elastic / elastic/beats

[text-auditor] Fix PANW repeatcnt description contamination and one harvester grammar error

Open Beginner friendly
#50,159 1 comment 0 reactions 0 assignees View on GitHub
needs_team
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 15m
Merged PRs (30d)
385

Description

## Text Improvements

The following user-facing text issues were found in the repository. Each is a low-effort fix.

### 1. PANW `repeatcnt` field description includes pasted sentence from another field

**File:** `x-pack/filebeat/module/panw/panos/_meta/fields.yml` (line 190)
**Current text:** `The number of sessions with the same source IP address, destination IP address, application, and subtype that GlobalProtect has detected within the last five seconds.An integer associated with any errors that occurred.`
**Suggested fix:** `The number of sessions with the same source IP address, destination IP address, application, and subtype that GlobalProtect has detected within the last five seconds.`
**Why:** This description has an appended sentence that belongs to `error_code`, making `repeatcnt` text misleading and internally inconsistent.

### 2. Redundant grammar in harvester runtime error text

**File:** `filebeat/input/log/harvester.go` (line 563)
**Current text:** `file info is not identical with opened file. Aborting harvesting and retrying file later again`
**Suggested fix:** `file info is not identical with opened file. Aborting harvesting and retrying file later`
**Why:** `later again` is a clear redundant phrase in a user-visible runtime error.

## Completeness Check

- Searched for `five seconds.An integer associated with any errors that occurred` and verified source-of-truth occurrence in `x-pack/filebeat/module/panw/panos/_meta/fields.yml` (plus generated/rendered copies in docs).
- Searched for `retrying file later again` and verified this runtime error appears once in `filebeat/input/log/harvester.go`.

## Suggested Actions

- [ ] Fix the `repeatcnt` description in `x-pack/filebeat/module/panw/panos/_meta/fields.yml` and regenerate exported field docs.
- [ ] Replace `later again` with `later` in `filebeat/input/log/harvester.go`.

> [!NOTE]
>
> 🔒 Integrity filter blocked 1 item
>
> The following item were blocked because they don't meet the GitHub integrity level.
>
> - [#8175](https://github.com/elastic/beats/issues/8175) `search_issues`: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
>
> To allow these resources, lower `min-integrity` in your GitHub frontmatter:
>
> ```yaml
> tools:
> github:
> min-integrity: approved # merged | approved | unapproved | none
> ```
>
>

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Text Auditor](https://github.com/elastic/beats/actions/runs/24513403888)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on Apr 23, 2026, 1:55 PM UTC

Contributor guide

Open the contributing guide

Research direction

Update the repeatcnt description in x-pack/filebeat/module/panw/panos/_meta/fields.yml and remove “again” from the runtime error in filebeat/input/log/harvester.go. Regenerate the exported field documentation after the metadata change, then verify the two specified phrases no longer occur and the generated docs match the source.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
documentation
Issue type
Documentation
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
82/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.