eventreader_test.go
+++ b/auditbeat/module/file_integrity/eventreader_test.go
@@ -23,6 +23,7 @@ import (
 	"os"
 	"path/filepath"
 	"runtime"
+	"runtime/debug"
 	"strings"
 	"syscall"
 	"testing"
@@ -313,7 +314,7 @@ func TestRaces(t *testing.T) {
 func readTimeout(t testing.TB, events <-chan Event) Event {
 	select {
 	case <-time.After(time.Second):
-		t.Fatalf("%+v", errors.Errorf("timed-out waiting for event"))
+		t.Fatalf("timed-out waiting for event:\n%s", debug.Stack())
 	case e, ok := <-events:
 		if !ok {
 			t.Fatal("failed reading from event channel")
diff --git a/auditbeat/module/file_integrity/fileorigin_darwin.go b/auditbeat/module/file_integrity/fileorigin_darwin.go
index 740987f25fe8..227bef1e4da8 100644
--- a/auditbeat/module/file_integrity/fileorigin_darwin.go
+++ b/auditbeat/module/file_integrity/fileorigin_darwin.go
@@ -74,9 +74,13 @@ func GetFileOrigin(path string) ([]string, error) {
 	defer C.free(unsafe.Pointer(cPath))
 
 	// Query length kMDItemWhereFroms extended-attribute
-	attrSize, err := C.getxattr(cPath, kMDItemWhereFroms, nil, 0, 0, 0)
+	attrSize, errno := C.getxattr(cPath, kMDItemWhereFroms, nil, 0, 0, 0)
 	if attrSize == -1 {
-		return nil, errors.Wrap(filterErrno(err), "getxattr: query attribute length failed")
+		err := filterErrno(errno)
+		if err != nil {
+			return nil, fmt.Errorf("getxattr: query attribute length failed: %w", err)
+		}
+		return nil, nil
 	}
 	if attrSize == 0 {
 		return nil, nil
@@ -84,9 +88,13 @@ func GetFileOrigin(path string) ([]string, error) {
 
 	// Read the kMDItemWhereFroms attribute
 	data := make([]byte, attrSize)
-	newSize, err := C.getxattr(cPath, kMDItemWhereFroms, unsafe.Pointer(&data[0]), C.size_t(attrSize), 0, 0)
+	newSize, errno := C.getxattr(cPath, kMDItemWhereFroms, unsafe.Pointer(&data[0]), C.size_t(attrSize), 0, 0)
 	if newSize == -1 {
-		return nil, errors.Wrap(filterErrno(err), "getxattr failed")
+		err := filterErrno(errno)
+		if err != nil {
+			return nil, fmt.Errorf("getxattr failed: %w", filterErrno(err))
+		}
+		return nil, nil
 	}
 	if newSize != attrSize {
 		return nil, errors.New("getxattr: attribute changed while reading")
diff --git a/x-pack/auditbeat/module/system/socket/guess/guess.go b/x-pack/auditbeat/module/system/socket/guess/guess.go
index c31233b6d3d2..59fd8f5df5c9 100644
--- a/x-pack/auditbeat/module/system/socket/guess/guess.go
+++ b/x-pack/auditbeat/module/system/socket/guess/guess.go
@@ -236,7 +236,10 @@ func guessOnce(guesser Guesser, installer helper.ProbeInstaller, ctx Context) (r
 			}
 
 		case <-perfchan.LostC():
-			return nil, errors.Wrap(err, "event loss in perf channel")
+			if err != nil {
+				return nil, fmt.Errorf("event loss in perf channel: %w", err)
+			}
+			return nil, errors.New("event loss in perf channel")
 		}
 	}
 }
diff --git a/x-pack/auditbeat/module/system/socket/helper/loopback.go b/x-pack/auditbeat/module/system/socket/helper/loopback.go
index ae576052213f..eea98399049c 100644
--- a/x-pack/auditbeat/module/system/socket/helper/loopback.go
+++ b/x-pack/auditbeat/module/system/socket/helper/loopback.go
@@ -112,7 +112,10 @@ func (lo *IPv6Loopback) AddRandomAddress() (addr net.IP, err error) {
 		}
 		time.Sleep(time.Millisecond * time.Duration(i))
 	}
-	return addr, errors.Wrap(err, "bind failed")
+	if err != nil {
+		err = fmt.Errorf("bind failed: %w", err)
+	}
+	return addr, err
 }
 
 // Cleanup removes the addresses registered to this loopback.

From ddeb784c631e12b700958c56fcc44785dc4dc38f Mon Sep 17 00:00:00 2001
From: Dan Kortschak <dan.kortschak@elastic.co>
Date: Thu, 10 Feb 2022 16:07:44 +1030
Subject: [PATCH 3/4] replace unwrapping with errors.As

---
 auditbeat/helper/hasher/hasher_test.go | 18 ++----------------
 1 file changed, 2 insertions(+), 16 deletions(-)

diff --git a/auditbeat/helper/hasher/hasher_test.go b/auditbeat/helper/hasher/hasher_test.go
index a50d3cc0c079..2eb62a935c42 100644
--- a/auditbeat/helper/hasher/hasher_test.go
+++ b/auditbeat/helper/hasher/hasher_test.go
@@ -18,6 +18,7 @@
 package hasher
 
 import (
+	"errors"
 	"io/ioutil"
 	"os"
 	"path/filepath"
@@ -87,20 +88,5 @@ func TestHasherLimits(t *testing.T) {
 	hashes, err := hasher.HashFile(file)
 	assert.Empty(t, hashes)
 	assert.Error(t, err)
-	assert.IsType(t, FileTooLargeError{}, cause(err))
-}
-
-func cause(err error) error {
-	type unwrapper interface {
-		Unwrap() error
-	}
-
-	for err != nil {
-		w, ok := err.(unwrapper)
-		if !ok {
-			break
-		}
-		err = w.Unwrap()
-	}
-	return err
+	assert.True(t, errors.As(err, &FileTooLargeError{}))
 }

From 63959ea5b0b5d7c8deab9a7a7576841374487373 Mon Sep 17 00:00:00 2001
From: Dan Kortschak <dan.kortschak@elastic.co>
Date: Mon, 21 Feb 2022 11:02:07 +1030
Subject: [PATCH 4/4] x-pack/auditbeat/module/system/socket/guess: remove dead
 branch

---
 x-pack/auditbeat/module/system/socket/guess/guess.go | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/x-pack/auditbeat/module/system/socket/guess/guess.go b/x-pack/auditbeat/module/system/socket/guess/guess.go
index 59fd8f5df5c9..0c6326160577 100644
--- a/x-pack/auditbeat/module/system/socket/guess/guess.go
+++ b/x-pack/auditbeat/module/system/socket/guess/guess.go
@@ -236,9 +236,6 @@ func guessOnce(guesser Guesser, installer helper.ProbeInstaller, ctx Context) (r
 			}
 
 		case <-perfchan.LostC():
-			if err != nil {
-				return nil, fmt.Errorf("event loss in perf channel: %w", err)
-			}
 			return nil, errors.New("event loss in perf channel")
 		}
 	}