[Flaky Test] filebeat.tests.system.test_registrar.Test test_rotating_file

## Flaky Test

* **Test Name:** test_rotating_file
* **Scope:** filebeat.tests.system.test_registrar.Test
* **File:** filebeat/tests/system/test_registrar.py
* **Location:** filebeat/tests/system/test_registrar.py:279
* **Buildkite Link:** https://buildkite.com/organizations/elastic/analytics/suites/beats/tests/27a1995b-5f24-8948-a4ee-5ded6269370d
* **Flaky Instances:** 2
* **Latest Occurrence:** 2026-04-27T03:13:42.766Z

### Details

```json
{
"id": "27a1995b-5f24-8948-a4ee-5ded6269370d",
"web_url": "https://buildkite.com/organizations/elastic/analytics/suites/beats/tests/27a1995b-5f24-8948-a4ee-5ded6269370d",
"scope": "filebeat.tests.system.test_registrar.Test",
"name": "test_rotating_file",
"location": "filebeat/tests/system/test_registrar.py:279",
"file_name": "filebeat/tests/system/test_registrar.py",
"instances": 2,
"latest_occurrence_at": "2026-04-27T03:13:42.766Z",
"most_recent_instance_at": "2026-04-27T03:13:42.766Z",
"last_resolved_at": null,
"ownership_team_ids": [],
"failure_examples_count": 1
}
```

### Failure Examples

**Example 1:**
**Run:** https://api.buildkite.com/v2/analytics/organizations/elastic/suites/beats/runs/84bda4f5-4830-8d6a-8d83-1eb3b84c6a4d
**Time:** 2026-04-27T03:01:50.813Z
**Stacktrace:**

```
self =

@unittest.skipIf(platform.system() == 'Darwin' or os.name == 'nt',
'Flaky test: https://github.com/elastic/beats/issues/26378')
def test_rotating_file(self):
"""
Checks that the registry is properly updated after a file is rotated
"""
self.render_config_template(
path=os.path.abspath(self.working_dir) + "/log/*",
close_inactive="1s"
)

os.mkdir(self.working_dir + "/log/")
testfile_path = self.working_dir + "/log/test.log"

filebeat = self.start_beat()

with open(testfile_path, 'w') as testfile:
testfile.write("offset 9\n")

self.wait_until(lambda: self.output_has(lines=1),
max_timeout=10)

testfilerenamed = self.working_dir + "/log/test.1.log"
os.rename(testfile_path, testfilerenamed)

with open(testfile_path, 'w') as testfile:
testfile.write("offset 10\n")

self.wait_until(lambda: self.output_has(lines=2),
max_timeout=10)

# Wait until rotation is detected
> self.wait_until(
lambda: self.log_contains(
"Updating state for renamed file"),
max_timeout=10)

tests/system/test_registrar.py:312:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

self = , cond = . at 0x712f191f3c10>, max_timeout = 10
poll_interval = 0.1, name = 'cond', err_msg = ''

def wait_until(self, cond, max_timeout=20, poll_interval=0.1, name="cond", err_msg=""):
"""
TODO: this can probably be a "wait_until_output_count", among other things, since that could actually use `self`, and this can become an internal function
Waits until the cond function returns true,
or until the max_timeout is reached. Calls the cond
function every poll_interval seconds.

If the max_timeout is reached before cond() returns
true, an exception is raised.
"""
start = datetime.now()
while not cond():
if datetime.now() - start > timedelta(seconds=max_timeout):
print("Test has failed, here are the Beat logs")
if self.output_lines() == 0:
print("\n\nBeat had no output file")
else:
print("\n\nHere is the beat's output file:")
for entry in self.read_output():
print(entry)
> raise WaitTimeoutError(
f"Timeout waiting for condition '{name}'. Waited {max_timeout} seconds: {err_msg}")
E beat.beat.WaitTimeoutError: Timeout waiting for condition 'cond'. Waited 10 seconds:

../libbeat/tests/system/beat/beat.py:453: WaitTimeoutError
```

Start with filebeat/tests/system/test_registrar.py at test_rotating_file, around line 279, and review the wait for “Updating state for renamed file.” Run this test and compare failures with the linked Buildkite example. Done means the rotation test reliably detects the renamed file without timing out.

Written by the indexing model from the issue text.