From c438382b0bf528d3dddc7cdb6b71bd7b63b088e7 Mon Sep 17 00:00:00 2001
From: Dan Kortschak <90160302+efd6@users.noreply.github.com>
Date: Tue, 21 Nov 2023 12:25:00 +1030
Subject: [PATCH] x-pack/filebeat/input/cel: make now evaluate to a time in UTC
 (#37159)

now() and the mito now global both evaluate as times in UTC. The
per-period now global of the input should as well.
---
 CHANGELOG.next.asciidoc            | 1 +
 x-pack/filebeat/input/cel/input.go | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index f75bb1624efc..dc2848479a7e 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -91,6 +91,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Fix handling of response errors in HTTPJSON and CEL request trace logging. {pull}36956[36956]
 - Do not error when Okta API returns no data. {pull}37092[37092]
 - Fix request body close behaviour in HTTP_Endpoint when handling GZIP compressed content. {pull}37091[37091]
+- Make CEL input now global evaluate to a time in UTC. {pull}37159[37159]
 
 *Heartbeat*
 
diff --git a/x-pack/filebeat/input/cel/input.go b/x-pack/filebeat/input/cel/input.go
index b65f0ae8d100..c12ea0fd2e4e 100644
--- a/x-pack/filebeat/input/cel/input.go
+++ b/x-pack/filebeat/input/cel/input.go
@@ -232,7 +232,7 @@ func (i input) run(env v2.Context, src *source, cursor map[string]interface{}, p
 			}
 			log.Debugw("request state", logp.Namespace("cel"), "state", redactor{state: state, cfg: cfg.Redact})
 			metrics.executions.Add(1)
-			start := i.now()
+			start := i.now().In(time.UTC)
 			state, err = evalWith(ctx, prg, state, start)
 			log.Debugw("response state", logp.Namespace("cel"), "state", redactor{state: state, cfg: cfg.Redact})
 			if err != nil {