Merge branch 'wg-panic-fix' of github.com:faec/beats into wg-panic-fix

CHANGELOG.asciidoc

@@ -3,6 +3,28 @@
 :issue: https:/elastic/beats/issues/
 :pull: https:/elastic/beats/pull/
 
+[[release-notes-8.12.2]]
+=== Beats version 8.12.2
+https:/elastic/beats/compare/v8.12.1\...v8.12.2[View commits]
+
+==== Bugfixes
+
+*Filebeat*
+
+- [threatintel] MISP pagination fixes. {pull}37898[37898]
+- Fix file handle leak when handling errors in filestream. {pull}37973[37973]
+
+*Packetbeat*
+
+- Fix interface device parsing for packetbeat protocols. {pull}37946[37946]
+
+==== Added
+
+*Metricbeat*
+
+- Update `getOpTimestamp` in `replstatus` to fix sort and temp files generation issue in MongoDB. {pull}37688[37688]
+
+
 [[release-notes-8.12.1]]
 === Beats version 8.12.1
 https:/elastic/beats/compare/v8.12.0\...v8.12.1[View commits]

CHANGELOG.next.asciidoc

@@ -27,6 +27,7 @@ fields added to events containing the Beats version. {pull}37553[37553]
 *Filebeat*
 
 - Convert netflow input to API v2 and disable event normalisation {pull}37901[37901]
+- Introduce input/netmetrics and refactor netflow input metrics {pull}38055[38055]
 
 
 *Heartbeat*
@@ -96,6 +97,7 @@ fields added to events containing the Beats version. {pull}37553[37553]
 - [threatintel] MISP pagination fixes {pull}37898[37898]
 - Fix file handle leak when handling errors in filestream {pull}37973[37973]
 - Fix a race condition that could crash Filebeat with a "negative WaitGroup counter" error {pull}38094[38094]
+- Prevent HTTPJSON holding response bodies between executions. {issue}35219[35219] {pull}38116[38116]
 
 *Heartbeat*
 
@@ -108,7 +110,6 @@ fields added to events containing the Beats version. {pull}37553[37553]
 
 *Packetbeat*
 
-- Fix interface device parsing for packetbeat protocols. {pull}37946[37946]
 
 *Winlogbeat*
 
@@ -134,6 +135,7 @@ Setting environmental variable ELASTIC_NETINFO:false in Elastic Agent pod will d
 - Upgrade to elastic-agent-libs v0.7.3 and golang.org/x/crypto v0.17.0. {pull}37544[37544]
 - Make more selective the Pod autodiscovery upon node and namespace update events. {issue}37338[37338] {pull}37431[37431]
 - Upgrade go-sysinfo from 1.12.0 to 1.13.1. {pull}37996[37996]
+- Make `range` condition work with numeric values as strings. {pull}38080[38080]
 
 *Auditbeat*
 
@@ -219,7 +221,6 @@ Setting environmental variable ELASTIC_NETINFO:false in Elastic Agent pod will d
 
 *Metricbeat*
 
-- Update `getOpTimestamp` in `replstatus` to fix sort and temp files generation issue in mongodb. {pull}37688[37688]
 
 *Osquerybeat*
 
@@ -319,6 +320,9 @@ Setting environmental variable ELASTIC_NETINFO:false in Elastic Agent pod will d
 
 
 
+
+
+
 
 
 

catalog-info.yaml

@@ -637,7 +637,7 @@ spec:
  spec:
  # branch_configuration: "7.17" #TODO: uncomment after tests
  pipeline_file: ".buildkite/x-pack/pipeline.xpack.metricbeat.yml"
- maximum_timeout_in_minutes: 120
+ maximum_timeout_in_minutes: 240
  provider_settings:
  trigger_mode: none # don't trigger jobs from github activity
  build_pull_request_forks: false

filebeat/input/internal/procnet/procnet.go → filebeat/input/netmetrics/netmetrics.go

@@ -15,24 +15,27 @@
 // specific language governing permissions and limitations
 // under the License.
 
-// Package procnet provides support for obtaining and formatting /proc/net
-// network addresses for linux systems.
-package procnet
+// Package netmetrics provides different metricsets for capturing network-related metrics,
+// such as UDP and TCP metrics through NewUDP and NewTCP, respectively.
+package netmetrics
 
 import (
+ "bytes"
+ "encoding/hex"
  "fmt"
  "net"
  "strconv"
+ "strings"
 
  "github.com/elastic/elastic-agent-libs/logp"
 )
 
-// Addrs returns the linux /proc/net/tcp or /proc/net/udp addresses for the
+// addrs returns the linux /proc/net/tcp or /proc/net/udp addresses for the
 // provided host address, addr. addr is a host:port address and host may be
 // an IPv4 or IPv6 address, or an FQDN for the host. The returned slices
 // contain the string representations of the address as they would appear in
 // the /proc/net tables.
-func Addrs(addr string, log *logp.Logger) (addr4, addr6 []string, err error) {
+func addrs(addr string, log *logp.Logger) (addr4, addr6 []string, err error) {
  host, port, err := net.SplitHostPort(addr)
  if err != nil {
  return nil, nil, fmt.Errorf("failed to get address for %s: could not split host and port: %w", addr, err)
@@ -54,23 +57,23 @@ func Addrs(addr string, log *logp.Logger) (addr4, addr6 []string, err error) {
  // the len constants all addresses may appear to be IPv6.
  switch {
  case len(p.To4()) == net.IPv4len:
- addr4 = append(addr4, IPv4(p, int(pn)))
+ addr4 = append(addr4, ipV4(p, int(pn)))
  case len(p.To16()) == net.IPv6len:
- addr6 = append(addr6, IPv6(p, int(pn)))
+ addr6 = append(addr6, ipV6(p, int(pn)))
  default:
  log.Warnf("unexpected addr length %d for %s", len(p), p)
  }
  }
  return addr4, addr6, nil
 }
 
-// IPv4 returns the string representation of an IPv4 address in a /proc/net table.
-func IPv4(ip net.IP, port int) string {
+// ipV4 returns the string representation of an IPv4 address in a /proc/net table.
+func ipV4(ip net.IP, port int) string {
  return fmt.Sprintf("%08X:%04X", reverse(ip.To4()), port)
 }
 
-// IPv6 returns the string representation of an IPv6 address in a /proc/net table.
-func IPv6(ip net.IP, port int) string {
+// ipV6 returns the string representation of an IPv6 address in a /proc/net table.
+func ipV6(ip net.IP, port int) string {
  return fmt.Sprintf("%032X:%04X", reverse(ip.To16()), port)
 }
 
@@ -81,3 +84,37 @@ func reverse(b []byte) []byte {
  }
  return c
 }
+
+func contains(b []byte, addr []string, addrIsUnspecified []bool) bool {
+ for i, a := range addr {
+ if addrIsUnspecified[i] {
+ _, ap, pok := strings.Cut(a, ":")
+ _, bp, bok := bytes.Cut(b, []byte(":"))
+ if pok && bok && strings.EqualFold(string(bp), ap) {
+ return true
+ }
+ } else if strings.EqualFold(string(b), a) {
+ return true
+ }
+ }
+ return false
+}
+
+func containsUnspecifiedAddr(addr []string) (yes bool, which []bool, bad []string) {
+ which = make([]bool, len(addr))
+ for i, a := range addr {
+ prefix, _, ok := strings.Cut(a, ":")
+ if !ok {
+ continue
+ }
+ ip, err := hex.DecodeString(prefix)
+ if err != nil {
+ bad = append(bad, a)
+ }
+ if net.IP(ip).IsUnspecified() {
+ yes = true
+ which[i] = true
+ }
+ }
+ return yes, which, bad
+}

filebeat/input/internal/procnet/procnet_test.go → filebeat/input/netmetrics/netmetrics_test.go

@@ -15,7 +15,7 @@
 // specific language governing permissions and limitations
 // under the License.
 
-package procnet
+package netmetrics
 
 import (
  "testing"
@@ -25,7 +25,7 @@ import (
 
 func TestAddrs(t *testing.T) {
  t.Run("ipv4", func(t *testing.T) {
- addr4, addr6, err := Addrs("0.0.0.0:9001", logp.L())
+ addr4, addr6, err := addrs("0.0.0.0:9001", logp.L())
  if err != nil {
  t.Errorf("unexpected error: %v", err)
  }
@@ -38,7 +38,7 @@ func TestAddrs(t *testing.T) {
  })
 
  t.Run("ipv6", func(t *testing.T) {
- addr4, addr6, err := Addrs("[::]:9001", logp.L())
+ addr4, addr6, err := addrs("[::]:9001", logp.L())
  if err != nil {
  t.Errorf("unexpected error: %v", err)
  }