Silently ignore empty files in filestream

[rdner]

Proposed commit message

Empty files are excluded from processing in filestream as early as possible.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
• I have added an entry in ./changelog/fragments using the changelog tool.

Benchmarks

Environment: darwin/arm64, Apple M4 Pro, 12 threads

cd ./filebeat/input/filestream
go test -bench='^BenchmarkGetFiles$' -benchmem -run=^$ -count=5

Metric	main	this PR	Delta	Significant
Time (ms/op)	1.853	1.851	~0%	No (p=0.548)
Memory (MiB/op)	1.197	1.196	~0%	No (p=0.151)
Allocs/op	9,107	9,107	~0%	No (p=0.159)

So, no impact.

Related issues

• Closes filestream: empty should be silently ignored instead of triggering fingerprint warnings #48891

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between f4c57a4 and 4a548ec.

📒 Files selected for processing (1)

• filebeat/input/filestream/input_integration_test.go

---

📝 Walkthrough

Walkthrough

Detects and silently exclude zero-byte files from filestream processing. Adds a new package error errFileEmpty and reorders getIngestTarget to detect empty regular files and empty symlink targets early, deferring initialization of file info until after these checks. GetFiles suppresses debug logging for errFileEmpty cases. Tests and integration tests were added/adjusted to cover empty regular files, symlinks to empty files, and updated truncation/offset expectations. A changelog fragment changelog/fragments/1772466645-ignore-empty-files.yaml was added.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The PR successfully implements all key requirements from issue #48891: empty files are silently skipped, non-empty small files retain existing warnings, early exclusion prevents unnecessary processing.
Out of Scope Changes check	✅ Passed	All changes directly support the primary objective. Test adjustments (5-byte truncation) reflect the new behavior where zero-byte truncation equals delete/re-create, maintaining scope alignment.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR updates the filestream scanner/watcher logic to treat 0-byte files as a special case: they are excluded from ingestion decisions early and do not contribute to fingerprint “too small” warnings/log noise, aligning behavior with the empty-file expectations described in #48891.

Changes:

• Add an errFileEmpty sentinel and exclude empty regular files (and symlinks to empty targets) during ingest-target resolution.
• Suppress per-scan debug logging for the empty-file case in fileScanner.GetFiles().
• Update/add tests to cover silent exclusion of empty files and symlinks; add changelog fragment.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
filebeat/input/filestream/fswatch.go	Introduces errFileEmpty and skips empty files early; avoids debug logging for empty-file ingest-target failures.
filebeat/input/filestream/fswatch_test.go	Updates watcher test expectation (no debug for empty files) and adds scanner/getIngestTarget tests for empty file exclusion.
filebeat/input/filestream/fswatch_integration_test.go	Minor test cleanup (unused param) and relocates mustFingerprintIdentifier helper.
changelog/fragments/1772466645-ignore-empty-files.yaml	Adds changelog entry for the enhancement.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[rdner]

I still need to fix the TestFilestreamTruncated* tests (or fix the behavior, let's see). Putting back in draft for now.

[rdner]

I still need to fix the TestFilestreamTruncated* tests (or fix the behavior, let's see). Putting back in draft for now.

So, that's because now truncating a file to zero is handled the same way as delete/re-create. Which I cannot see any problem with (am I missing something?).

Truncating to anything but zero is still handled with the special behavior as before. I adjusted the existing tests to reflect that.

[AndersonQ]

So, that's because now truncating a file to zero is handled the same way as delete/re-create. Which I cannot see any problem with (am I missing something?).

I don't think so, the truncated file would get a new fingerprint anyway.

[github-actions]

@Mergifyio backport 8.19 9.2 9.3

[mergify]

backport 8.19 9.2 9.3

✅ Backports have been created

Details

• #49230 [8.19](backport #49196) Silently ignore empty files in filestream has been created for branch 8.19 but encountered conflicts

Cherry-pick of 404fb99 has failed:

On branch mergify/bp/8.19/pr-49196
Your branch is up to date with 'origin/8.19'.

You are currently cherry-picking commit 404fb99fd.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	new file:   changelog/fragments/1772466645-ignore-empty-files.yaml
	modified:   filebeat/input/filestream/fswatch.go
	modified:   filebeat/input/filestream/input_integration_test.go

Unmerged paths:
  (use "git add/rm <file>..." as appropriate to mark resolution)
	deleted by us:   filebeat/input/filestream/fswatch_integration_test.go
	both modified:   filebeat/input/filestream/fswatch_test.go

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

• #49231 [9.2](backport #49196) Silently ignore empty files in filestream has been created for branch 9.2 but encountered conflicts

Cherry-pick of 404fb99 has failed:

On branch mergify/bp/9.2/pr-49196
Your branch is up to date with 'origin/9.2'.

You are currently cherry-picking commit 404fb99fd.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	new file:   changelog/fragments/1772466645-ignore-empty-files.yaml
	modified:   filebeat/input/filestream/fswatch.go
	modified:   filebeat/input/filestream/fswatch_integration_test.go
	modified:   filebeat/input/filestream/input_integration_test.go

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   filebeat/input/filestream/fswatch_test.go

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

• #49232 [9.3](backport #49196) Silently ignore empty files in filestream has been created for branch 9.3 but encountered conflicts

Cherry-pick of 404fb99 has failed:

On branch mergify/bp/9.3/pr-49196
Your branch is up to date with 'origin/9.3'.

You are currently cherry-picking commit 404fb99fd.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	new file:   changelog/fragments/1772466645-ignore-empty-files.yaml
	modified:   filebeat/input/filestream/fswatch.go
	modified:   filebeat/input/filestream/fswatch_integration_test.go
	modified:   filebeat/input/filestream/input_integration_test.go

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   filebeat/input/filestream/fswatch_test.go

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally