Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[filebeat][winlog] implement status reporter for winlog input #40163

Merged
merged 8 commits into from
Jul 11, 2024
Merged
Show file tree
Hide file tree
Changes from 3 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion CHANGELOG.next.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
- Update Salesforce module to use new Salesforce input. {pull}37509[37509]
- Tag events that come from a filestream in "take over" mode. {pull}39828[39828]
- Fix high IO and handling of a corrupted registry log file. {pull}35893[35893]

- Implement Elastic Agent status and health reporting for Winlog Filebeat input
*Heartbeat*


Expand Down
4 changes: 4 additions & 0 deletions filebeat/input/winlog/input.go
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@ import (
input "github.com/elastic/beats/v7/filebeat/input/v2"
cursor "github.com/elastic/beats/v7/filebeat/input/v2/input-cursor"
"github.com/elastic/beats/v7/libbeat/feature"
"github.com/elastic/beats/v7/libbeat/management/status"
"github.com/elastic/elastic-agent-libs/logp"
"github.com/elastic/go-concert/ctxtool"
"github.com/elastic/go-concert/timed"
Expand Down Expand Up @@ -99,6 +100,7 @@ func (eventlogRunner) Run(

// Flag used to detect repeat "channel not found" errors, eliminating log spam.
channelNotFoundErrDetected := false
ctx.UpdateStatus(status.Running, "")

runLoop:
for {
Expand Down Expand Up @@ -161,6 +163,7 @@ runLoop:
}

log.Errorw("Error occurred while reading from Windows Event Log", "error", err)
ctx.UpdateStatus(status.Degraded, fmt.Sprintf("Error occurred while reading from Windows Event Log: %v", err))
return err
}
if len(records) == 0 {
Expand All @@ -173,6 +176,7 @@ runLoop:
if err := publisher.Publish(event, record.Offset); err != nil {
// Publisher indicates disconnect when returning an error.
// stop trying to publish records and quit
ctx.UpdateStatus(status.Degraded, fmt.Sprintf("Error occurred while publishing from winlog: %v", err))
return err
}
}
Expand Down
Loading