[bug] Number of filebeat inputs enabled is incorrectly logged
- Dominant language
- Go
- Stars
- 12.7k
- Forks
- 5k
- Avg merge
- 2d 15m
- Merged PRs (30d)
- 385
Description
Steps to reproduce
1. Start agent with
```
agent.grpc:
port: 6794
inputs:
- type: filestream
id: your-input-id
streams:
- id: your-filestream-stream-id
data_stream:
dataset: generic
paths:
- /var/log/*.log
outputs:
default:
type: elasticsearch
hosts: ["XXX"]
preset: "balanced"
username: "elastic"
password: "XXX"
agent.monitoring:
enabled: false
```
Even when filestream input is enabled, the logs show "Enabled Inputs: 0".
```json
{"log.level":"info",
"@timestamp":"2025-05-08T12:21:41.959+0530",
"message":"Loading Inputs: 0",
"component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"filestream-default","type":"filestream"},
"log":{"source":"filestream-default"},
"ecs.version":"1.6.0","log.logger":"crawler","log.origin":{"file.line":72,"file.name":"beater/crawler.go","function":"github.com/elastic/beats/v7/filebeat/beater.(*crawler).Start"},"service.name":"filebeat","ecs.version":"1.6.0"}
{"log.level":"info",
"@timestamp":"2025-05-08T12:21:41.959+0530",
"message":"Loading and starting Inputs completed. Enabled inputs: 0",
"component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"filestream-default","type":"filestream"},"log":{"source":"filestream-default"},
"log.origin":{"file.line":107,"file.name":"beater/crawler.go","function":"github.com/elastic/beats/v7/filebeat/beater.(*crawler).Start"},"service.name":"filebeat","ecs.version":"1.6.0","log.logger":"crawler","ecs.version":"1.6.0"}
```
Reason:
This is because filebeat [crawler](https://github.com/elastic/beats/blob/main/filebeat/beater/crawler.go#L72) (in managed mode) is started with an empty config first.
Contributor guide
Research direction
Start in filebeat/beater/crawler.go at the reported lines 72 and 107, and reproduce the managed-mode configuration from the issue. Trace how the crawler is started with an empty config and how the input count is logged. Done means the logs report the enabled filestream input count correctly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- observability-sre
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100