packetbeat: per-stream interface and procs configuration silently dropped under OTel runtime
- Dominant language
- Go
- Stars
- 12.7k
- Forks
- 5k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 364
Description
`packetbeat/beater/packetbeat.go:98-102` selects the config loader on
`b.Manager.Enabled()`. Under the OTel runtime that returns `false`, so
`FromStatic` is used. `FromStatic` reads `interfaces`, `procs`,
`ignore_outgoing` and related keys from the **top level** of the beat config.
`NewAgentConfig` (the process-runtime loader) hoists those keys out of each
stream entry. Under OTel, elastic-agent's `getInputsForUnit` nests streams
under `packetbeat.protocols`; there is no top-level `interfaces` or `procs`
key. `FromStatic` therefore finds nothing and falls back to
`[]InterfaceConfig{{Device: defaultDevice()}}` — `"any"` on Linux, which
works and masks the loss.
The following per-stream keys from the `network_traffic` stream templates are
silently dropped under OTel:
- `interface.device`, `interface.file`, `interface.type`, `interface.with_vlans`
- `interface.bpf_filter`, `interface.snaplen`, `interface.buffer_size_mb`
- `interface.internal_networks`
- `procs.enabled`
- `ignore_outgoing`
In addition, because `packet` lacks `single_receiver: true` in the Agent spec,
16 `network_traffic` datasets each start their own receiver with their own
capture handle on the same device. The interface deduplication, per-protocol
`procs` merge and combined BPF filter that `NewAgentConfig` + `setupSniffer`
provide are all bypassed. The `maxSniffers` cap
(`packetbeat/beater/reloader.go:40`) is also unreachable, as it lives in the
reload path which the OTel runtime does not use.
The fix for the dropped keys is the same as for #52931: the loader selected
under OTel must handle agent-shaped stream entries. `npcap.never_install` is
tracked separately in #53009.
Contributor guide
Assessment
This issue has not been assessed yet.