diff --git a/CHANGELOG-developer.next.asciidoc b/CHANGELOG-developer.next.asciidoc index 0b0fd435ae3..70e81698b64 100644 --- a/CHANGELOG-developer.next.asciidoc +++ b/CHANGELOG-developer.next.asciidoc @@ -71,6 +71,7 @@ The list below covers the major changes between 7.0.0-rc2 and main only. - Rename x-pack/filebeat websocket input to streaming. {issue}40264[40264] {pull}40421[40421] - Journald input now calls `journalctl` instead of using `github.com/coreos/go-systemd/v22@v22.5.0/sdjournal`, the CGO dependency has been removed from Filebeat {pull}40061[40061] - System module events now contain `input.type: systemlogs` instead of `input.type: log` when harvesting log files, however the ingest pipeline sets it back to the original input (log or journald). {pull}41246[41246] +- The system-logs input is removed because it's not used anymore {pull}42328[42328] ==== Bugfixes diff --git a/filebeat/include/list.go b/filebeat/include/list.go index ae05c332eaa..d71af2bc1ff 100644 --- a/filebeat/include/list.go +++ b/filebeat/include/list.go @@ -34,7 +34,6 @@ import ( _ "github.com/elastic/beats/v7/filebeat/input/redis" _ "github.com/elastic/beats/v7/filebeat/input/stdin" _ "github.com/elastic/beats/v7/filebeat/input/syslog" - _ "github.com/elastic/beats/v7/filebeat/input/systemlogs" _ "github.com/elastic/beats/v7/filebeat/module/apache" _ "github.com/elastic/beats/v7/filebeat/module/auditd" _ "github.com/elastic/beats/v7/filebeat/module/elasticsearch" diff --git a/filebeat/input/default-inputs/inputs_linux.go b/filebeat/input/default-inputs/inputs_linux.go index ec37894d26a..8eed9a3ea4f 100644 --- a/filebeat/input/default-inputs/inputs_linux.go +++ b/filebeat/input/default-inputs/inputs_linux.go @@ -19,7 +19,6 @@ package inputs import ( "github.com/elastic/beats/v7/filebeat/input/journald" - "github.com/elastic/beats/v7/filebeat/input/systemlogs" v2 "github.com/elastic/beats/v7/filebeat/input/v2" cursor "github.com/elastic/beats/v7/filebeat/input/v2/input-cursor" "github.com/elastic/beats/v7/libbeat/beat" @@ -38,7 +37,6 @@ func osInputs(info beat.Info, log *logp.Logger, components osComponents) []v2.Pl zeroPlugin := v2.Plugin{} if journald := journald.Plugin(log, components); journald != zeroPlugin { plugins = append(plugins, journald) - plugins = append(plugins, systemlogs.PluginV2(log, components)) } return plugins diff --git a/filebeat/input/systemlogs/input.go b/filebeat/input/systemlogs/input.go deleted file mode 100644 index eadc5a8565a..00000000000 --- a/filebeat/input/systemlogs/input.go +++ /dev/null @@ -1,214 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -package systemlogs - -import ( - "errors" - "fmt" - "os" - "path/filepath" - - "github.com/elastic/beats/v7/filebeat/channel" - v1 "github.com/elastic/beats/v7/filebeat/input" - loginput "github.com/elastic/beats/v7/filebeat/input/log" - v2 "github.com/elastic/beats/v7/filebeat/input/v2" - cursor "github.com/elastic/beats/v7/filebeat/input/v2/input-cursor" - "github.com/elastic/beats/v7/libbeat/feature" - conf "github.com/elastic/elastic-agent-libs/config" - "github.com/elastic/elastic-agent-libs/logp" -) - -const pluginName = "system-logs" - -func init() { - // Register an input V1, that's used by the log input - if err := v1.Register(pluginName, newV1Input); err != nil { - panic(err) - } -} - -type config struct { - UseJournald bool `config:"use_journald"` - UseFiles bool `config:"use_files"` - Files *conf.C `config:"files" yaml:"files"` - Journald *conf.C `config:"journald" yaml:"journald"` -} - -func (c *config) Validate() error { - if c.UseFiles && c.UseJournald { - return errors.New("'use_journald' and 'use_files' cannot both be true") - } - - if c.Files == nil && c.Journald == nil { - return errors.New("one of 'journald' or 'files' must be set") - } - - return nil -} - -// newV1Input checks whether the log input must be created and -// delegates to loginput.NewInput if needed. -func newV1Input( - cfg *conf.C, - outlet channel.Connector, - context v1.Context, -) (v1.Input, error) { - journald, err := useJournald(cfg) - if err != nil { - return nil, fmt.Errorf("cannot decide between journald and files: %w", err) - } - - if journald { - return nil, v2.ErrUnknownInput - } - - // Convert the configuration and create a log input - logCfg, err := toFilesConfig(cfg) - if err != nil { - return nil, err - } - - return loginput.NewInput(logCfg, outlet, context) -} - -// PluginV2 creates a v2.Plugin that will instantiate a journald -// input if needed. -func PluginV2(logger *logp.Logger, store cursor.StateStore) v2.Plugin { - logger = logger.Named(pluginName) - - return v2.Plugin{ - Name: pluginName, - Stability: feature.Experimental, - Deprecated: false, - Info: "system-logs input", - Doc: "The system-logs input collects system logs on Linux by reading them from journald or traditional log files", - Manager: &cursor.InputManager{ - Logger: logger, - StateStore: store, - Type: pluginName, - Configure: configure, - }, - } -} - -// useJournald returns true if jounrald should be used. -// If there is an error, false is always retruned. -// -// The decision logic is: -// - If UseJournald is set, return true -// - If UseFiles is set, return false -// - If the globs defined in `files.paths` match any existing file, -// return false -// - Otherwise return true -func useJournald(c *conf.C) (bool, error) { - logger := logp.L().Named("input.system-logs") - - cfg := config{} - if err := c.Unpack(&cfg); err != nil { - return false, fmt.Errorf("cannot unpack 'system-logs' config: %w", err) - } - - if cfg.UseJournald { - logger.Info("using journald input because 'use_journald' is set") - return true, nil - } - - if cfg.UseFiles { - logger.Info("using log input because 'use_files' is set") - return false, nil - } - - globs := struct { - Paths []string `config:"files.paths"` - }{} - - if err := c.Unpack(&globs); err != nil { - return false, fmt.Errorf("cannot parse paths from config: %w", err) - } - - for _, g := range globs.Paths { - paths, err := filepath.Glob(g) - if err != nil { - return false, fmt.Errorf("cannot resolve glob: %w", err) - } - - for _, p := range paths { - stat, err := os.Stat(p) - if err != nil { - return false, fmt.Errorf("cannot stat '%s': %w", p, err) - } - - // Ignore directories - if stat.IsDir() { - continue - } - - // We found one file, return early - logger.Infof( - "using log input because file(s) was(were) found when testing glob '%s'", - g) - return false, nil - } - } - - // if no system log files are found, then use jounrald - logger.Info("no files were found, using journald input") - - return true, nil -} - -func toFilesConfig(cfg *conf.C) (*conf.C, error) { - newCfg, err := cfg.Child("files", -1) - if err != nil { - return nil, fmt.Errorf("cannot extract 'journald' block: %w", err) - } - - if _, err := cfg.Remove("journald", -1); err != nil { - return nil, err - } - - if _, err := cfg.Remove("type", -1); err != nil { - return nil, err - } - - if _, err := cfg.Remove("files", -1); err != nil { - return nil, err - } - - if _, err := cfg.Remove("use_journald", -1); err != nil { - return nil, err - } - - if _, err := cfg.Remove("use_files", -1); err != nil { - return nil, err - } - - if err := newCfg.Merge(cfg); err != nil { - return nil, err - } - - if err := newCfg.SetString("type", -1, "log"); err != nil { - return nil, fmt.Errorf("cannot set 'type': %w", err) - } - - if err := cfg.SetString("type", -1, pluginName); err != nil { - return nil, fmt.Errorf("cannot set type back to '%s': %w", pluginName, err) - } - - return newCfg, nil -} diff --git a/filebeat/input/systemlogs/input_linux.go b/filebeat/input/systemlogs/input_linux.go deleted file mode 100644 index 98a59361c0b..00000000000 --- a/filebeat/input/systemlogs/input_linux.go +++ /dev/null @@ -1,90 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -//go:build linux - -package systemlogs - -import ( - "fmt" - - "github.com/elastic/beats/v7/filebeat/input/journald" - v2 "github.com/elastic/beats/v7/filebeat/input/v2" - cursor "github.com/elastic/beats/v7/filebeat/input/v2/input-cursor" - conf "github.com/elastic/elastic-agent-libs/config" -) - -// configure checks whether the journald input must be created and -// delegates to journald.Configure if needed. -func configure(cfg *conf.C) ([]cursor.Source, cursor.Input, error) { - jouranl, err := useJournald(cfg) - if err != nil { - return nil, nil, fmt.Errorf("cannot decide between journald and files: %w", err) - } - - if !jouranl { - return nil, nil, v2.ErrUnknownInput - } - - journaldCfg, err := toJournaldConfig(cfg) - if err != nil { - return nil, nil, err - } - - return journald.Configure(journaldCfg) -} - -func toJournaldConfig(cfg *conf.C) (*conf.C, error) { - newCfg, err := cfg.Child("journald", -1) - if err != nil { - return nil, fmt.Errorf("cannot extract 'journald' block: %w", err) - } - - if _, err := cfg.Remove("journald", -1); err != nil { - return nil, err - } - - if _, err := cfg.Remove("type", -1); err != nil { - return nil, err - } - - if _, err := cfg.Remove("files", -1); err != nil { - return nil, err - } - - if _, err := cfg.Remove("use_journald", -1); err != nil { - return nil, err - } - - if _, err := cfg.Remove("use_files", -1); err != nil { - return nil, err - } - - if err := newCfg.Merge(cfg); err != nil { - return nil, err - } - - if err := newCfg.SetString("type", -1, "journald"); err != nil { - return nil, fmt.Errorf("cannot set 'type': %w", err) - } - - if err := cfg.SetString("type", -1, pluginName); err != nil { - return nil, fmt.Errorf("cannot set type back to '%s': %w", pluginName, err) - } - - return newCfg, nil -} diff --git a/filebeat/input/systemlogs/input_linux_test.go b/filebeat/input/systemlogs/input_linux_test.go deleted file mode 100644 index 251ef6cae67..00000000000 --- a/filebeat/input/systemlogs/input_linux_test.go +++ /dev/null @@ -1,54 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -//go:build linux - -package systemlogs - -import ( - "testing" - - conf "github.com/elastic/elastic-agent-libs/config" -) - -func TestJournaldInputIsCreated(t *testing.T) { - c := map[string]any{ - "files.paths": []string{"/file/does/not/exist"}, - // The 'journald' object needs to exist for the input to be instantiated - "journald.enabled": true, - } - - cfg := conf.MustNewConfigFrom(c) - - _, inp, err := configure(cfg) - if err != nil { - t.Fatalf("did not expect an error calling newV1Input: %s", err) - } - - type namer interface { - Name() string - } - - i, isNamer := inp.(namer) - if !isNamer { - t.Fatalf("expecting an instance of *log.Input, got '%T' instead", inp) - } - - if got, expected := i.Name(), "journald"; got != expected { - t.Fatalf("expecting '%s' input, got '%s'", expected, got) - } -} diff --git a/filebeat/input/systemlogs/input_other.go b/filebeat/input/systemlogs/input_other.go deleted file mode 100644 index ab21d3864b1..00000000000 --- a/filebeat/input/systemlogs/input_other.go +++ /dev/null @@ -1,31 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -//go:build !linux - -package systemlogs - -import ( - "errors" - - cursor "github.com/elastic/beats/v7/filebeat/input/v2/input-cursor" - conf "github.com/elastic/elastic-agent-libs/config" -) - -func configure(cfg *conf.C) ([]cursor.Source, cursor.Input, error) { - return nil, nil, errors.New("journald is only supported on Linux") -} diff --git a/filebeat/input/systemlogs/input_test.go b/filebeat/input/systemlogs/input_test.go deleted file mode 100644 index 6e5526f1736..00000000000 --- a/filebeat/input/systemlogs/input_test.go +++ /dev/null @@ -1,145 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -package systemlogs - -import ( - "os" - "testing" - - "github.com/elastic/beats/v7/filebeat/channel" - "github.com/elastic/beats/v7/filebeat/input" - "github.com/elastic/beats/v7/filebeat/input/log" - "github.com/elastic/beats/v7/libbeat/beat" - conf "github.com/elastic/elastic-agent-libs/config" -) - -func generateFile(t *testing.T) string { - // Create a know file for testing, the content is not relevant - // it just needs to exist - knwonFile, err := os.CreateTemp(t.TempDir(), t.Name()+"knwonFile*") - if err != nil { - t.Fatalf("cannot create temporary file: %s", err) - } - - if _, err := knwonFile.WriteString("Bowties are cool"); err != nil { - t.Fatalf("cannot write to temporary file '%s': %s", knwonFile.Name(), err) - } - knwonFile.Close() - - return knwonFile.Name() -} - -func TestUseJournald(t *testing.T) { - filename := generateFile(t) - - testCases := map[string]struct { - cfg map[string]any - useJournald bool - expectErr bool - }{ - "No files found": { - cfg: map[string]any{ - "files.paths": []string{"/file/does/not/exist"}, - }, - useJournald: true, - }, - "File exists": { - cfg: map[string]any{ - "files.paths": []string{filename}, - }, - useJournald: false, - }, - "use_journald is true": { - cfg: map[string]any{ - "use_journald": true, - "journald": struct{}{}, - }, - useJournald: true, - }, - "use_files is true": { - cfg: map[string]any{ - "use_files": true, - "journald": nil, - "files": struct{}{}, - }, - useJournald: false, - }, - "use_journald and use_files are true": { - cfg: map[string]any{ - "use_files": true, - "use_journald": true, - "journald": struct{}{}, - }, - useJournald: false, - expectErr: true, - }, - } - - for name, tc := range testCases { - t.Run(name, func(t *testing.T) { - cfg := conf.MustNewConfigFrom(tc.cfg) - - useJournald, err := useJournald(cfg) - if !tc.expectErr && err != nil { - t.Fatalf("did not expect an error calling 'useJournald': %s", err) - } - if tc.expectErr && err == nil { - t.Fatal("expecting an error when calling 'userJournald', got none") - } - - if useJournald != tc.useJournald { - t.Fatalf("expecting 'useJournald' to be %t, got %t", - tc.useJournald, useJournald) - } - }) - } -} - -func TestLogInputIsInstantiated(t *testing.T) { - filename := generateFile(t) - c := map[string]any{ - "files.paths": []string{filename}, - } - - cfg := conf.MustNewConfigFrom(c) - - inp, err := newV1Input(cfg, connectorMock{}, input.Context{}) - if err != nil { - t.Fatalf("did not expect an error calling newV1Input: %s", err) - } - _, isLogInput := inp.(*log.Input) - if !isLogInput { - t.Fatalf("expecting an instance of *log.Input, got '%T' instead", inp) - } -} - -type connectorMock struct{} - -func (mock connectorMock) Connect(c *conf.C) (channel.Outleter, error) { - return outleterMock{}, nil -} - -func (mock connectorMock) ConnectWith(c *conf.C, clientConfig beat.ClientConfig) (channel.Outleter, error) { - return outleterMock{}, nil -} - -type outleterMock struct{} - -func (o outleterMock) Close() error { return nil } -func (o outleterMock) Done() <-chan struct{} { return make(chan struct{}) } -func (o outleterMock) OnEvent(beat.Event) bool { return false } diff --git a/filebeat/tests/integration/systemlogs_all_test.go b/filebeat/tests/integration/systemlogs_all_test.go deleted file mode 100644 index cbc0c50c129..00000000000 --- a/filebeat/tests/integration/systemlogs_all_test.go +++ /dev/null @@ -1,126 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -package integration - -import ( - "bufio" - _ "embed" - "encoding/json" - "errors" - "io" - "os" - "path/filepath" - "testing" - "time" - - cp "github.com/otiai10/copy" - "github.com/stretchr/testify/require" -) - -//go:embed testdata/filebeat_system_module.yml -var systemModuleCfg string - -func copyModulesDir(t *testing.T, dst string) { - pwd, err := os.Getwd() - if err != nil { - t.Fatalf("cannot get the current directory: %s", err) - } - localModules := filepath.Join(pwd, "../", "../", "module") - localModulesD := filepath.Join(pwd, "../", "../", "modules.d") - - if err := cp.Copy(localModules, filepath.Join(dst, "module")); err != nil { - t.Fatalf("cannot copy 'module' folder to test folder: %s", err) - } - if err := cp.Copy(localModulesD, filepath.Join(dst, "modules.d")); err != nil { - t.Fatalf("cannot copy 'modules.d' folder to test folder: %s", err) - } -} - -//nolint:unused,nolintlint // necessary on Linux -func waitForAllFilesets(t *testing.T, outputGlob string, msgAndArgs ...any) { - require.Eventually( - t, - findFilesetNames(t, outputGlob), - time.Minute, - 10*time.Millisecond, - msgAndArgs...) -} - -//nolint:unused,nolintlint // necessary on Linux -func findFilesetNames(t *testing.T, outputGlob string) func() bool { - f := func() bool { - files, err := filepath.Glob(outputGlob) - if err != nil { - t.Fatalf("cannot get files list for glob '%s': '%s'", outputGlob, err) - } - - if len(files) > 1 { - t.Fatalf( - "only a single output file is supported, found: %d. Files: %s", - len(files), - files, - ) - } - - foundSyslog := false - foundAuth := false - - file, err := os.Open(files[0]) - if err != nil { - t.Fatalf("cannot open '%s': '%s'", files[0], err) - } - defer file.Close() - - r := bufio.NewReader(file) - for { - line, err := r.ReadBytes('\n') - if err != nil { - if errors.Is(err, io.EOF) { - break - } else { - t.Fatalf("cannot read '%s': '%s", file.Name(), err) - } - } - - data := struct { - Fileset struct { - Name string `json:"name"` - } `json:"fileset"` - }{} - - if err := json.Unmarshal(line, &data); err != nil { - t.Fatalf("cannot parse output line as JSON: %s", err) - } - - switch data.Fileset.Name { - case "syslog": - foundSyslog = true - case "auth": - foundAuth = true - } - - if foundAuth && foundSyslog { - return true - } - } - - return false - } - - return f -} diff --git a/filebeat/tests/integration/systemlogs_linux_test.go b/filebeat/tests/integration/systemlogs_linux_test.go deleted file mode 100644 index 88af84734af..00000000000 --- a/filebeat/tests/integration/systemlogs_linux_test.go +++ /dev/null @@ -1,67 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -//go:build integration && linux - -package integration - -import ( - "fmt" - "path/filepath" - "testing" - "time" - - "github.com/elastic/beats/v7/libbeat/tests/integration" -) - -// TestSystemLogsCanUseJournald aims to ensure the system-logs input can -// correctly choose and start a journald input when the globs defined in -// var.paths do not resolve to any file. -func TestSystemModuleCanUseJournaldInput(t *testing.T) { - t.Skip("The system module is not using the system-logs input at the moment") - filebeat := integration.NewBeat( - t, - "filebeat", - "../../filebeat.test", - ) - workDir := filebeat.TempDir() - copyModulesDir(t, workDir) - - // As the name says, we want this folder to exist bu t be empty - globWithoutFiles := filepath.Join(filebeat.TempDir(), "this-folder-does-not-exist") - yamlCfg := fmt.Sprintf(systemModuleCfg, globWithoutFiles, globWithoutFiles, workDir) - - filebeat.WriteConfigFile(yamlCfg) - filebeat.Start() - - filebeat.WaitForLogs( - "no files were found, using journald input", - 10*time.Second, - "system-logs did not select journald input") - filebeat.WaitForLogs( - "journalctl started with PID", - 10*time.Second, - "system-logs did not start journald input") - - // Scan every event in the output until at least one from - // each fileset (auth, syslog) is found. - waitForAllFilesets( - t, - filepath.Join(workDir, "output*.ndjson"), - "did not find events from both filesets: 'auth' and 'syslog'", - ) -} diff --git a/filebeat/tests/integration/systemlogs_other_test.go b/filebeat/tests/integration/systemlogs_other_test.go deleted file mode 100644 index 42fc61b426d..00000000000 --- a/filebeat/tests/integration/systemlogs_other_test.go +++ /dev/null @@ -1,56 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -//go:build integration - -package integration - -import ( - "fmt" - "path" - "testing" - "time" - - "github.com/elastic/beats/v7/libbeat/tests/integration" -) - -func TestSystemLogsCanUseLogInput(t *testing.T) { - t.Skip("The system module is not using the system-logs input at the moment") - filebeat := integration.NewBeat( - t, - "filebeat", - "../../filebeat.test", - ) - workDir := filebeat.TempDir() - copyModulesDir(t, workDir) - - logFilePath := path.Join(workDir, "syslog") - integration.GenerateLogFile(t, logFilePath, 5, false) - yamlCfg := fmt.Sprintf(systemModuleCfg, logFilePath, logFilePath, workDir) - - filebeat.WriteConfigFile(yamlCfg) - filebeat.Start() - - filebeat.WaitForLogs( - "using log input because file(s) was(were) found", - 10*time.Second, - "system-logs did not select the log input") - filebeat.WaitForLogs( - "Harvester started for paths:", - 10*time.Second, - "system-logs did not start the log input") -}