Fix the wrong event type for a new file (#36098) (#36102)

It's supposed to emit a `create` event, not a `write` event when a previously ignored empty file gets written to. (cherry picked from commit f52d38a) Co-authored-by: Denis <denis.rechkunov@elastic.co>
elastic · Jul 18, 2023 · ec49a82 · ec49a82
1 parent 195e58e
commit ec49a82
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/filebeat/input/filestream/fswatch.go b/filebeat/input/filestream/fswatch.go
@@ -202,6 +202,7 @@ func (w *fileWatcher) watch(ctx unison.Canceler) {
 		// no need to react on empty new files
 		if fd.Info.Size() == 0 {
 			w.log.Warnf("file %q has no content yet, skipping", fd.Filename)
+			delete(paths, path)
 			continue
 		}
 		select {

diff --git a/filebeat/input/filestream/fswatch_test.go b/filebeat/input/filestream/fswatch_test.go
@@ -295,8 +295,7 @@ scanner:
 			e := fw.Event()
 			expEvent := loginp.FSEvent{
 				NewPath: filename,
-				OldPath: filename,
-				Op:      loginp.OpWrite,
+				Op:      loginp.OpCreate,
 				Descriptor: loginp.FileDescriptor{
 					Filename: filename,
 					Info:     testFileInfo{path: basename, size: 5}, // +5 bytes appended