From 00594952ec03f94667955fd356447cbb5d3c329b Mon Sep 17 00:00:00 2001 From: Tiago Queiroz Date: Thu, 16 Jan 2025 12:58:07 -0500 Subject: [PATCH] Remove the system-logs input The system-logs input was created to support reading syslog and auth logs from Linux hosts by the system module, but at the end it was decided not to use it. This commit removes its code and references. --- CHANGELOG-developer.next.asciidoc | 1 + filebeat/include/list.go | 1 - filebeat/input/default-inputs/inputs_linux.go | 2 - filebeat/input/systemlogs/input.go | 214 ------------------ filebeat/input/systemlogs/input_linux.go | 90 -------- filebeat/input/systemlogs/input_linux_test.go | 54 ----- filebeat/input/systemlogs/input_other.go | 31 --- filebeat/input/systemlogs/input_test.go | 145 ------------ .../tests/integration/systemlogs_all_test.go | 126 ----------- .../integration/systemlogs_linux_test.go | 67 ------ .../integration/systemlogs_other_test.go | 56 ----- 11 files changed, 1 insertion(+), 786 deletions(-) delete mode 100644 filebeat/input/systemlogs/input.go delete mode 100644 filebeat/input/systemlogs/input_linux.go delete mode 100644 filebeat/input/systemlogs/input_linux_test.go delete mode 100644 filebeat/input/systemlogs/input_other.go delete mode 100644 filebeat/input/systemlogs/input_test.go delete mode 100644 filebeat/tests/integration/systemlogs_all_test.go delete mode 100644 filebeat/tests/integration/systemlogs_linux_test.go delete mode 100644 filebeat/tests/integration/systemlogs_other_test.go diff --git a/CHANGELOG-developer.next.asciidoc b/CHANGELOG-developer.next.asciidoc index 0b0fd435ae37..19f0015a00c2 100644 --- a/CHANGELOG-developer.next.asciidoc +++ b/CHANGELOG-developer.next.asciidoc @@ -71,6 +71,7 @@ The list below covers the major changes between 7.0.0-rc2 and main only. - Rename x-pack/filebeat websocket input to streaming. {issue}40264[40264] {pull}40421[40421] - Journald input now calls `journalctl` instead of using `github.com/coreos/go-systemd/v22@v22.5.0/sdjournal`, the CGO dependency has been removed from Filebeat {pull}40061[40061] - System module events now contain `input.type: systemlogs` instead of `input.type: log` when harvesting log files, however the ingest pipeline sets it back to the original input (log or journald). {pull}41246[41246] +- The system-logs input is remove because it's not used any more {pull}42328[42328] ==== Bugfixes diff --git a/filebeat/include/list.go b/filebeat/include/list.go index ae05c332eaa4..d71af2bc1ff9 100644 --- a/filebeat/include/list.go +++ b/filebeat/include/list.go @@ -34,7 +34,6 @@ import ( _ "github.com/elastic/beats/v7/filebeat/input/redis" _ "github.com/elastic/beats/v7/filebeat/input/stdin" _ "github.com/elastic/beats/v7/filebeat/input/syslog" - _ "github.com/elastic/beats/v7/filebeat/input/systemlogs" _ "github.com/elastic/beats/v7/filebeat/module/apache" _ "github.com/elastic/beats/v7/filebeat/module/auditd" _ "github.com/elastic/beats/v7/filebeat/module/elasticsearch" diff --git a/filebeat/input/default-inputs/inputs_linux.go b/filebeat/input/default-inputs/inputs_linux.go index ec37894d26ae..8eed9a3ea4f5 100644 --- a/filebeat/input/default-inputs/inputs_linux.go +++ b/filebeat/input/default-inputs/inputs_linux.go @@ -19,7 +19,6 @@ package inputs import ( "github.com/elastic/beats/v7/filebeat/input/journald" - "github.com/elastic/beats/v7/filebeat/input/systemlogs" v2 "github.com/elastic/beats/v7/filebeat/input/v2" cursor "github.com/elastic/beats/v7/filebeat/input/v2/input-cursor" "github.com/elastic/beats/v7/libbeat/beat" @@ -38,7 +37,6 @@ func osInputs(info beat.Info, log *logp.Logger, components osComponents) []v2.Pl zeroPlugin := v2.Plugin{} if journald := journald.Plugin(log, components); journald != zeroPlugin { plugins = append(plugins, journald) - plugins = append(plugins, systemlogs.PluginV2(log, components)) } return plugins diff --git a/filebeat/input/systemlogs/input.go b/filebeat/input/systemlogs/input.go deleted file mode 100644 index eadc5a8565ac..000000000000 --- a/filebeat/input/systemlogs/input.go +++ /dev/null @@ -1,214 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -package systemlogs - -import ( - "errors" - "fmt" - "os" - "path/filepath" - - "github.com/elastic/beats/v7/filebeat/channel" - v1 "github.com/elastic/beats/v7/filebeat/input" - loginput "github.com/elastic/beats/v7/filebeat/input/log" - v2 "github.com/elastic/beats/v7/filebeat/input/v2" - cursor "github.com/elastic/beats/v7/filebeat/input/v2/input-cursor" - "github.com/elastic/beats/v7/libbeat/feature" - conf "github.com/elastic/elastic-agent-libs/config" - "github.com/elastic/elastic-agent-libs/logp" -) - -const pluginName = "system-logs" - -func init() { - // Register an input V1, that's used by the log input - if err := v1.Register(pluginName, newV1Input); err != nil { - panic(err) - } -} - -type config struct { - UseJournald bool `config:"use_journald"` - UseFiles bool `config:"use_files"` - Files *conf.C `config:"files" yaml:"files"` - Journald *conf.C `config:"journald" yaml:"journald"` -} - -func (c *config) Validate() error { - if c.UseFiles && c.UseJournald { - return errors.New("'use_journald' and 'use_files' cannot both be true") - } - - if c.Files == nil && c.Journald == nil { - return errors.New("one of 'journald' or 'files' must be set") - } - - return nil -} - -// newV1Input checks whether the log input must be created and -// delegates to loginput.NewInput if needed. -func newV1Input( - cfg *conf.C, - outlet channel.Connector, - context v1.Context, -) (v1.Input, error) { - journald, err := useJournald(cfg) - if err != nil { - return nil, fmt.Errorf("cannot decide between journald and files: %w", err) - } - - if journald { - return nil, v2.ErrUnknownInput - } - - // Convert the configuration and create a log input - logCfg, err := toFilesConfig(cfg) - if err != nil { - return nil, err - } - - return loginput.NewInput(logCfg, outlet, context) -} - -// PluginV2 creates a v2.Plugin that will instantiate a journald -// input if needed. -func PluginV2(logger *logp.Logger, store cursor.StateStore) v2.Plugin { - logger = logger.Named(pluginName) - - return v2.Plugin{ - Name: pluginName, - Stability: feature.Experimental, - Deprecated: false, - Info: "system-logs input", - Doc: "The system-logs input collects system logs on Linux by reading them from journald or traditional log files", - Manager: &cursor.InputManager{ - Logger: logger, - StateStore: store, - Type: pluginName, - Configure: configure, - }, - } -} - -// useJournald returns true if jounrald should be used. -// If there is an error, false is always retruned. -// -// The decision logic is: -// - If UseJournald is set, return true -// - If UseFiles is set, return false -// - If the globs defined in `files.paths` match any existing file, -// return false -// - Otherwise return true -func useJournald(c *conf.C) (bool, error) { - logger := logp.L().Named("input.system-logs") - - cfg := config{} - if err := c.Unpack(&cfg); err != nil { - return false, fmt.Errorf("cannot unpack 'system-logs' config: %w", err) - } - - if cfg.UseJournald { - logger.Info("using journald input because 'use_journald' is set") - return true, nil - } - - if cfg.UseFiles { - logger.Info("using log input because 'use_files' is set") - return false, nil - } - - globs := struct { - Paths []string `config:"files.paths"` - }{} - - if err := c.Unpack(&globs); err != nil { - return false, fmt.Errorf("cannot parse paths from config: %w", err) - } - - for _, g := range globs.Paths { - paths, err := filepath.Glob(g) - if err != nil { - return false, fmt.Errorf("cannot resolve glob: %w", err) - } - - for _, p := range paths { - stat, err := os.Stat(p) - if err != nil { - return false, fmt.Errorf("cannot stat '%s': %w", p, err) - } - - // Ignore directories - if stat.IsDir() { - continue - } - - // We found one file, return early - logger.Infof( - "using log input because file(s) was(were) found when testing glob '%s'", - g) - return false, nil - } - } - - // if no system log files are found, then use jounrald - logger.Info("no files were found, using journald input") - - return true, nil -} - -func toFilesConfig(cfg *conf.C) (*conf.C, error) { - newCfg, err := cfg.Child("files", -1) - if err != nil { - return nil, fmt.Errorf("cannot extract 'journald' block: %w", err) - } - - if _, err := cfg.Remove("journald", -1); err != nil { - return nil, err - } - - if _, err := cfg.Remove("type", -1); err != nil { - return nil, err - } - - if _, err := cfg.Remove("files", -1); err != nil { - return nil, err - } - - if _, err := cfg.Remove("use_journald", -1); err != nil { - return nil, err - } - - if _, err := cfg.Remove("use_files", -1); err != nil { - return nil, err - } - - if err := newCfg.Merge(cfg); err != nil { - return nil, err - } - - if err := newCfg.SetString("type", -1, "log"); err != nil { - return nil, fmt.Errorf("cannot set 'type': %w", err) - } - - if err := cfg.SetString("type", -1, pluginName); err != nil { - return nil, fmt.Errorf("cannot set type back to '%s': %w", pluginName, err) - } - - return newCfg, nil -} diff --git a/filebeat/input/systemlogs/input_linux.go b/filebeat/input/systemlogs/input_linux.go deleted file mode 100644 index 98a59361c0b2..000000000000 --- a/filebeat/input/systemlogs/input_linux.go +++ /dev/null @@ -1,90 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -//go:build linux - -package systemlogs - -import ( - "fmt" - - "github.com/elastic/beats/v7/filebeat/input/journald" - v2 "github.com/elastic/beats/v7/filebeat/input/v2" - cursor "github.com/elastic/beats/v7/filebeat/input/v2/input-cursor" - conf "github.com/elastic/elastic-agent-libs/config" -) - -// configure checks whether the journald input must be created and -// delegates to journald.Configure if needed. -func configure(cfg *conf.C) ([]cursor.Source, cursor.Input, error) { - jouranl, err := useJournald(cfg) - if err != nil { - return nil, nil, fmt.Errorf("cannot decide between journald and files: %w", err) - } - - if !jouranl { - return nil, nil, v2.ErrUnknownInput - } - - journaldCfg, err := toJournaldConfig(cfg) - if err != nil { - return nil, nil, err - } - - return journald.Configure(journaldCfg) -} - -func toJournaldConfig(cfg *conf.C) (*conf.C, error) { - newCfg, err := cfg.Child("journald", -1) - if err != nil { - return nil, fmt.Errorf("cannot extract 'journald' block: %w", err) - } - - if _, err := cfg.Remove("journald", -1); err != nil { - return nil, err - } - - if _, err := cfg.Remove("type", -1); err != nil { - return nil, err - } - - if _, err := cfg.Remove("files", -1); err != nil { - return nil, err - } - - if _, err := cfg.Remove("use_journald", -1); err != nil { - return nil, err - } - - if _, err := cfg.Remove("use_files", -1); err != nil { - return nil, err - } - - if err := newCfg.Merge(cfg); err != nil { - return nil, err - } - - if err := newCfg.SetString("type", -1, "journald"); err != nil { - return nil, fmt.Errorf("cannot set 'type': %w", err) - } - - if err := cfg.SetString("type", -1, pluginName); err != nil { - return nil, fmt.Errorf("cannot set type back to '%s': %w", pluginName, err) - } - - return newCfg, nil -} diff --git a/filebeat/input/systemlogs/input_linux_test.go b/filebeat/input/systemlogs/input_linux_test.go deleted file mode 100644 index 251ef6cae67a..000000000000 --- a/filebeat/input/systemlogs/input_linux_test.go +++ /dev/null @@ -1,54 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -//go:build linux - -package systemlogs - -import ( - "testing" - - conf "github.com/elastic/elastic-agent-libs/config" -) - -func TestJournaldInputIsCreated(t *testing.T) { - c := map[string]any{ - "files.paths": []string{"/file/does/not/exist"}, - // The 'journald' object needs to exist for the input to be instantiated - "journald.enabled": true, - } - - cfg := conf.MustNewConfigFrom(c) - - _, inp, err := configure(cfg) - if err != nil { - t.Fatalf("did not expect an error calling newV1Input: %s", err) - } - - type namer interface { - Name() string - } - - i, isNamer := inp.(namer) - if !isNamer { - t.Fatalf("expecting an instance of *log.Input, got '%T' instead", inp) - } - - if got, expected := i.Name(), "journald"; got != expected { - t.Fatalf("expecting '%s' input, got '%s'", expected, got) - } -} diff --git a/filebeat/input/systemlogs/input_other.go b/filebeat/input/systemlogs/input_other.go deleted file mode 100644 index ab21d3864b17..000000000000 --- a/filebeat/input/systemlogs/input_other.go +++ /dev/null @@ -1,31 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -//go:build !linux - -package systemlogs - -import ( - "errors" - - cursor "github.com/elastic/beats/v7/filebeat/input/v2/input-cursor" - conf "github.com/elastic/elastic-agent-libs/config" -) - -func configure(cfg *conf.C) ([]cursor.Source, cursor.Input, error) { - return nil, nil, errors.New("journald is only supported on Linux") -} diff --git a/filebeat/input/systemlogs/input_test.go b/filebeat/input/systemlogs/input_test.go deleted file mode 100644 index 6e5526f17361..000000000000 --- a/filebeat/input/systemlogs/input_test.go +++ /dev/null @@ -1,145 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -package systemlogs - -import ( - "os" - "testing" - - "github.com/elastic/beats/v7/filebeat/channel" - "github.com/elastic/beats/v7/filebeat/input" - "github.com/elastic/beats/v7/filebeat/input/log" - "github.com/elastic/beats/v7/libbeat/beat" - conf "github.com/elastic/elastic-agent-libs/config" -) - -func generateFile(t *testing.T) string { - // Create a know file for testing, the content is not relevant - // it just needs to exist - knwonFile, err := os.CreateTemp(t.TempDir(), t.Name()+"knwonFile*") - if err != nil { - t.Fatalf("cannot create temporary file: %s", err) - } - - if _, err := knwonFile.WriteString("Bowties are cool"); err != nil { - t.Fatalf("cannot write to temporary file '%s': %s", knwonFile.Name(), err) - } - knwonFile.Close() - - return knwonFile.Name() -} - -func TestUseJournald(t *testing.T) { - filename := generateFile(t) - - testCases := map[string]struct { - cfg map[string]any - useJournald bool - expectErr bool - }{ - "No files found": { - cfg: map[string]any{ - "files.paths": []string{"/file/does/not/exist"}, - }, - useJournald: true, - }, - "File exists": { - cfg: map[string]any{ - "files.paths": []string{filename}, - }, - useJournald: false, - }, - "use_journald is true": { - cfg: map[string]any{ - "use_journald": true, - "journald": struct{}{}, - }, - useJournald: true, - }, - "use_files is true": { - cfg: map[string]any{ - "use_files": true, - "journald": nil, - "files": struct{}{}, - }, - useJournald: false, - }, - "use_journald and use_files are true": { - cfg: map[string]any{ - "use_files": true, - "use_journald": true, - "journald": struct{}{}, - }, - useJournald: false, - expectErr: true, - }, - } - - for name, tc := range testCases { - t.Run(name, func(t *testing.T) { - cfg := conf.MustNewConfigFrom(tc.cfg) - - useJournald, err := useJournald(cfg) - if !tc.expectErr && err != nil { - t.Fatalf("did not expect an error calling 'useJournald': %s", err) - } - if tc.expectErr && err == nil { - t.Fatal("expecting an error when calling 'userJournald', got none") - } - - if useJournald != tc.useJournald { - t.Fatalf("expecting 'useJournald' to be %t, got %t", - tc.useJournald, useJournald) - } - }) - } -} - -func TestLogInputIsInstantiated(t *testing.T) { - filename := generateFile(t) - c := map[string]any{ - "files.paths": []string{filename}, - } - - cfg := conf.MustNewConfigFrom(c) - - inp, err := newV1Input(cfg, connectorMock{}, input.Context{}) - if err != nil { - t.Fatalf("did not expect an error calling newV1Input: %s", err) - } - _, isLogInput := inp.(*log.Input) - if !isLogInput { - t.Fatalf("expecting an instance of *log.Input, got '%T' instead", inp) - } -} - -type connectorMock struct{} - -func (mock connectorMock) Connect(c *conf.C) (channel.Outleter, error) { - return outleterMock{}, nil -} - -func (mock connectorMock) ConnectWith(c *conf.C, clientConfig beat.ClientConfig) (channel.Outleter, error) { - return outleterMock{}, nil -} - -type outleterMock struct{} - -func (o outleterMock) Close() error { return nil } -func (o outleterMock) Done() <-chan struct{} { return make(chan struct{}) } -func (o outleterMock) OnEvent(beat.Event) bool { return false } diff --git a/filebeat/tests/integration/systemlogs_all_test.go b/filebeat/tests/integration/systemlogs_all_test.go deleted file mode 100644 index cbc0c50c129d..000000000000 --- a/filebeat/tests/integration/systemlogs_all_test.go +++ /dev/null @@ -1,126 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -package integration - -import ( - "bufio" - _ "embed" - "encoding/json" - "errors" - "io" - "os" - "path/filepath" - "testing" - "time" - - cp "github.com/otiai10/copy" - "github.com/stretchr/testify/require" -) - -//go:embed testdata/filebeat_system_module.yml -var systemModuleCfg string - -func copyModulesDir(t *testing.T, dst string) { - pwd, err := os.Getwd() - if err != nil { - t.Fatalf("cannot get the current directory: %s", err) - } - localModules := filepath.Join(pwd, "../", "../", "module") - localModulesD := filepath.Join(pwd, "../", "../", "modules.d") - - if err := cp.Copy(localModules, filepath.Join(dst, "module")); err != nil { - t.Fatalf("cannot copy 'module' folder to test folder: %s", err) - } - if err := cp.Copy(localModulesD, filepath.Join(dst, "modules.d")); err != nil { - t.Fatalf("cannot copy 'modules.d' folder to test folder: %s", err) - } -} - -//nolint:unused,nolintlint // necessary on Linux -func waitForAllFilesets(t *testing.T, outputGlob string, msgAndArgs ...any) { - require.Eventually( - t, - findFilesetNames(t, outputGlob), - time.Minute, - 10*time.Millisecond, - msgAndArgs...) -} - -//nolint:unused,nolintlint // necessary on Linux -func findFilesetNames(t *testing.T, outputGlob string) func() bool { - f := func() bool { - files, err := filepath.Glob(outputGlob) - if err != nil { - t.Fatalf("cannot get files list for glob '%s': '%s'", outputGlob, err) - } - - if len(files) > 1 { - t.Fatalf( - "only a single output file is supported, found: %d. Files: %s", - len(files), - files, - ) - } - - foundSyslog := false - foundAuth := false - - file, err := os.Open(files[0]) - if err != nil { - t.Fatalf("cannot open '%s': '%s'", files[0], err) - } - defer file.Close() - - r := bufio.NewReader(file) - for { - line, err := r.ReadBytes('\n') - if err != nil { - if errors.Is(err, io.EOF) { - break - } else { - t.Fatalf("cannot read '%s': '%s", file.Name(), err) - } - } - - data := struct { - Fileset struct { - Name string `json:"name"` - } `json:"fileset"` - }{} - - if err := json.Unmarshal(line, &data); err != nil { - t.Fatalf("cannot parse output line as JSON: %s", err) - } - - switch data.Fileset.Name { - case "syslog": - foundSyslog = true - case "auth": - foundAuth = true - } - - if foundAuth && foundSyslog { - return true - } - } - - return false - } - - return f -} diff --git a/filebeat/tests/integration/systemlogs_linux_test.go b/filebeat/tests/integration/systemlogs_linux_test.go deleted file mode 100644 index 88af84734aff..000000000000 --- a/filebeat/tests/integration/systemlogs_linux_test.go +++ /dev/null @@ -1,67 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -//go:build integration && linux - -package integration - -import ( - "fmt" - "path/filepath" - "testing" - "time" - - "github.com/elastic/beats/v7/libbeat/tests/integration" -) - -// TestSystemLogsCanUseJournald aims to ensure the system-logs input can -// correctly choose and start a journald input when the globs defined in -// var.paths do not resolve to any file. -func TestSystemModuleCanUseJournaldInput(t *testing.T) { - t.Skip("The system module is not using the system-logs input at the moment") - filebeat := integration.NewBeat( - t, - "filebeat", - "../../filebeat.test", - ) - workDir := filebeat.TempDir() - copyModulesDir(t, workDir) - - // As the name says, we want this folder to exist bu t be empty - globWithoutFiles := filepath.Join(filebeat.TempDir(), "this-folder-does-not-exist") - yamlCfg := fmt.Sprintf(systemModuleCfg, globWithoutFiles, globWithoutFiles, workDir) - - filebeat.WriteConfigFile(yamlCfg) - filebeat.Start() - - filebeat.WaitForLogs( - "no files were found, using journald input", - 10*time.Second, - "system-logs did not select journald input") - filebeat.WaitForLogs( - "journalctl started with PID", - 10*time.Second, - "system-logs did not start journald input") - - // Scan every event in the output until at least one from - // each fileset (auth, syslog) is found. - waitForAllFilesets( - t, - filepath.Join(workDir, "output*.ndjson"), - "did not find events from both filesets: 'auth' and 'syslog'", - ) -} diff --git a/filebeat/tests/integration/systemlogs_other_test.go b/filebeat/tests/integration/systemlogs_other_test.go deleted file mode 100644 index 42fc61b426d2..000000000000 --- a/filebeat/tests/integration/systemlogs_other_test.go +++ /dev/null @@ -1,56 +0,0 @@ -// Licensed to Elasticsearch B.V. under one or more contributor -// license agreements. See the NOTICE file distributed with -// this work for additional information regarding copyright -// ownership. Elasticsearch B.V. licenses this file to you under -// the Apache License, Version 2.0 (the "License"); you may -// not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, -// software distributed under the License is distributed on an -// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -// KIND, either express or implied. See the License for the -// specific language governing permissions and limitations -// under the License. - -//go:build integration - -package integration - -import ( - "fmt" - "path" - "testing" - "time" - - "github.com/elastic/beats/v7/libbeat/tests/integration" -) - -func TestSystemLogsCanUseLogInput(t *testing.T) { - t.Skip("The system module is not using the system-logs input at the moment") - filebeat := integration.NewBeat( - t, - "filebeat", - "../../filebeat.test", - ) - workDir := filebeat.TempDir() - copyModulesDir(t, workDir) - - logFilePath := path.Join(workDir, "syslog") - integration.GenerateLogFile(t, logFilePath, 5, false) - yamlCfg := fmt.Sprintf(systemModuleCfg, logFilePath, logFilePath, workDir) - - filebeat.WriteConfigFile(yamlCfg) - filebeat.Start() - - filebeat.WaitForLogs( - "using log input because file(s) was(were) found", - 10*time.Second, - "system-logs did not select the log input") - filebeat.WaitForLogs( - "Harvester started for paths:", - 10*time.Second, - "system-logs did not start the log input") -}