Add new `fingerprint` file identity #35734

rdner · 2023-06-09T15:47:28Z

UPD
See #36078 for benchmarks results.

What does this PR do?

This is a new alternative to existing options like native, path and inode_marker.

Unlike the existing options, this file identity does not rely on any file system metadata and uses only the file size and its content.

Users can specify what amount of bytes is used to fingerprint the beginning of each file.

This identity is supposed to be more stable and less affected by the environment/setup of the users.

Why is it important?

Some of customers experiencing problems with relying on file system metadata, so we need the alternative file identity option that does not rely on any file system metadata.

Checklist

My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
I have made corresponding change to the default configuration files
I have added tests that prove my fix is effective or that my feature works
I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

Solve handling the file removal event (cannot read the file content after its removal)
Tests for fswatch.go
Steps for manual testing

Edge cases

when a file size is under the fingerprint offset+length its ingested is delayed until the file grows in size
when there is a fingerprint collision, only the first discovered file with this fingerprint is ingested, the rest are ignored. Users will find this log message in Filebeat's output:

{                                                                   
  "log.level": "info",                                              
  "@timestamp": "2023-07-13T11:42:47.606+0200",                     
  "log.logger": "scanner",                                          
  "log.origin": {                                                                                                                       
    "file.name": "filestream/fswatch.go",                           
    "file.line": 376                                                
  },                                                                                                                                    
  "message": "\"/path/to/your/logs/some.log\" points to an already known ingest target \"/path/to/your/logs/another.log\" [2edc986847e209b4016e141a6dc8716d3207350f416969382d431539bf292e4a==2edc986847e209b4016e141a6
dc8716d3207350f416969382d431539bf292e4a]. Skipping",                                                                                    
  "service.name": "filebeat",                                       
  "ecs.version": "1.6.0"                                            
}

when a fingerprint identity is set but fingerprint is disabled in the scanner, Filebeat will fail to start with:

{
  "log.level": "error",
  "@timestamp": "2023-07-13T11:36:49.507+0200",
  "log.origin": {
    "file.name": "instance/beat.go",
    "file.line": 1274
  },
  "message": "Exiting: Failed to start crawler: starting input failed: error while initializing input: cannot create prospector: fingerprint file identity can be used only when fingerprint is enabled in the scanner",
  "service.name": "filebeat",
  "ecs.version": "1.6.0"
}

when a fingerprint size is less than 64 bytes (length-offset) Filebeat will fail to start with:

{
  "log.level": "error",
  "@timestamp": "2023-07-13T11:38:32.080+0200",
  "log.origin": {
    "file.name": "instance/beat.go",
    "file.line": 1274
  },
  "message": "Exiting: Failed to start crawler: starting input failed: error while initializing input: cannot create prospector: error while creating filewatcher error while reading configuration of fingerprint: fingerprint size 10 cannot be smaller than 64",
  "service.name": "filebeat",
  "ecs.version": "1.6.0"
}

This requirement comes from the SHA block size.

if the fingerprint file identity is used any changes to offset or length values will lead to the full re-ingestion of all files matched by the paths.

Documentation updates

How to test this PR locally

Run Filebeat with this configuration:

filebeat.inputs:
  - type: filestream
    id: my-filestream-id
    paths:
      - "/path/to/your/logs/*.log"
    prospector.scanner.check_interval: 5s
    prospector.scanner.fingerprint.enabled: true # starts using fingerprinting for scanning files
    file_identity.fingerprint: ~ # is using a computed fingerprint as an ID in the registry
path.data: "/path/to/your/data"
logging:
  level: debug
output.console:
  enabled: true

Note the path placeholders you need to fix first.

Check if the following log messages showed up in the Filebeat's output:

{                                                                   
  "log.level": "debug",                                             
  "@timestamp": "2023-07-13T11:00:43.811+0200",                     
  "log.logger": "scanner",                                          
  "log.origin": {                                                   
    "file.name": "filestream/fswatch.go",                           
    "file.line": 295                                                
  },                                                                
  "message": "fingerprint mode enabled: offset 0, length 1024",     
  "service.name": "filebeat",                                       
  "ecs.version": "1.6.0"                                            
}
{                                                                   
  "log.level": "debug",                                             
  "@timestamp": "2023-07-13T11:00:43.811+0200",                     
  "log.origin": {                                                   
    "file.name": "filestream/prospector_creator.go",                
    "file.line": 58                                                 
  },                                                                
  "message": "file identity is set to fingerprint",                 
  "service.name": "filebeat",                                       
  "filestream_id": "my-filestream-id",                              
  "ecs.version": "1.6.0"                                            
}

Place an empty file (touch some.log) in /path/to/your/logs
Wait up to 5 seconds to see this log message in Filebeat's output:

{
  "log.level": "debug",
  "@timestamp": "2023-07-13T11:09:25.676+0200",
  "log.logger": "scanner",
  "log.origin": {
    "file.name": "filestream/fswatch.go",
    "file.line": 370
  },
  "message": "cannot create a file descriptor for an ingest target \"/path/to/your/logs/some.log\": filesize of \"/path/to/your/logs/some.log\" is 0, expected at least 1024 for fingerprinting",
  "service.name": "filebeat",
  "ecs.version": "1.6.0"
}

This means the scanner detected the file but its ingestion is delayed until the file size reaches the fingerprint size, which is 1024 bytes by default.

Add 128 bytes to the file using the following command:

printf 'a%.0s' {1..128} >> some.log

you can see that the message changed and contains the new file size:

{
  "log.level": "debug",
  "@timestamp": "2023-07-13T11:12:43.968+0200",
  "log.logger": "scanner",
  "log.origin": {
    "file.name": "filestream/fswatch.go",
    "file.line": 370
  },
  "message": "cannot create a file descriptor for an ingest target \"/path/to/your/logs/some.log\": filesize of \"/path/to/your/logs/some.log\" is 128, expected at least 1024 for fingerprinting",
  "service.name": "filebeat",
  "ecs.version": "1.6.0"
}

Write another 896 bytes (1024 in total):

printf 'a%.0s' {1..896} >> some.log

and you should see that Filebeat started reading from it:

{                                                                   
  "log.level": "debug",                                             
  "@timestamp": "2023-07-13T11:15:18.969+0200",                     
  "log.logger": "input.filestream",                                 
  "log.origin": {                                                                                                                       
    "file.name": "filestream/prospector.go",                        
    "file.line": 179                                                
  },                                                                                                                                    
  "message": "A new file /path/to/your/logs/some.log has been found",                                      
  "service.name": "filebeat",                                                                                                           
  "id": "my-filestream-id",                                         
  "prospector": "file_prospector",                                  
  "operation": "create",                                            
  "source_name": "fingerprint::2edc986847e209b4016e141a6dc8716d3207350f416969382d431539bf292e4a",                                       
  "fingerprint": "2edc986847e209b4016e141a6dc8716d3207350f416969382d431539bf292e4a",                                                    
  "os_id": "119173889-16777234",                                    
  "new_path": "/path/to/your/logs/some.log",                                                               
  "ecs.version": "1.6.0"                                            
}
{                                                                   
  "log.level": "debug",                                                                                                                 
  "@timestamp": "2023-07-13T11:15:18.970+0200",                     
  "log.logger": "input.filestream",                                 
  "log.origin": {                                                                                                                       
    "file.name": "input-logfile/harvester.go",                                                                                          
    "file.line": 139                                                                                                                    
  },                                                                
  "message": "Starting harvester for file",                         
  "service.name": "filebeat",                                       
  "id": "my-filestream-id",                                         
  "source_file": "filestream::my-filestream-id::fingerprint::2edc986847e209b4016e141a6dc8716d3207350f416969382d431539bf292e4a",         
  "ecs.version": "1.6.0"                                            
}
{                                                                   
  "log.level": "debug",                                             
  "@timestamp": "2023-07-13T11:15:18.971+0200",                     
  "log.logger": "input.filestream",                                 
  "log.origin": {                                                   
    "file.name": "filestream/filestream.go",                        
    "file.line": 131                                                
  },                                                                
  "message": "End of file reached: /path/to/your/logs/some.log; Backoff now.",                             
  "service.name": "filebeat",                                       
  "id": "my-filestream-id",                                         
  "source_file": "filestream::my-filestream-id::fingerprint::2edc986847e209b4016e141a6dc8716d3207350f416969382d431539bf292e4a",         
  "path": "/path/to/your/logs/some.log",                                                                   
  "state-id": "fingerprint::2edc986847e209b4016e141a6dc8716d3207350f416969382d431539bf292e4a",                                          
  "ecs.version": "1.6.0"                                            
}

The file is an ingest target now and we can see a file entry in the registry log:

{
  "op": "set",
  "id": 1
}
{
  "k": "filestream::my-filestream-id::fingerprint::2edc986847e209b4016e141a6dc8716d3207350f416969382d431539bf292e4a",
  "v": {
    "ttl": 0,
    "updated": [
      281470681743360,
      18446744011573955000
    ],
    "cursor": null,
    "meta": {
      "identifier_name": "fingerprint",
      "source": "/path/to/your/logs/some.log"
    }
  }
}
{
  "op": "set",
  "id": 2
}
{
  "k": "filestream::my-filestream-id::fingerprint::2edc986847e209b4016e141a6dc8716d3207350f416969382d431539bf292e4a",
  "v": {
    "ttl": 1800000000000,
    "updated": [
      516367547520,
      1689239718
    ],
    "cursor": null,
    "meta": {
      "identifier_name": "fingerprint",
      "source": "/path/to/your/logs/some.log"
    }
  }
}

As you can see there is no offset yet, because we have not written a new line character and our configuration is line-based.

Write the new line character at the end of the file:

echo >> some.log

Now you should see this log message in Filebeat's output:

{                                                                   
  "log.level": "debug",                                             
  "@timestamp": "2023-07-13T11:25:34.821+0200",                     
  "log.logger": "processors",                                       
  "log.origin": {                                                   
    "file.name": "processing/processors.go",                        
    "file.line": 213                                                
  },                                                                
  "message": "Publish event: {\n  \"@timestamp\": \"2023-07-13T09:25:34.821Z\",\n  \"@metadata\": {\n    \"beat\": \"filebeat\",\n    \"type\": \"_doc\",\n    \"version\": \"8.10.0\"\n  },\n  \"message\": \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\n  \"input\": {\n    \"type\": \"filestream\"\n  },\n  \"host\": {\n    \"name\": \"MacBook-Pro.localdomain\"\n  },\n  \"agen
t\": {\n    \"version\": \"8.10.0\",\n    \"ephemeral_id\": \"bca636e7-678f-4155-ae6c-506f3fbda7be\",\n    \"id\": \"7bb65ce2-f3ae-4c9c-ad58-d33760e14425\",\n    \"name\": \"MacBook-Pro.localdomain\",\n    \"type\": \"filebeat\"\n  },\n  \"ecs\": {\n    \"version\": \"8.0
.0\"\n  },\n  \"log\": {\n    \"offset\": 0,\n    \"file\": {\n      \"path\": \"/path/to/your/logs/some.log\"\n    }\n  }\n}",                                                                                                                    
  "service.name": "filebeat",                                                                                                                                                                                                                                                   
  "ecs.version": "1.6.0"                                                                                                                                                                                                                                                        
}

If we look at the registry again, we'll see the updated offset:

{
  "op": "set",
  "id": 3
}
{
  "k": "filestream::my-filestream-id::fingerprint::2edc986847e209b4016e141a6dc8716d3207350f416969382d431539bf292e4a",
  "v": {
    "ttl": 1800000000000,
    "updated": [
      516217223520,
      1689240334
    ],
    "cursor": {
      "offset": 1025
    },
    "meta": {
      "source": "/path/to/your/logs/some.log",
      "identifier_name": "fingerprint"
    }
  }
}

Related issues

Closes [Filebeat] Implement a more stable file identifier #34419

mergify · 2023-06-09T15:48:02Z

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @rdner? 🙏.
For such, you'll need to label your PR with:

The upcoming major version of the Elastic Stack
The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

backport-v8./d.0 is the label to automatically backport to the 8./d branch. /d is the digit

elasticmachine · 2023-06-09T16:42:41Z

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Start Time: 2023-07-14T04:36:25.939+0000
Duration: 77 min 32 sec

Test stats 🧪

Test	Results
Failed	0
Passed	8046
Skipped	757
Total	8803

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

/test : Re-trigger the build.
/package : Generate the packages and run the E2E tests.
/beats-tester : Run the installation tests with beats-tester.
run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

mergify · 2023-06-20T14:24:06Z

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b fingerprint-file-identity upstream/fingerprint-file-identity
git merge upstream/main
git push upstream fingerprint-file-identity

This is a new alternative to existing options like `native`, `path` and `inode_marker`. Unlike the existing options, this file identity does not rely on any file system metadata and uses only the file size and its content. Users can specify what amount of bytes is used to fingerprint the beginning of each file. This identity is supposed to be more stable and less affected by the environment/setup of the users.

So, we can handle removals and postponed ingestion. Also, a few performance optimizations included.

rdner · 2023-07-13T09:45:19Z

filebeat/input/filestream/config.go

@@ -33,6 +33,7 @@ import (
 type config struct {
 	Reader readerConfig `config:",inline"`

+	ID             string             `config:"id"`


Need for better logging.

Not entirely clear what id represents: is it the identifier of the config object itself? The filestream input? Is it stable through restarts ?

This is an input ID in an input-level configuration. You can find it here https://www.elastic.co/guide/en/beats/filebeat/current/configuration-filebeat-options.html#CO11-1

rdner · 2023-07-13T09:46:30Z

filebeat/input/filestream/fswatch.go

-				s.log.Debug("stat(%s) failed: %s", file, err)
+			fileID := fd.FileID()
+			if knownFilename, exists := uniqueIDs[fileID]; exists {
+				s.log.Infof("%q points to an already known ingest target %q [%s==%s]. Skipping", fd.Filename, knownFilename, fileID, fileID)


should we promote it to WARN level? Can be potentially noisy but very useful for troubleshooting.

I think INFO is fine. There's neither any degraded behavior nor is there necessarily any action a user could take. And I know some customers are spooked by WARN level messages in the logs. So I'd leave this as INFO. We (maintainers) should be able to search for this message pretty easily during troubleshooting.

kilfoyle

LGTM for the docs part! 👍

ycombinator · 2023-07-13T15:59:49Z

cannot create a file descriptor for an ingest target "/path/to/your/logs/some.log": filesize of "/path/to/your/logs/some.log" is 128, expected at least 1024 for fingerprinting

I realize this log message, specifically the part about the filesize, is coming from an error returned by the fileScanner.toFileDescriptor method. I realize that method can return other errors too. And whatever error is returned is being logged at the debug level.

However, for this particular "error" about needing a minimum file size for fingerprinting, I think it might be valuable to log it as at a WARN level. If a file cannot be fingerprinted, it means it's not being ingested. I think users might want to know about this or else they'll think there's some unexpected data loss happening. OTOH, I'm not sure what users can do about the situation until the file size grows to be large enough for fingerprinting (and therefore ingestion). But I still lean towards having the user know why certain data isn't being ingested just yet.

Side note: it might be good to include units (bytes) in the message for the file sizes - observed and expected.

ycombinator

Left a couple of comments, mostly minor. Overall this is looking great!

filebeat/input/filestream/fswatch_test.go

ycombinator

LGTM - nice work @rdner!

faec

Looks good, only one nit so far, still working through everything though, will do another pass tomorrow

filebeat/input/filestream/fswatch.go

mergify · 2023-07-14T01:37:11Z

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b fingerprint-file-identity upstream/fingerprint-file-identity
git merge upstream/main
git push upstream fingerprint-file-identity

This is a new alternative to existing options like `native`, `path` and `inode_marker`. Unlike the existing options, this file identity does not rely on any file system metadata and uses only the file size and its content. Users can specify what amount of bytes is used to fingerprint the beginning of each file, optionally it's possible to set an offset from the beginning. This identity is supposed to be more stable and less affected by the environment/setup of the users. This change also contains a few performance optimisations of how we work with the filesystem and watch for file changes. (cherry picked from commit b701377) # Conflicts: # filebeat/input/filestream/config.go # filebeat/input/filestream/fswatch.go # filebeat/input/filestream/fswatch_test.go # filebeat/input/filestream/identifier.go # filebeat/input/filestream/prospector.go # filebeat/input/filestream/prospector_test.go # libbeat/metric/system/cgroup/cgcommon/metrics_test.go

* Add new `fingerprint` file identity (#35734) This is a new alternative to existing options like `native`, `path` and `inode_marker`. Unlike the existing options, this file identity does not rely on any file system metadata and uses only the file size and its content. Users can specify what amount of bytes is used to fingerprint the beginning of each file, optionally it's possible to set an offset from the beginning. This identity is supposed to be more stable and less affected by the environment/setup of the users. This change also contains a few performance optimisations of how we work with the filesystem and watch for file changes. (cherry picked from commit b701377) # Conflicts: # filebeat/input/filestream/config.go # filebeat/input/filestream/fswatch.go # filebeat/input/filestream/fswatch_test.go # filebeat/input/filestream/identifier.go # filebeat/input/filestream/prospector.go # filebeat/input/filestream/prospector_test.go # libbeat/metric/system/cgroup/cgcommon/metrics_test.go * Resolve conflicts --------- Co-authored-by: Denis <denis.rechkunov@elastic.co>

lucabelluccini · 2023-08-18T20:28:11Z

Hello 👋
In order to benefit from this in integrations, the inputs will need to expose file_identity setting or default to fingerprint, isn't it?

This is a new alternative to existing options like `native`, `path` and `inode_marker`. Unlike the existing options, this file identity does not rely on any file system metadata and uses only the file size and its content. Users can specify what amount of bytes is used to fingerprint the beginning of each file, optionally it's possible to set an offset from the beginning. This identity is supposed to be more stable and less affected by the environment/setup of the users. This change also contains a few performance optimisations of how we work with the filesystem and watch for file changes.

rdner added the enhancement label Jun 9, 2023

rdner self-assigned this Jun 9, 2023

botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Jun 9, 2023

rdner added skip-ci Skip the build in the CI but linting backport-v7.17.0 Automated backport with mergify labels Jun 9, 2023

rdner removed the skip-ci Skip the build in the CI but linting label Jun 9, 2023

rdner force-pushed the fingerprint-file-identity branch from a782869 to bf25f92 Compare June 9, 2023 19:37

rdner added 4 commits July 11, 2023 14:31

Fix the integration test

6603081

Close file after fingerprinting

a1c3043

Move fingerprinting to a lower level (fswatcher)

d47387a

So, we can handle removals and postponed ingestion. Also, a few performance optimizations included.

rdner force-pushed the fingerprint-file-identity branch from 3fc3bac to d47387a Compare July 11, 2023 12:37

rdner added the skip-ci Skip the build in the CI but linting label Jul 11, 2023

rdner added 3 commits July 11, 2023 15:00

Update docs

07c5511

Some fixes after rebase and switch of approach

2be9005

Add fswatch tests and make improvements

e86accb

rdner removed the skip-ci Skip the build in the CI but linting label Jul 12, 2023

rdner added 6 commits July 12, 2023 17:56

Update reference

76c8943

Add the changelog entry

e20d1f9

Make update

6fb641d

Rollback unnecessary changes in tests

62a7b8c

Test fixes

3769af9

More tests and docs

d8ecc4d

rdner added the Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team label Jul 13, 2023

botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Jul 13, 2023

rdner commented Jul 13, 2023

View reviewed changes

kilfoyle approved these changes Jul 13, 2023

View reviewed changes

ycombinator reviewed Jul 13, 2023

View reviewed changes

filebeat/input/filestream/fswatch_test.go Show resolved Hide resolved

rdner added 3 commits July 13, 2023 21:22

Add test for a fingerprint collision in watcher

d49fb77

Promote log messages to the warn level

08d8c8e

Use file units in log messages

627cef4

rdner requested review from ycombinator and pchila July 13, 2023 19:29

ycombinator approved these changes Jul 13, 2023

View reviewed changes

Fix tests

e0e8db9

faec reviewed Jul 13, 2023

View reviewed changes

filebeat/input/filestream/fswatch.go Outdated Show resolved Hide resolved

Handle edge-case when file info is out of date

11ff189

Merge branch 'main' into fingerprint-file-identity

06cbe45

rdner merged commit b701377 into elastic:main Jul 14, 2023
28 checks passed

rdner deleted the fingerprint-file-identity branch July 14, 2023 06:22

mergify bot mentioned this pull request Jul 14, 2023

[7.17](backport #35734) Add new fingerprint file identity #36064

Merged

This was referenced Jul 15, 2023

Make fingerprinting faster #36073

Merged

Fix empty file edge case #36076

Merged

Add benchmarks for scanning files #36078

Merged

leehinman mentioned this pull request Sep 11, 2023

[filestream] revert change in symlink resolution #36557

Merged

3 tasks

rdner mentioned this pull request Oct 4, 2023

Re-use buffers to optimise memory allocation in fingerprint #36736

Merged

2 tasks

geekpete mentioned this pull request Feb 9, 2024

[Filebeat] Improve documentation about file identifiers/device ID #34418

Closed

rdner mentioned this pull request Mar 19, 2024

Make log messages in the file scanner less noisy #38421

Merged

4 tasks

mergify bot mentioned this pull request Mar 20, 2024

[8.13](backport #38421) Make log messages in the file scanner less noisy #38454

Merged

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add new `fingerprint` file identity #35734

Add new `fingerprint` file identity #35734

rdner commented Jun 9, 2023 •

edited

mergify bot commented Jun 9, 2023

elasticmachine commented Jun 9, 2023 •

edited by jenkins-beats-ci bot

Build stats

Test stats 🧪

mergify bot commented Jun 20, 2023

rdner Jul 13, 2023

pchila Jul 13, 2023

rdner Jul 13, 2023

rdner Jul 13, 2023 •

edited

ycombinator Jul 13, 2023

kilfoyle left a comment

ycombinator commented Jul 13, 2023

ycombinator left a comment

ycombinator left a comment

faec left a comment

mergify bot commented Jul 14, 2023

lucabelluccini commented Aug 18, 2023

Add new fingerprint file identity #35734

Add new fingerprint file identity #35734

Conversation

rdner commented Jun 9, 2023 • edited

What does this PR do?

Why is it important?

Checklist

Author's Checklist

Edge cases

Documentation updates

How to test this PR locally

Related issues

mergify bot commented Jun 9, 2023

elasticmachine commented Jun 9, 2023 • edited by jenkins-beats-ci bot

💚 Build Succeeded

Build stats

Test stats 🧪

💚 Flaky test report

🤖 GitHub comments

mergify bot commented Jun 20, 2023

rdner Jul 13, 2023

Choose a reason for hiding this comment

pchila Jul 13, 2023

Choose a reason for hiding this comment

rdner Jul 13, 2023

Choose a reason for hiding this comment

rdner Jul 13, 2023 • edited

Choose a reason for hiding this comment

ycombinator Jul 13, 2023

Choose a reason for hiding this comment

kilfoyle left a comment

Choose a reason for hiding this comment

ycombinator commented Jul 13, 2023

ycombinator left a comment

Choose a reason for hiding this comment

ycombinator left a comment

Choose a reason for hiding this comment

faec left a comment

Choose a reason for hiding this comment

mergify bot commented Jul 14, 2023

lucabelluccini commented Aug 18, 2023

Add new `fingerprint` file identity #35734

Add new `fingerprint` file identity #35734

rdner commented Jun 9, 2023 •

edited

elasticmachine commented Jun 9, 2023 •

edited by jenkins-beats-ci bot

rdner Jul 13, 2023 •

edited