[Filebeat] Fix offset field pointing at end of line for #6514

[original-brownbear]

Fixes #6514. Didn't add a new test because I had to adjust that one test to reflect the change by adding EOL + message length before comparing to the stored file offset.

[ph]

@original-brownbear can you add a changelog entry with this change?

[original-brownbear]

@ph sure sec :)

[original-brownbear]

done :)

[ph]

LGTM thanks @original-brownbear

[original-brownbear]

@ph np + thanks for the review:
Also, sorry still new around here :) => just squash + merge and backport to what branch?

[ph]

There is a test failing, I haven't see this one before, Can you take a look?

Also don't worry for the backport, I will take care of it I have a few to do.

Traceback (most recent call last):
  File "/System/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/unittest/case.py", line 331, in run
    testMethod()
  File "/private/var/lib/jenkins/workspace/elastic+beats+pull-request+multijob-darwin/beat/filebeat/label/macosx/src/github.com/elastic/beats/filebeat/tests/system/test_registrar.py", line 816, in test_clean_inactive
    assert len(data) == 2
AssertionError

[ph]

Something tell me it might be a timing issue, I will ask jenkins to run it again.

[ph]

jenkins test this please.

[original-brownbear]

@ph likely, last night it was green and I only added the changelog entry + rebase since the last time it ran.

[ruflin]

@ph I think it's a timing issue and i have seen the test failing before (which concerns me a bit).

[ph]

@armin Yeah don't worry about it, I will followup :)
@ruflin I haven't seen it, but we did a few changes that might impact timing.