elastic / elastic/beats

[bug] Number of filebeat inputs enabled is incorrectly logged

Open
#44,287 2 comments 0 reactions 0 assignees View on GitHub
bug Stalled Team:Elastic-Agent-Data-Plane
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 15m
Merged PRs (30d)
385

Description

Steps to reproduce

1. Start agent with
```
agent.grpc:
port: 6794
inputs:
- type: filestream
id: your-input-id
streams:
- id: your-filestream-stream-id
data_stream:
dataset: generic
paths:
- /var/log/*.log
outputs:
default:
type: elasticsearch
hosts: ["XXX"]
preset: "balanced"
username: "elastic"
password: "XXX"
agent.monitoring:
enabled: false
```

Even when filestream input is enabled, the logs show "Enabled Inputs: 0".

```json
{"log.level":"info",
"@timestamp":"2025-05-08T12:21:41.959+0530",
"message":"Loading Inputs: 0",
"component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"filestream-default","type":"filestream"},
"log":{"source":"filestream-default"},
"ecs.version":"1.6.0","log.logger":"crawler","log.origin":{"file.line":72,"file.name":"beater/crawler.go","function":"github.com/elastic/beats/v7/filebeat/beater.(*crawler).Start"},"service.name":"filebeat","ecs.version":"1.6.0"}

{"log.level":"info",
"@timestamp":"2025-05-08T12:21:41.959+0530",
"message":"Loading and starting Inputs completed. Enabled inputs: 0",
"component":{"binary":"filebeat","dataset":"elastic_agent.filebeat","id":"filestream-default","type":"filestream"},"log":{"source":"filestream-default"},
"log.origin":{"file.line":107,"file.name":"beater/crawler.go","function":"github.com/elastic/beats/v7/filebeat/beater.(*crawler).Start"},"service.name":"filebeat","ecs.version":"1.6.0","log.logger":"crawler","ecs.version":"1.6.0"}
```

Reason:

This is because filebeat [crawler](https://github.com/elastic/beats/blob/main/filebeat/beater/crawler.go#L72) (in managed mode) is started with an empty config first.

Contributor guide

Open the contributing guide

Research direction

Start in filebeat/beater/crawler.go at the reported lines 72 and 107, and reproduce the managed-mode configuration from the issue. Trace how the crawler is started with an empty config and how the input count is logged. Done means the logs report the enabled filestream input count correctly.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
observability-sre
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.