[Flaky Test] filebeat.tests.system.test_modules.Test test_fileset_file_052_auditd

## Flaky Test

* **Test Name:** test_fileset_file_052_auditd
* **Scope:** filebeat.tests.system.test_modules.Test
* **File:** ../../../../.asdf/installs/python/3.9.13/lib/python3.9/unittest/case.py
* **Location:** ../../../../.asdf/installs/python/3.9.13/lib/python3.9/unittest/case.py:116
* **Buildkite Link:** https://buildkite.com/organizations/elastic/analytics/suites/beats/tests/4ad58752-c5e9-8149-8d10-068670e04162
* **Flaky Instances:** 1
* **Latest Occurrence:** 2026-07-22T04:17:21.779Z

### Details

```json
{
"id": "4ad58752-c5e9-8149-8d10-068670e04162",
"web_url": "https://buildkite.com/organizations/elastic/analytics/suites/beats/tests/4ad58752-c5e9-8149-8d10-068670e04162",
"scope": "filebeat.tests.system.test_modules.Test",
"name": "test_fileset_file_052_auditd",
"location": "../../../../.asdf/installs/python/3.9.13/lib/python3.9/unittest/case.py:116",
"file_name": "../../../../.asdf/installs/python/3.9.13/lib/python3.9/unittest/case.py",
"instances": 1,
"latest_occurrence_at": "2026-07-22T04:17:21.779Z",
"most_recent_instance_at": "2026-07-22T04:17:21.779Z",
"last_resolved_at": null,
"ownership_team_ids": [],
"failure_examples_count": 1
}
```

### Failure Examples

**Example 1:**
**Run:** https://api.buildkite.com/v2/analytics/organizations/elastic/suites/beats/runs/d8068140-0858-860c-9c8b-4eef22a552cf
**Time:** 2026-07-22T04:07:36.939Z
**Stacktrace:**

```
a = (,)

@wraps(func)
def standalone_func(*a):
> return func(*(a + p.args), **p.kwargs)

../build/ve/linux/lib/python3.9/site-packages/parameterized/parameterized.py:518:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
tests/system/test_modules.py:177: in test_fileset_file
self.run_on_file(
tests/system/test_modules.py:296: in run_on_file
self.wait_until(lambda: self.es.indices.exists(index=self.index_name),
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

self = , cond = . at 0x75e69cef28b0>, max_timeout = 20
poll_interval = 0.1
name = 'indices present for /opt/buildkite-agent/builds/bk-agent-prod-gcp-1784693080895481667/elastic/filebeat/filebeat/module/auditd/log/test/execve.log'
err_msg = ''

def wait_until(self, cond, max_timeout=20, poll_interval=0.1, name="cond", err_msg=""):
"""
TODO: this can probably be a "wait_until_output_count", among other things, since that could actually use `self`, and this can become an internal function
Waits until the cond function returns true,
or until the max_timeout is reached. Calls the cond
function every poll_interval seconds.

If the max_timeout is reached before cond() returns
true, an exception is raised.
"""
start = datetime.now()
while not cond():
if datetime.now() - start > timedelta(seconds=max_timeout):
print("Test has failed, here are the Beat logs")
if self.output_lines() == 0:
print("\n\nBeat had no output file")
else:
print("\n\nHere is the beat's output file:")
for entry in self.read_output():
print(entry)
> raise WaitTimeoutError(
f"Timeout waiting for condition '{name}'. Waited {max_timeout} seconds: {err_msg}")
E beat.beat.WaitTimeoutError: Timeout waiting for condition 'indices present for /opt/buildkite-agent/builds/bk-agent-prod-gcp-1784693080895481667/elastic/filebeat/filebeat/module/auditd/log/test/execve.log'. Waited 20 seconds:

../libbeat/tests/system/beat/beat.py:453: WaitTimeoutError
```

Start with tests/system/test_modules.py, especially test_fileset_file and run_on_file, then inspect the auditd fixture at module/auditd/log/test/execve.log. Run test_fileset_file_052_auditd and review the Beat output and linked Buildkite failure. Done means the test reliably observes the expected Elasticsearch index without timing out.

Written by the indexing model from the issue text.