Merge branch '8.17' into mergify/bp/8.17/pr-6329

elastic · Dec 19, 2024 · 5b4d7a5 · 5b4d7a5
2 parents 96cc37b + 0f87c8c
commit 5b4d7a5
Show file tree

Hide file tree

Showing 47 changed files with 3,156 additions and 1,118 deletions.
diff --git a/NOTICE.txt b/NOTICE.txt
diff --git a/changelog/fragments/1734525166-update-otel-v0.116.0.yaml b/changelog/fragments/1734525166-update-otel-v0.116.0.yaml
@@ -0,0 +1,32 @@
+# Kind can be one of:
+# - breaking-change: a change to previously-documented behavior
+# - deprecation: functionality that is being removed in a later release
+# - bug-fix: fixes a problem in a previous version
+# - enhancement: extends functionality but does not break or fix existing behavior
+# - feature: new functionality
+# - known-issue: problems that we are aware of in a given version
+# - security: impacts on the security of a product or a user’s deployment.
+# - upgrade: important information for someone upgrading from a prior version
+# - other: does not fit into any of the other categories
+kind: enhancement
+
+# Change summary; a 80ish characters long description of the change.
+summary: Update OTel components to v0.116.0
+
+# Long description; in case the summary is not enough to describe the change
+# this field accommodate a description without length limits.
+# NOTE: This field will be rendered only for breaking-change and known-issue kinds at the moment.
+#description:
+
+# Affected component; usually one of "elastic-agent", "fleet-server", "filebeat", "metricbeat", "auditbeat", "all", etc.
+component: elastic-agent
+
+# PR URL; optional; the PR number that added the changeset.
+# If not present is automatically filled by the tooling finding the PR where this changelog fragment has been added.
+# NOTE: the tooling supports backports, so it's able to fill the original PR number instead of the backport PR number.
+# Please provide it if you are adding a fragment for a different PR.
+#pr: https://github.com/owner/repo/1234
+
+# Issue URL; optional; the GitHub issue related to this changeset (either closes or is part of).
+# If not present is automatically filled by the tooling with the issue linked to the PR number.
+#issue: https://github.com/owner/repo/1234
diff --git a/deploy/kubernetes/elastic-agent-standalone/templates.d/activemq.yml b/deploy/kubernetes/elastic-agent-standalone/templates.d/activemq.yml
@@ -10,6 +10,8 @@ inputs:
             type: logs
           exclude_files:
             - .gz$
+          file_identity:
+            fingerprint: null
           parsers:
             - container:
                 format: auto
@@ -18,6 +20,8 @@ inputs:
             - /var/log/containers/*${kubernetes.hints.container_id}.log
           prospector:
             scanner:
+                fingerprint:
+                    enabled: true
                 symlinks: true
           tags:
             - forwarded
@@ -28,6 +32,8 @@ inputs:
             type: logs
           exclude_files:
             - .gz$
+          file_identity:
+            fingerprint: null
           multiline:
             match: after
             negate: true
@@ -40,6 +46,8 @@ inputs:
             - /var/log/containers/*${kubernetes.hints.container_id}.log
           prospector:
             scanner:
+                fingerprint:
+                    enabled: true
                 symlinks: true
           tags:
             - forwarded
@@ -62,7 +70,6 @@ inputs:
           path: /api/jolokia/?ignoreErrors=true&amp;canonicalNaming=false
           period: ${kubernetes.hints.activemq.broker.period|kubernetes.hints.activemq.period|'10s'}
           tags:
-            - forwarded
             - activemq-broker
           username: ${kubernetes.hints.activemq.broker.username|kubernetes.hints.activemq.username|'admin'}
         - condition: ${kubernetes.hints.activemq.queue.enabled} == true or ${kubernetes.hints.activemq.enabled} == true
@@ -77,7 +84,6 @@ inputs:
           path: /api/jolokia/?ignoreErrors=true&amp;canonicalNaming=false
           period: ${kubernetes.hints.activemq.queue.period|kubernetes.hints.activemq.period|'10s'}
           tags:
-            - forwarded
             - activemq-queue
           username: ${kubernetes.hints.activemq.queue.username|kubernetes.hints.activemq.username|'admin'}
         - condition: ${kubernetes.hints.activemq.topic.enabled} == true or ${kubernetes.hints.activemq.enabled} == true
@@ -92,7 +98,6 @@ inputs:
           path: /api/jolokia/?ignoreErrors=true&amp;canonicalNaming=false
           period: ${kubernetes.hints.activemq.topic.period|kubernetes.hints.activemq.period|'10s'}
           tags:
-            - forwarded
             - activemq-topic
           username: ${kubernetes.hints.activemq.topic.username|kubernetes.hints.activemq.username|'admin'}
       data_stream.namespace: default
diff --git a/deploy/kubernetes/elastic-agent-standalone/templates.d/apache.yml b/deploy/kubernetes/elastic-agent-standalone/templates.d/apache.yml
@@ -1,46 +1,4 @@
 inputs:
-    - name: filestream-apache
-      id: filestream-apache-${kubernetes.hints.container_id}
-      type: filestream
-      use_output: default
-      streams:
-        - condition: ${kubernetes.hints.apache.access.enabled} == true or ${kubernetes.hints.apache.enabled} == true
-          data_stream:
-            dataset: apache.access
-            type: logs
-          exclude_files:
-            - .gz$
-          parsers:
-            - container:
-                format: auto
-                stream: ${kubernetes.hints.apache.access.stream|'all'}
-          paths:
-            - /var/log/containers/*${kubernetes.hints.container_id}.log
-          prospector:
-            scanner:
-                symlinks: true
-          tags:
-            - apache-access
-        - condition: ${kubernetes.hints.apache.error.enabled} == true or ${kubernetes.hints.apache.enabled} == true
-          data_stream:
-            dataset: apache.error
-            type: logs
-          exclude_files:
-            - .gz$
-          parsers:
-            - container:
-                format: auto
-                stream: ${kubernetes.hints.apache.error.stream|'all'}
-          paths:
-            - /var/log/containers/*${kubernetes.hints.container_id}.log
-          processors:
-            - add_locale: null
-          prospector:
-            scanner:
-                symlinks: true
-          tags:
-            - apache-error
-      data_stream.namespace: default
     - name: httpjson-apache
       id: httpjson-apache-${kubernetes.hints.container_id}
       type: httpjson
@@ -139,3 +97,53 @@ inputs:
           period: ${kubernetes.hints.apache.status.period|kubernetes.hints.apache.period|'30s'}
           server_status_path: /server-status
       data_stream.namespace: default
+    - name: filestream-apache
+      id: filestream-apache-${kubernetes.hints.container_id}
+      type: filestream
+      use_output: default
+      streams:
+        - condition: ${kubernetes.hints.apache.access.enabled} == true or ${kubernetes.hints.apache.enabled} == true
+          data_stream:
+            dataset: apache.access
+            type: logs
+          exclude_files:
+            - .gz$
+          file_identity:
+            fingerprint: null
+          parsers:
+            - container:
+                format: auto
+                stream: ${kubernetes.hints.apache.access.stream|'all'}
+          paths:
+            - /var/log/containers/*${kubernetes.hints.container_id}.log
+          prospector:
+            scanner:
+                fingerprint:
+                    enabled: true
+                symlinks: true
+          tags:
+            - apache-access
+        - condition: ${kubernetes.hints.apache.error.enabled} == true or ${kubernetes.hints.apache.enabled} == true
+          data_stream:
+            dataset: apache.error
+            type: logs
+          exclude_files:
+            - .gz$
+          file_identity:
+            fingerprint: null
+          parsers:
+            - container:
+                format: auto
+                stream: ${kubernetes.hints.apache.error.stream|'all'}
+          paths:
+            - /var/log/containers/*${kubernetes.hints.container_id}.log
+          processors:
+            - add_locale: null
+          prospector:
+            scanner:
+                fingerprint:
+                    enabled: true
+                symlinks: true
+          tags:
+            - apache-error
+      data_stream.namespace: default
diff --git a/deploy/kubernetes/elastic-agent-standalone/templates.d/cassandra.yml b/deploy/kubernetes/elastic-agent-standalone/templates.d/cassandra.yml
@@ -10,6 +10,8 @@ inputs:
             type: logs
           exclude_files:
             - .gz$
+          file_identity:
+            fingerprint: null
           multiline:
             match: after
             negate: true
@@ -22,6 +24,8 @@ inputs:
             - /var/log/containers/*${kubernetes.hints.container_id}.log
           prospector:
             scanner:
+                fingerprint:
+                    enabled: true
                 symlinks: true
           tags:
             - forwarded

diff --git a/deploy/kubernetes/elastic-agent-standalone/templates.d/cef.yml b/deploy/kubernetes/elastic-agent-standalone/templates.d/cef.yml
@@ -1,25 +1,4 @@
 inputs:
-    - name: udp-cef
-      id: udp-cef-${kubernetes.hints.container_id}
-      type: udp
-      use_output: default
-      streams:
-        - condition: ${kubernetes.hints.cef.log.enabled} == true or ${kubernetes.hints.cef.enabled} == true
-          data_stream:
-            dataset: cef.log
-            type: logs
-          host: localhost:9003
-          processors:
-            - rename:
-                fields:
-                    - from: message
-                      to: event.original
-            - decode_cef:
-                field: event.original
-          tags:
-            - cef
-            - forwarded
-      data_stream.namespace: default
     - name: tcp-cef
       id: tcp-cef-${kubernetes.hints.container_id}
       type: tcp
@@ -52,6 +31,8 @@ inputs:
             type: logs
           exclude_files:
             - .gz$
+          file_identity:
+            fingerprint: null
           parsers:
             - container:
                 format: auto
@@ -67,8 +48,31 @@ inputs:
                 field: event.original
           prospector:
             scanner:
+                fingerprint:
+                    enabled: true
                 symlinks: true
           tags:
             - cef
             - forwarded
       data_stream.namespace: default
+    - name: udp-cef
+      id: udp-cef-${kubernetes.hints.container_id}
+      type: udp
+      use_output: default
+      streams:
+        - condition: ${kubernetes.hints.cef.log.enabled} == true or ${kubernetes.hints.cef.enabled} == true
+          data_stream:
+            dataset: cef.log
+            type: logs
+          host: localhost:9003
+          processors:
+            - rename:
+                fields:
+                    - from: message
+                      to: event.original
+            - decode_cef:
+                field: event.original
+          tags:
+            - cef
+            - forwarded
+      data_stream.namespace: default
diff --git a/deploy/kubernetes/elastic-agent-standalone/templates.d/checkpoint.yml b/deploy/kubernetes/elastic-agent-standalone/templates.d/checkpoint.yml
@@ -10,6 +10,8 @@ inputs:
             type: logs
           exclude_files:
             - .gz$
+          file_identity:
+            fingerprint: null
           parsers:
             - container:
                 format: auto
@@ -30,6 +32,8 @@ inputs:
                 target: _temp_
           prospector:
             scanner:
+                fingerprint:
+                    enabled: true
                 symlinks: true
           tags:
             - forwarded

diff --git a/deploy/kubernetes/elastic-agent-standalone/templates.d/crowdstrike.yml b/deploy/kubernetes/elastic-agent-standalone/templates.d/crowdstrike.yml
@@ -10,6 +10,8 @@ inputs:
             type: logs
           exclude_files:
             - .gz$
+          file_identity:
+            fingerprint: null
           multiline.match: after
           multiline.max_lines: 5000
           multiline.negate: true
@@ -23,6 +25,8 @@ inputs:
             - /var/log/containers/*${kubernetes.hints.container_id}.log
           prospector:
             scanner:
+                fingerprint:
+                    enabled: true
                 symlinks: true
           tags:
             - forwarded
@@ -33,6 +37,8 @@ inputs:
             type: logs
           exclude_files:
             - .gz$
+          file_identity:
+            fingerprint: null
           parsers:
             - container:
                 format: auto
@@ -43,6 +49,8 @@ inputs:
             - add_locale: null
           prospector:
             scanner:
+                fingerprint:
+                    enabled: true
                 symlinks: true
           tags:
             - forwarded

diff --git a/deploy/kubernetes/elastic-agent-standalone/templates.d/cyberarkpas.yml b/deploy/kubernetes/elastic-agent-standalone/templates.d/cyberarkpas.yml
@@ -44,6 +44,8 @@ inputs:
             type: logs
           exclude_files:
             - .gz$
+          file_identity:
+            fingerprint: null
           parsers:
             - container:
                 format: auto
@@ -54,6 +56,8 @@ inputs:
             - add_locale: null
           prospector:
             scanner:
+                fingerprint:
+                    enabled: true
                 symlinks: true
           tags:
             - forwarded