Minor improvements to Journalbeat (#8618)

* refactoring of async API

* correct name of field

* tie vendored lib to latest release

* convert string fields to int && drop if needed

* do not expose internal type

* do not block on out channel if beat is stopped

* fix name of registry_file option

* more refactoring

* add missing notice

* port uuid to new lib

* address review notes

* rm factory

* index custom as nested object

NOTICE.txt

@@ -173,7 +173,8 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 --------------------------------------------------------------------
 Dependency: github.com/coreos/go-systemd
-Revision: eee3db372b31153ca0b90702e165948699803fd0
+Version: v17
+Revision: 39ca1b05acc7ad1220e09f133283b8859a8b71ab
 License type (autodetected): Apache-2.0
 ./vendor/github.com/coreos/go-systemd/LICENSE:
 --------------------------------------------------------------------

journalbeat/_meta/beat.yml

@@ -20,8 +20,6 @@ journalbeat.inputs:
 
   # The number of seconds to wait before trying to read again from journals.
   #backoff: 1s
-  # Multiplier of backoff value.
-  #backoff_factor: 2
   # The maximum number of seconds to wait before attempting to read again from journals.
   #max_backoff: 60s
 
@@ -47,8 +45,6 @@ journalbeat.inputs:
 
   # The number of seconds to wait before trying to read again from journals.
   #backoff: 1s
-  # Multiplier of backoff value.
-  #backoff_factor: 2
   # The maximum number of seconds to wait before attempting to read again from journals.
   #max_backoff: 60s
 

journalbeat/_meta/fields.common.yml

@@ -34,7 +34,7 @@
               description: >
                   Audit fields of event.
               fields:
-                - name: loginuid
+                - name: login_uid
                   type: long
                   required: false
                   example: 1000
@@ -314,3 +314,8 @@
       required: true
       description: >
         The logged message.
+    - name: custom
+      type: nested
+      required: false
+      description: >
+        Arbitrary fields coming from processes.

journalbeat/config/config.go

@@ -28,20 +28,18 @@ import (
 
 // Config stores the configuration of Journalbeat
 type Config struct {
-	Inputs        []*common.Config `config:"inputs"`
-	RegistryFile  string           `config:"registry"`
-	Backoff       time.Duration    `config:"backoff" validate:"min=0,nonzero"`
-	BackoffFactor int              `config:"backoff_factor" validate:"min=1"`
-	MaxBackoff    time.Duration    `config:"max_backoff" validate:"min=0,nonzero"`
-	Seek          string           `config:"seek"`
-	Matches       []string         `config:"include_matches"`
+	Inputs       []*common.Config `config:"inputs"`
+	RegistryFile string           `config:"registry_file"`
+	Backoff      time.Duration    `config:"backoff" validate:"min=0,nonzero"`
+	MaxBackoff   time.Duration    `config:"max_backoff" validate:"min=0,nonzero"`
+	Seek         string           `config:"seek"`
+	Matches      []string         `config:"include_matches"`
 }
 
 // DefaultConfig are the defaults of a Journalbeat instance
 var DefaultConfig = Config{
-	RegistryFile:  "registry",
-	Backoff:       1 * time.Second,
-	BackoffFactor: 2,
-	MaxBackoff:    60 * time.Second,
-	Seek:          "tail",
+	RegistryFile: "registry",
+	Backoff:      1 * time.Second,
+	MaxBackoff:   60 * time.Second,
+	Seek:         "tail",
 }