Skip to content

[8.19](backport #45730) Fix panic in winlog input#45738

Merged
ebeahan merged 4 commits into8.19from
mergify/bp/8.19/pr-45730
Aug 5, 2025
Merged

[8.19](backport #45730) Fix panic in winlog input#45738
ebeahan merged 4 commits into8.19from
mergify/bp/8.19/pr-45730

Conversation

@mergify
Copy link
Copy Markdown
Contributor

@mergify mergify Bot commented Aug 4, 2025

Fixes a panic in the winlog input that happened because of a conflict in the internal id of its metrics registry #45693.

When checking whether a registry input id already exists, the check didn't include the ids of input registries with "nested" type (which are unreported containers for cursor-based inputs that can have several sub-inputs inside).

This is usually not a problem because the default (and what most inputs use even when overriding their id, e.g. I think this is why it probably didn't hit the GCP input) is to use a scoped id like "input_id::source_id", so they don't conflict with the container which has bare id "input_id".
This hit winlog in particular because:

  • winlog always uses a source id that is the same as its input id
  • winlog still used the global input metrics helpers in the inputmon package instead of the metrics registry provided by the Filebeat inputs API
  • winlog is the only input that did not add a scope prefix on the id provided to inputmon.NewInputRegistry, so the globally-created registry conflicted with the input manager's container (and this conflict was missed because of the missed "nested" type check above).

Fixing the missed "nested" collision check would prevent the input panic, but the collision itself would still exist and prevent winlog input metrics from being reported.

This PR both fixes the missed "nested" conflict check and removes the deprecated global metrics call from the winlog input, replacing it with the API-provided registry.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues


This is an automatic backport of pull request #45730 done by [Mergify](https://mergify.com).

Fixes a panic in the winlog input that happened because of a conflict in the internal id of its metrics registry #45693.

When checking whether a registry input id already exists, the check didn't include the ids of input registries with "nested" type (which are unreported containers for cursor-based inputs that can have several sub-inputs inside).

This is usually not a problem because the default (and what most inputs use even when overriding their id, e.g. I think this is why it probably didn't hit the GCP input) is to use a scoped id like "input_id::source_id", so they don't conflict with the container which has bare id "input_id".
This hit winlog in particular because:
- winlog always uses a source id that is the same as its input id
- winlog still used the global input metrics helpers in the `inputmon` package instead of the metrics registry provided by the Filebeat inputs API
- winlog is the only input that did not add a scope prefix on the id provided to `inputmon.NewInputRegistry`, so the globally-created registry conflicted with the input manager's container (and this conflict was missed because of the missed "nested" type check above).

Fixing the missed "nested" collision check would prevent the input panic, but the collision itself would still exist and prevent winlog input metrics from being reported.

This PR both fixes the missed "nested" conflict check and removes the deprecated global metrics call from the winlog input, replacing it with the API-provided registry.

(cherry picked from commit 4081f24)

# Conflicts:
#	winlogbeat/eventlog/metrics.go
#	winlogbeat/eventlog/wineventlog.go
@mergify mergify Bot added backport conflicts There is a conflict in the backported pull request labels Aug 4, 2025
@mergify mergify Bot requested review from a team as code owners August 4, 2025 21:43
@mergify mergify Bot added the backport label Aug 4, 2025
@mergify
Copy link
Copy Markdown
Contributor Author

mergify Bot commented Aug 4, 2025

Cherry-pick of 4081f24 has failed:

On branch mergify/bp/8.19/pr-45730
Your branch is up to date with 'origin/8.19'.

You are currently cherry-picking commit 4081f24d2.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   CHANGELOG.next.asciidoc
	modified:   filebeat/input/winlog/input.go
	modified:   libbeat/monitoring/inputmon/httphandler.go
	modified:   libbeat/monitoring/inputmon/input_test.go
	modified:   winlogbeat/beater/eventlogger.go
	modified:   winlogbeat/eventlog/eventlog.go
	modified:   winlogbeat/eventlog/runner.go
	modified:   winlogbeat/eventlog/wineventlog_test.go
	modified:   x-pack/winlogbeat/module/testing_windows.go

Unmerged paths:
  (use "git add/rm <file>..." as appropriate to mark resolution)
	deleted by us:   winlogbeat/eventlog/metrics.go
	both modified:   winlogbeat/eventlog/wineventlog.go

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

@mergify mergify Bot assigned faec Aug 4, 2025
@mergify mergify Bot added the conflicts There is a conflict in the backported pull request label Aug 4, 2025
@mergify mergify Bot requested review from khushijain21 and leehinman and removed request for a team August 4, 2025 21:43
@mergify mergify Bot mentioned this pull request Aug 4, 2025
6 tasks
@botelastic botelastic Bot added the needs_team Indicates that the issue/PR needs a Team:* label label Aug 4, 2025
@github-actions github-actions Bot added bug Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team labels Aug 4, 2025
@elasticmachine
Copy link
Copy Markdown
Contributor

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

@botelastic botelastic Bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Aug 4, 2025
@ebeahan ebeahan force-pushed the mergify/bp/8.19/pr-45730 branch from dd76ef3 to c8810b5 Compare August 4, 2025 23:31
@ebeahan ebeahan merged commit 2d2cd77 into 8.19 Aug 5, 2025
199 of 203 checks passed
@ebeahan ebeahan deleted the mergify/bp/8.19/pr-45730 branch August 5, 2025 02:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport bug conflicts There is a conflict in the backported pull request Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants