From 0041d614f3e92c1fb5500515c7d3a46701a4b243 Mon Sep 17 00:00:00 2001 From: "Lee E. Hinman" Date: Mon, 11 Sep 2023 11:57:37 -0500 Subject: [PATCH 1/3] [filestream] revert change in symlink resolution --- CHANGELOG.next.asciidoc | 1 + filebeat/input/filestream/fswatch.go | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 1a616d1d097..6b9e22c3d73 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -108,6 +108,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff] - Remove 'onFilteredOut' and 'onDroppedOnPublish' callback logs {issue}36299[36299] {pull}36399[36399] - Added a fix for Crowdstrike pipeline handling process arrays {pull}36496[36496] - Ensure winlog input retains metric collection when handling recoverable errors. {issue}36479[36479] {pull}36483[36483] +- Revert error introduced in {pull}35734[35734] when symlinks can't be resolved in filestream. {pull}99999[99999] *Heartbeat* diff --git a/filebeat/input/filestream/fswatch.go b/filebeat/input/filestream/fswatch.go index 39d0275cfef..4cfc117caf7 100644 --- a/filebeat/input/filestream/fswatch.go +++ b/filebeat/input/filestream/fswatch.go @@ -441,7 +441,8 @@ func (s *fileScanner) getIngestTarget(filename string) (it ingestTarget, err err it.originalFilename, err = filepath.EvalSymlinks(it.filename) if err != nil { - return it, fmt.Errorf("failed to resolve the symlink %q: %w", it.filename, err) + s.log.Debugf("finding path to original file has failed %s: %+v", it.filename, err) + return it, nil } if s.isFileExcluded(it.originalFilename) { From 8f9959eb13f1ecee916b0d85086c32d7567b5471 Mon Sep 17 00:00:00 2001 From: Lee E Hinman <57081003+leehinman@users.noreply.github.com> Date: Mon, 11 Sep 2023 13:26:34 -0500 Subject: [PATCH 2/3] Update CHANGELOG.next.asciidoc Co-authored-by: Tiago Queiroz --- CHANGELOG.next.asciidoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index 6b9e22c3d73..6e0cd14419f 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -108,7 +108,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff] - Remove 'onFilteredOut' and 'onDroppedOnPublish' callback logs {issue}36299[36299] {pull}36399[36399] - Added a fix for Crowdstrike pipeline handling process arrays {pull}36496[36496] - Ensure winlog input retains metric collection when handling recoverable errors. {issue}36479[36479] {pull}36483[36483] -- Revert error introduced in {pull}35734[35734] when symlinks can't be resolved in filestream. {pull}99999[99999] +- Revert error introduced in {pull}35734[35734] when symlinks can't be resolved in filestream. {pull}36557[36557] *Heartbeat* From 828c3a52e116a2599ab66efccb12dfeba26dc417 Mon Sep 17 00:00:00 2001 From: Lee E Hinman <57081003+leehinman@users.noreply.github.com> Date: Tue, 12 Sep 2023 15:36:08 -0500 Subject: [PATCH 3/3] Update filebeat/input/filestream/fswatch.go Co-authored-by: Denis --- filebeat/input/filestream/fswatch.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/filebeat/input/filestream/fswatch.go b/filebeat/input/filestream/fswatch.go index 4cfc117caf7..8986794340d 100644 --- a/filebeat/input/filestream/fswatch.go +++ b/filebeat/input/filestream/fswatch.go @@ -442,7 +442,7 @@ func (s *fileScanner) getIngestTarget(filename string) (it ingestTarget, err err it.originalFilename, err = filepath.EvalSymlinks(it.filename) if err != nil { s.log.Debugf("finding path to original file has failed %s: %+v", it.filename, err) - return it, nil + it.originalFilename = it.filename } if s.isFileExcluded(it.originalFilename) {