New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Filebeat][testing] Module tests don't check if indexing the event fails #23947

Closed

andrewkroh opened this issue Feb 9, 2021 · 3 comments

Labels

bug Filebeat Stalled

Member

andrewkroh commented Feb 9, 2021 •

edited

Loading

The tests for Filebeat modules index events then check the result against a golden file. But the test itself won't fail if an event that it sends in a _bulk request fails to index. The tests should be checking for Cannot index event errors at

beats/filebeat/tests/system/test_modules.py

Line 153 in cc8f870

errors = ["Error loading pipeline for fileset"]

I did a check and found several modules that have index errors with their test logs. Attaching the failures below in a comment:

The text was updated successfully, but these errors were encountered:

andrewkroh added bug Filebeat labels

botelastic bot added the needs_team label

Member Author

andrewkroh commented Feb 9, 2021

💔 Tests Failed

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

Build Cause: Pull request #23944 opened
Start Time: 2021-02-09T17:37:38.503+0000
Duration: 53 min 47 sec
Commit: e8dbd9ccb4f67215236cb4b9b264624f210f914a

Test stats 🧪

Test	Results
Failed	8
Passed	12992
Skipped	2033
Total	15033

Trends 🧪

Test errors

Expand to view the tests failures

`Build&Test / filebeat-windows-8-windows-8 / test_syslog_with_udp – filebeat.tests.system.test_syslog.Test`

Expand to view the error details

 AssertionError: assert "'su root' fa.../dev/pts/8 33" == "'su root' fa... /dev/pts/8 0"   Skipping 33 identical leading characters in diff, use -v to show   - dev/pts/8 0   ?           ^   + dev/pts/8 33   ?           ^^

Expand to view the stacktrace

 self = <test_syslog.Test testMethod=test_syslog_with_udp>

        def test_syslog_with_udp(self):
            """
            Test syslog input with events from TCP.
            """
            host = "127.0.0.1"
            port = 8080
            input_raw = """
    - type: syslog
      protocol:
        udp:
            host: "{}:{}"
    """
    
            input_raw = input_raw.format(host, port)
            self.render_config_template(
                input_raw=input_raw,
                inputs=False,
            )
    
            filebeat = self.start_beat()
    
            self.wait_until(lambda: self.log_contains("Started listening for UDP connection"))
    
            sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)  # TCP
    
            for n in range(0, 50):
                m = "<13>Oct 11 22:14:15 wopr.mymachine.co postfix/smtpd[2000]:" \
                    " 'su root' failed for lonvick on /dev/pts/8 {}\n"
                m = m.format(n)
                sock.sendto(m.encode("utf-8"), (host, port))
    
            self.wait_until(lambda: self.output_count(lambda x: x >= 1))
            filebeat.check_kill_and_wait()
            sock.close()
    
            output = self.read_output()
>           self.assert_syslog(output[0])

tests\system\test_syslog.py:131: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

self = <test_syslog.Test testMethod=test_syslog_with_udp>
syslog = {'@metadata.beat': 'filebeat', '@metadata.truncated': False, '@metadata.type': '_doc', '@metadata.version': '8.0.0', ...}
has_address = True

    def assert_syslog(self, syslog, has_address=True):
        assert syslog["event.severity"] == 5
        assert syslog["hostname"] == "wopr.mymachine.co"
        assert syslog["input.type"] == "syslog"
>       assert syslog["message"] == "'su root' failed for lonvick on /dev/pts/8 0"
E       AssertionError: assert "'su root' fa.../dev/pts/8 33" == "'su root' fa... /dev/pts/8 0"
E         Skipping 33 identical leading characters in diff, use -v to show
E         - dev/pts/8 0
E         ?           ^
E         + dev/pts/8 33
E         ?           ^^

tests\system\test_syslog.py:257: AssertionError

`Build&Test / filebeat-build / test_fileset_file_023_kibana – filebeat.tests.system.test_modules.Test`

Expand to view the error details

 AssertionError: Error found in log:2021-02-09T16:08:04.250-0200 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc000d1c09a23c6ec, ext:50766929, loc:(*time.Location)(0x3ee6880)}, Meta:{"pipeline":"filebeat-8.0.0-kibana-log-pipeline"}, Fields:{"agent":{"ephemeral_id":"c58c43bd-cedd-4b3d-9996-9c8a71ed5842","id":"fa4a978e-3df0-4bef-be7e-3135179423f2","name":"e5e617242853","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"dataset":"kibana.log","module":"kibana"},"fileset":{"name":"log"},"host":{"name":"e5e617242853"},"input":{"type":"log"},"json":{"@timestamp":"2018-05-09T10:59:00Z","message":"Initializing plugin xpack_main@6.3.0","pid":69776,"plugin":{"author":"Elastic","build":{"date":"Thu May 03 2018 09:49:27 GMT+0000 (UTC)","git":{"count":"17130","date":"Wed, 2 May 2018 22:40:22 -0500","sha":"88e269d"}},"dependencies":{"@elastic/eui":"0.0.38","@elastic/node-crypto":"0.1.2","@elastic/node-phantom-simple":"2.2.4","@elastic/numeral":"2.3.2","@kbn/datemath":"file:../packages/kbn-datemath","@kbn/ui-framework":"file:../packages/kbn-ui-framework","angular-paging":"2.2.1","angular-resource":"1.4.9","angular-sanitize":"1.4.9","angular-ui-ace":"0.2.3","angular-ui-bootstrap":"1.2.5","babel-core":"^6.26.0","babel-preset-es2015":"^6.24.1","babel-runtime":"^6.26.0","bluebird":"3.1.1","boom":"3.1.1","brace":"0.10.0","chrome-remote-interface":"0.24.2","classnames":"2.2.5","concat-stream":"1.5.1","d3":"3.5.6","d3-scale":"1.0.6","dedent":"^0.7.0","dragselect":"1.7.17","elasticsearch":"13.0.1","extract-zip":"1.5.0","font-awesome":"4.4.0","get-port":"2.1.0","getos":"^3.1.0","glob":"6.0.4","hapi-auth-cookie":"6.1.1","history":"4.7.2","humps":"2.0.1","icalendar":"0.7.1","isomorphic-fetch":"2.2.1","joi":"6.10.1","jquery":"^3.3.1","jstimezonedetect":"1.0.5","lodash":"3.10.1","lodash.mean":"^4.1.0","lodash.orderby":"4.6.0","mkdirp":"0.5.1","moment":"^2.20.1","moment-duration-format":"^1.3.0","moment-timezone":"^0.5.14","ngreact":"^0.5.1","object-hash":"1.2.0","path-match":"1.2.4","pdfmake":"0.1.33","pivotal-ui":"13.0.1","pluralize":"3.1.0","pngjs":"3.3.1","prop-types":"^15.6.0","puid":"1.0.5","react":"^16.2.0","react-clipboard.js":"^1.1.2","react-dom":"^16.2.0","react-markdown-renderer":"^1.4.0","react-portal":"^3.2.0","react-redux":"^5.0.5","react-router-breadcrumbs-hoc":"1.1.2","react-router-dom":"^4.2.2","react-select":"^1.2.1","react-sticky":"^6.0.1","react-syntax-highlighter":"^5.7.0","react-vis":"^1.8.1","redux":"3.7.2","redux-actions":"2.2.1","redux-thunk":"2.2.0","request":"^2.85.0","reselect":"3.0.1","rimraf":"^2.6.2","rison-node":"0.3.1","rxjs":"5.3.0","semver":"5.1.0","stream-to-observable":"0.2.0","styled-components":"2.3.2","tar-fs":"1.13.0","tinycolor2":"1.3.0","ui-select":"0.19.4","unbzip2-stream":"1.0.9","uuid":"3.0.1","venn.js":"0.2.9","webcola":"3.3.6","xregexp":"3.2.0"},"engines":{"yarn":"^1.6.0"},"kibana":{"build":{"intermediateBuildDirectory":"build/plugin/kibana/x-pack"},"version":"6.3.0"},"license":"Elastic-License","name":"x-pack","private":true,"version":"6.3.0"},"tags":["plugins","debug"],"type":"log"},"log":{"file":{"path":"/go/src/github.com/elastic/beats/filebeat/module/kibana/log/test/log.verbose.624.log"},"offset":7209},"service":{"type":"kibana"}}, Private:file.State{Id:"native::5976257-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc0004696c0), Source:"/go/src/github.com/elastic/beats/filebeat/module/kibana/log/test/log.verbose.624.log", Offset:9719, Timestamp:time.Time{wall:0xc000d1c099d68d58, ext:45705928, loc:(*time.Location)(0x3ee6880)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x5b30c1, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"illegal_argument_exception","reason":"can't merge a non object mapping [kibana.log.meta.plugin.dependencies.lodash] with an object mapping"}    assert True is False

Expand to view the stacktrace

 a = (<test_modules.Test testMethod=test_fileset_file_023_kibana>,)

    @wraps(func)
    def standalone_func(*a):
>       return func(*(a + p.args), **p.kwargs)

../build/ve/docker/lib/python3.7/site-packages/parameterized/parameterized.py:518: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
tests/system/test_modules.py:99: in test_fileset_file
    cfgfile=cfgfile)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <test_modules.Test testMethod=test_fileset_file_023_kibana>
module = 'kibana', fileset = 'log'
test_file = '/go/src/github.com/elastic/beats/filebeat/module/kibana/log/test/log.verbose.624.log'
cfgfile = '/go/src/github.com/elastic/beats/filebeat/build/system-tests/run/test_modules.Test.test_fileset_file_023_kibana/filebeat.yml'

    def run_on_file(self, module, fileset, test_file, cfgfile):
        print("Testing {}/{} on {}".format(module, fileset, test_file))
    
        self.assert_explicit_ecs_version_set(module, fileset)
    
        try:
            self.es.indices.delete(index=self.index_name)
        except BaseException:
            pass
        self.wait_until(lambda: not self.es.indices.exists(self.index_name))
    
        cmd = [
            self.filebeat, "-systemTest",
            "-e", "-d", "*", "-once",
            "-c", cfgfile,
            "-E", "setup.ilm.enabled=false",
            "-modules={}".format(module),
            "-M", "{module}.*.enabled=false".format(module=module),
            "-M", "{module}.{fileset}.enabled=true".format(
                module=module, fileset=fileset),
            "-M", "{module}.{fileset}.var.input=file".format(
                module=module, fileset=fileset),
            "-M", "{module}.{fileset}.var.paths=[{test_file}]".format(
                module=module, fileset=fileset, test_file=test_file),
            "-M", "*.*.input.close_eof=true",
        ]
    
        # Based on the convention that if a name contains -json the json format is needed. Currently used for LS.
        if "-json" in test_file:
            cmd.append("-M")
            cmd.append("{module}.{fileset}.var.format=json".format(module=module, fileset=fileset))
    
        output_path = os.path.join(self.working_dir)
        # Runs inside a with block to ensure file is closed afterwards
        with open(os.path.join(output_path, "output.log"), "ab") as output:
            output.write(bytes(" ".join(cmd) + "\n", "utf-8"))
    
            # Use a fixed timezone so results don't vary depending on the environment
            # Don't use UTC to avoid hiding that non-UTC timezones are not being converted as needed,
            # this can happen because UTC uses to be the default timezone in date parsers when no other
            # timezone is specified.
            local_env = os.environ.copy()
            local_env["TZ"] = 'Etc/GMT+2'
    
            subprocess.Popen(cmd,
                             env=local_env,
                             stdin=None,
                             stdout=output,
                             stderr=subprocess.STDOUT,
                             bufsize=0).wait()
    
        # List of errors to check in filebeat output logs
        errors = ["Error loading pipeline for fileset", "Cannot index event"]
        # Checks if the output of filebeat includes errors
        contains_error, error_line = file_contains(os.path.join(output_path, "output.log"), errors)
>       assert contains_error is False, "Error found in log:{}".format(error_line)
E       AssertionError: Error found in log:2021-02-09T16:08:04.250-0200	WARN	[elasticsearch]	elasticsearch/client.go:408	Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc000d1c09a23c6ec, ext:50766929, loc:(*time.Location)(0x3ee6880)}, Meta:{"pipeline":"filebeat-8.0.0-kibana-log-pipeline"}, Fields:{"agent":{"ephemeral_id":"c58c43bd-cedd-4b3d-9996-9c8a71ed5842","id":"fa4a978e-3df0-4bef-be7e-3135179423f2","name":"e5e617242853","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"dataset":"kibana.log","module":"kibana"},"fileset":{"name":"log"},"host":{"name":"e5e617242853"},"input":{"type":"log"},"json":{"@timestamp":"2018-05-09T10:59:00Z","message":"Initializing plugin xpack_main@6.3.0","pid":69776,"plugin":{"author":"Elastic","build":{"date":"Thu May 03 2018 09:49:27 GMT+0000 (UTC)","git":{"count":"17130","date":"Wed, 2 May 2018 22:40:22 -0500","sha":"88e269d"}},"dependencies":{"@elastic/eui":"0.0.38","@elastic/node-crypto":"0.1.2","@elastic/node-phantom-simple":"2.2.4","@elastic/numeral":"2.3.2","@kbn/datemath":"file:../packages/kbn-datemath","@kbn/ui-framework":"file:../packages/kbn-ui-framework","angular-paging":"2.2.1","angular-resource":"1.4.9","angular-sanitize":"1.4.9","angular-ui-ace":"0.2.3","angular-ui-bootstrap":"1.2.5","babel-core":"^6.26.0","babel-preset-es2015":"^6.24.1","babel-runtime":"^6.26.0","bluebird":"3.1.1","boom":"3.1.1","brace":"0.10.0","chrome-remote-interface":"0.24.2","classnames":"2.2.5","concat-stream":"1.5.1","d3":"3.5.6","d3-scale":"1.0.6","dedent":"^0.7.0","dragselect":"1.7.17","elasticsearch":"13.0.1","extract-zip":"1.5.0","font-awesome":"4.4.0","get-port":"2.1.0","getos":"^3.1.0","glob":"6.0.4","hapi-auth-cookie":"6.1.1","history":"4.7.2","humps":"2.0.1","icalendar":"0.7.1","isomorphic-fetch":"2.2.1","joi":"6.10.1","jquery":"^3.3.1","jstimezonedetect":"1.0.5","lodash":"3.10.1","lodash.mean":"^4.1.0","lodash.orderby":"4.6.0","mkdirp":"0.5.1","moment":"^2.20.1","moment-duration-format":"^1.3.0","moment-timezone":"^0.5.14","ngreact":"^0.5.1","object-hash":"1.2.0","path-match":"1.2.4","pdfmake":"0.1.33","pivotal-ui":"13.0.1","pluralize":"3.1.0","pngjs":"3.3.1","prop-types":"^15.6.0","puid":"1.0.5","react":"^16.2.0","react-clipboard.js":"^1.1.2","react-dom":"^16.2.0","react-markdown-renderer":"^1.4.0","react-portal":"^3.2.0","react-redux":"^5.0.5","react-router-breadcrumbs-hoc":"1.1.2","react-router-dom":"^4.2.2","react-select":"^1.2.1","react-sticky":"^6.0.1","react-syntax-highlighter":"^5.7.0","react-vis":"^1.8.1","redux":"3.7.2","redux-actions":"2.2.1","redux-thunk":"2.2.0","request":"^2.85.0","reselect":"3.0.1","rimraf":"^2.6.2","rison-node":"0.3.1","rxjs":"5.3.0","semver":"5.1.0","stream-to-observable":"0.2.0","styled-components":"2.3.2","tar-fs":"1.13.0","tinycolor2":"1.3.0","ui-select":"0.19.4","unbzip2-stream":"1.0.9","uuid":"3.0.1","venn.js":"0.2.9","webcola":"3.3.6","xregexp":"3.2.0"},"engines":{"yarn":"^1.6.0"},"kibana":{"build":{"intermediateBuildDirectory":"build/plugin/kibana/x-pack"},"version":"6.3.0"},"license":"Elastic-License","name":"x-pack","private":true,"version":"6.3.0"},"tags":["plugins","debug"],"type":"log"},"log":{"file":{"path":"/go/src/github.com/elastic/beats/filebeat/module/kibana/log/test/log.verbose.624.log"},"offset":7209},"service":{"type":"kibana"}}, Private:file.State{Id:"native::5976257-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc0004696c0), Source:"/go/src/github.com/elastic/beats/filebeat/module/kibana/log/test/log.verbose.624.log", Offset:9719, Timestamp:time.Time{wall:0xc000d1c099d68d58, ext:45705928, loc:(*time.Location)(0x3ee6880)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x5b30c1, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"illegal_argument_exception","reason":"can't merge a non object mapping [kibana.log.meta.plugin.dependencies.lodash] with an object mapping"}
E         
E       assert True is False

tests/system/test_modules.py:156: AssertionError

`Build&Test / x-pack/filebeat-build / test_fileset_file_043_zoom – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest`

Expand to view the error details

 AssertionError: Error found in log:2021-02-09T16:07:24.521-0200 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc000d1b696b9c1be, ext:89628658, loc:(*time.Location)(0x60b8d60)}, Meta:{"pipeline":"filebeat-8.0.0-zoom-webhook-pipeline"}, Fields:{"agent":{"ephemeral_id":"cb239993-ad8a-4d55-9e20-bac36c1aeb05","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"dataset":"zoom.webhook","module":"zoom","timezone":"-02:00"},"fileset":{"name":"webhook"},"input":{"type":"log"},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/zoom/webhook/test/chat_channel.ndjson.log"},"offset":403},"message":"{\"event\":\"chat_channel.updated\",\"payload\":{\"account_id\":\"vbbvnvAdsfe\",\"operator\":\"somememai@gmtsffjdfhail.com\",\"operator_id\":\"z8dfgdfguQrdfgdf\",\"object\":{\"name\":\"Building Happy\",\"id\":\"6dfgdfgdg444447b0egga\",\"type\":1,\"date_time\":\"2020-02-10T21:59:05Z\",\"timestamp\":1581371945584}}}","service":{"type":"zoom"},"tags":["zoom-webhook","forwarded"],"zoom":{"event":"chat_channel.updated","payload":{"account_id":"vbbvnvAdsfe","object":{"date_time":"2020-02-10T21:59:05Z","id":"6dfgdfgdg444447b0egga","name":"Building Happy","timestamp":1581371945584,"type":1},"operator":"somememai@gmtsffjdfhail.com","operator_id":"z8dfgdfguQrdfgdf"}}}, Private:file.State{Id:"native::5680847-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc000f73110), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/zoom/webhook/test/chat_channel.ndjson.log", Offset:683, Timestamp:time.Time{wall:0xc000d1b696a93b5e, ext:88545700, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56aecf, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"illegal_argument_exception","reason":"field [members] not present as part of path [zoom.chat_channel.members]"}    assert True is False

Expand to view the stacktrace

 a = (<test_xpack_modules.XPackTest testMethod=test_fileset_file_043_zoom>,)

    @wraps(func)
    def standalone_func(*a):
>       return func(*(a + p.args), **p.kwargs)

../../build/ve/docker/lib/python3.7/site-packages/parameterized/parameterized.py:518: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../../filebeat/tests/system/test_modules.py:99: in test_fileset_file
    cfgfile=cfgfile)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <test_xpack_modules.XPackTest testMethod=test_fileset_file_043_zoom>
module = 'zoom', fileset = 'webhook'
test_file = '/go/src/github.com/elastic/beats/x-pack/filebeat/module/zoom/webhook/test/chat_channel.ndjson.log'
cfgfile = '/go/src/github.com/elastic/beats/x-pack/filebeat/build/system-tests/run/test_xpack_modules.XPackTest.test_fileset_file_043_zoom/filebeat.yml'

    def run_on_file(self, module, fileset, test_file, cfgfile):
        print("Testing {}/{} on {}".format(module, fileset, test_file))
    
        self.assert_explicit_ecs_version_set(module, fileset)
    
        try:
            self.es.indices.delete(index=self.index_name)
        except BaseException:
            pass
        self.wait_until(lambda: not self.es.indices.exists(self.index_name))
    
        cmd = [
            self.filebeat, "-systemTest",
            "-e", "-d", "*", "-once",
            "-c", cfgfile,
            "-E", "setup.ilm.enabled=false",
            "-modules={}".format(module),
            "-M", "{module}.*.enabled=false".format(module=module),
            "-M", "{module}.{fileset}.enabled=true".format(
                module=module, fileset=fileset),
            "-M", "{module}.{fileset}.var.input=file".format(
                module=module, fileset=fileset),
            "-M", "{module}.{fileset}.var.paths=[{test_file}]".format(
                module=module, fileset=fileset, test_file=test_file),
            "-M", "*.*.input.close_eof=true",
        ]
    
        # Based on the convention that if a name contains -json the json format is needed. Currently used for LS.
        if "-json" in test_file:
            cmd.append("-M")
            cmd.append("{module}.{fileset}.var.format=json".format(module=module, fileset=fileset))
    
        output_path = os.path.join(self.working_dir)
        # Runs inside a with block to ensure file is closed afterwards
        with open(os.path.join(output_path, "output.log"), "ab") as output:
            output.write(bytes(" ".join(cmd) + "\n", "utf-8"))
    
            # Use a fixed timezone so results don't vary depending on the environment
            # Don't use UTC to avoid hiding that non-UTC timezones are not being converted as needed,
            # this can happen because UTC uses to be the default timezone in date parsers when no other
            # timezone is specified.
            local_env = os.environ.copy()
            local_env["TZ"] = 'Etc/GMT+2'
    
            subprocess.Popen(cmd,
                             env=local_env,
                             stdin=None,
                             stdout=output,
                             stderr=subprocess.STDOUT,
                             bufsize=0).wait()
    
        # List of errors to check in filebeat output logs
        errors = ["Error loading pipeline for fileset", "Cannot index event"]
        # Checks if the output of filebeat includes errors
        contains_error, error_line = file_contains(os.path.join(output_path, "output.log"), errors)
>       assert contains_error is False, "Error found in log:{}".format(error_line)
E       AssertionError: Error found in log:2021-02-09T16:07:24.521-0200	WARN	[elasticsearch]	elasticsearch/client.go:408	Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc000d1b696b9c1be, ext:89628658, loc:(*time.Location)(0x60b8d60)}, Meta:{"pipeline":"filebeat-8.0.0-zoom-webhook-pipeline"}, Fields:{"agent":{"ephemeral_id":"cb239993-ad8a-4d55-9e20-bac36c1aeb05","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"dataset":"zoom.webhook","module":"zoom","timezone":"-02:00"},"fileset":{"name":"webhook"},"input":{"type":"log"},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/zoom/webhook/test/chat_channel.ndjson.log"},"offset":403},"message":"{\"event\":\"chat_channel.updated\",\"payload\":{\"account_id\":\"vbbvnvAdsfe\",\"operator\":\"somememai@gmtsffjdfhail.com\",\"operator_id\":\"z8dfgdfguQrdfgdf\",\"object\":{\"name\":\"Building Happy\",\"id\":\"6dfgdfgdg444447b0egga\",\"type\":1,\"date_time\":\"2020-02-10T21:59:05Z\",\"timestamp\":1581371945584}}}","service":{"type":"zoom"},"tags":["zoom-webhook","forwarded"],"zoom":{"event":"chat_channel.updated","payload":{"account_id":"vbbvnvAdsfe","object":{"date_time":"2020-02-10T21:59:05Z","id":"6dfgdfgdg444447b0egga","name":"Building Happy","timestamp":1581371945584,"type":1},"operator":"somememai@gmtsffjdfhail.com","operator_id":"z8dfgdfguQrdfgdf"}}}, Private:file.State{Id:"native::5680847-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc000f73110), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/zoom/webhook/test/chat_channel.ndjson.log", Offset:683, Timestamp:time.Time{wall:0xc000d1b696a93b5e, ext:88545700, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56aecf, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"illegal_argument_exception","reason":"field [members] not present as part of path [zoom.chat_channel.members]"}
E         
E       assert True is False

../../filebeat/tests/system/test_modules.py:156: AssertionError

`Build&Test / x-pack/filebeat-build / test_fileset_file_045_zoom – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest`

Expand to view the error details

 AssertionError: Error found in log:2021-02-09T16:07:31.149-0200 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc000d1b86487c9ad, ext:90284976, loc:(*time.Location)(0x60b8d60)}, Meta:{"pipeline":"filebeat-8.0.0-zoom-webhook-pipeline"}, Fields:{"agent":{"ephemeral_id":"ba2e4fb4-9d49-4ef8-b40b-63040cd3648a","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"dataset":"zoom.webhook","module":"zoom","timezone":"-02:00"},"fileset":{"name":"webhook"},"input":{"type":"log"},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/zoom/webhook/test/recording.ndjson.log"},"offset":0},"message":"{\"event\":\"recording.started\",\"payload\":{\"account_id\":\"lAAAAAAAAAAAAA\",\"object\":{\"uuid\":\"dj12vck6sdTn6yy7qdy3dQg==\",\"id\":150000008,\"host_id\":\"uLobbbbbbbbbb_qQsQ\",\"topic\":\"A test meeting\",\"type\":2,\"start_time\":\"2019-07-11T20:00:00Z\",\"duration\":1,\"timezone\":\"America/Los_Angeles\",\"recording_file\":{\"recording_start\":\"2019-07-31T22:41:02Z\",\"recording_end\":\"\"}}}}","service":{"type":"zoom"},"tags":["zoom-webhook","forwarded"],"zoom":{"event":"recording.started","payload":{"account_id":"lAAAAAAAAAAAAA","object":{"duration":1,"host_id":"uLobbbbbbbbbb_qQsQ","id":150000008,"recording_file":{"recording_end":"","recording_start":"2019-07-31T22:41:02Z"},"start_time":"2019-07-11T20:00:00Z","timezone":"America/Los_Angeles","topic":"A test meeting","type":2,"uuid":"dj12vck6sdTn6yy7qdy3dQg=="}}}}, Private:file.State{Id:"native::5680853-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc00080d040), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/zoom/webhook/test/recording.ndjson.log", Offset:359, Timestamp:time.Time{wall:0xc000d1b8647cb231, ext:89558078, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56aed5, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse field [zoom.recording.recording_file.recording_end] of type [date] in document with id '1Rr6h3cBlK8jOxC9G9E9'. Preview of field's value: ''","caused_by":{"type":"illegal_argument_exception","reason":"cannot parse empty date"}}    assert True is False

Expand to view the stacktrace

 a = (<test_xpack_modules.XPackTest testMethod=test_fileset_file_045_zoom>,)

    @wraps(func)
    def standalone_func(*a):
>       return func(*(a + p.args), **p.kwargs)

../../build/ve/docker/lib/python3.7/site-packages/parameterized/parameterized.py:518: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../../filebeat/tests/system/test_modules.py:99: in test_fileset_file
    cfgfile=cfgfile)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <test_xpack_modules.XPackTest testMethod=test_fileset_file_045_zoom>
module = 'zoom', fileset = 'webhook'
test_file = '/go/src/github.com/elastic/beats/x-pack/filebeat/module/zoom/webhook/test/recording.ndjson.log'
cfgfile = '/go/src/github.com/elastic/beats/x-pack/filebeat/build/system-tests/run/test_xpack_modules.XPackTest.test_fileset_file_045_zoom/filebeat.yml'

    def run_on_file(self, module, fileset, test_file, cfgfile):
        print("Testing {}/{} on {}".format(module, fileset, test_file))
    
        self.assert_explicit_ecs_version_set(module, fileset)
    
        try:
            self.es.indices.delete(index=self.index_name)
        except BaseException:
            pass
        self.wait_until(lambda: not self.es.indices.exists(self.index_name))
    
        cmd = [
            self.filebeat, "-systemTest",
            "-e", "-d", "*", "-once",
            "-c", cfgfile,
            "-E", "setup.ilm.enabled=false",
            "-modules={}".format(module),
            "-M", "{module}.*.enabled=false".format(module=module),
            "-M", "{module}.{fileset}.enabled=true".format(
                module=module, fileset=fileset),
            "-M", "{module}.{fileset}.var.input=file".format(
                module=module, fileset=fileset),
            "-M", "{module}.{fileset}.var.paths=[{test_file}]".format(
                module=module, fileset=fileset, test_file=test_file),
            "-M", "*.*.input.close_eof=true",
        ]
    
        # Based on the convention that if a name contains -json the json format is needed. Currently used for LS.
        if "-json" in test_file:
            cmd.append("-M")
            cmd.append("{module}.{fileset}.var.format=json".format(module=module, fileset=fileset))
    
        output_path = os.path.join(self.working_dir)
        # Runs inside a with block to ensure file is closed afterwards
        with open(os.path.join(output_path, "output.log"), "ab") as output:
            output.write(bytes(" ".join(cmd) + "\n", "utf-8"))
    
            # Use a fixed timezone so results don't vary depending on the environment
            # Don't use UTC to avoid hiding that non-UTC timezones are not being converted as needed,
            # this can happen because UTC uses to be the default timezone in date parsers when no other
            # timezone is specified.
            local_env = os.environ.copy()
            local_env["TZ"] = 'Etc/GMT+2'
    
            subprocess.Popen(cmd,
                             env=local_env,
                             stdin=None,
                             stdout=output,
                             stderr=subprocess.STDOUT,
                             bufsize=0).wait()
    
        # List of errors to check in filebeat output logs
        errors = ["Error loading pipeline for fileset", "Cannot index event"]
        # Checks if the output of filebeat includes errors
        contains_error, error_line = file_contains(os.path.join(output_path, "output.log"), errors)
>       assert contains_error is False, "Error found in log:{}".format(error_line)
E       AssertionError: Error found in log:2021-02-09T16:07:31.149-0200	WARN	[elasticsearch]	elasticsearch/client.go:408	Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc000d1b86487c9ad, ext:90284976, loc:(*time.Location)(0x60b8d60)}, Meta:{"pipeline":"filebeat-8.0.0-zoom-webhook-pipeline"}, Fields:{"agent":{"ephemeral_id":"ba2e4fb4-9d49-4ef8-b40b-63040cd3648a","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"dataset":"zoom.webhook","module":"zoom","timezone":"-02:00"},"fileset":{"name":"webhook"},"input":{"type":"log"},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/zoom/webhook/test/recording.ndjson.log"},"offset":0},"message":"{\"event\":\"recording.started\",\"payload\":{\"account_id\":\"lAAAAAAAAAAAAA\",\"object\":{\"uuid\":\"dj12vck6sdTn6yy7qdy3dQg==\",\"id\":150000008,\"host_id\":\"uLobbbbbbbbbb_qQsQ\",\"topic\":\"A test meeting\",\"type\":2,\"start_time\":\"2019-07-11T20:00:00Z\",\"duration\":1,\"timezone\":\"America/Los_Angeles\",\"recording_file\":{\"recording_start\":\"2019-07-31T22:41:02Z\",\"recording_end\":\"\"}}}}","service":{"type":"zoom"},"tags":["zoom-webhook","forwarded"],"zoom":{"event":"recording.started","payload":{"account_id":"lAAAAAAAAAAAAA","object":{"duration":1,"host_id":"uLobbbbbbbbbb_qQsQ","id":150000008,"recording_file":{"recording_end":"","recording_start":"2019-07-31T22:41:02Z"},"start_time":"2019-07-11T20:00:00Z","timezone":"America/Los_Angeles","topic":"A test meeting","type":2,"uuid":"dj12vck6sdTn6yy7qdy3dQg=="}}}}, Private:file.State{Id:"native::5680853-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc00080d040), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/zoom/webhook/test/recording.ndjson.log", Offset:359, Timestamp:time.Time{wall:0xc000d1b8647cb231, ext:89558078, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56aed5, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse field [zoom.recording.recording_file.recording_end] of type [date] in document with id '1Rr6h3cBlK8jOxC9G9E9'. Preview of field's value: ''","caused_by":{"type":"illegal_argument_exception","reason":"cannot parse empty date"}}
E         
E       assert True is False

../../filebeat/tests/system/test_modules.py:156: AssertionError

`Build&Test / x-pack/filebeat-build / test_fileset_file_067_sophos – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest`

Expand to view the error details

 AssertionError: Error found in log:2021-02-09T16:09:33.909-0200 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc000d1d6e57b3e46, ext:92746046, loc:(*time.Location)(0x60b8d60)}, Meta:{"pipeline":"filebeat-8.0.0-sophos-xg-pipeline"}, Fields:{"_conf":{"default":"firewall.localgroup.local","mappings":[{"hostname":"my_fancy_host","serial":"1234567890123456"},{"hostname":"some_other_host.local","serial":"1234567890123457"}]},"agent":{"ephemeral_id":"ff582fcd-f7d4-4748-979e-0c7c68f93808","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"dataset":"sophos.xg","module":"sophos","timezone":"-02:00"},"fileset":{"name":"xg"},"host":{"name":"9911684e5ade"},"input":{"type":"log"},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/sophos/xg/test/event.log"},"offset":4674},"message":"\u003c30\u003edevice=\"SFW\" date=2020-05-18 time=14:39:07 timezone=\"CEST\" device_name=\"XG230\" device_id=1234567890123457 log_id=062009617502 log_type=\"Event\" log_component=\"GUI\" log_subtype=\"Admin\" status=\"Successful\" priority=Information user_name=\"admin\" src_ip=10.83.234.5 SysLog_SERVER_NAME='Logstash' message=\"SysLog Server 'Logstash' settings were changed by 'admin' from '10.83.234.5' using 'GUI'\"","service":{"type":"sophos"},"tags":["sophos-xg","forwarded"]}, Private:file.State{Id:"native::5680954-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc000735d40), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/sophos/xg/test/event.log", Offset:5069, Timestamp:time.Time{wall:0xc000d1d6e558bafd, ext:90484202, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56af3a, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse field [source.ip] of type [ip] in document with id '6Rr7h3cBlK8jOxC9-tPF'. Preview of field's value: '10.83.234.5 SysLog_SERVER_NAME='Logstash''","caused_by":{"type":"illegal_argument_exception","reason":"'10.83.234.5 SysLog_SERVER_NAME='Logstash'' is not an IP string literal."}}    assert True is False

Expand to view the stacktrace

 a = (<test_xpack_modules.XPackTest testMethod=test_fileset_file_067_sophos>,)

    @wraps(func)
    def standalone_func(*a):
>       return func(*(a + p.args), **p.kwargs)

../../build/ve/docker/lib/python3.7/site-packages/parameterized/parameterized.py:518: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../../filebeat/tests/system/test_modules.py:99: in test_fileset_file
    cfgfile=cfgfile)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <test_xpack_modules.XPackTest testMethod=test_fileset_file_067_sophos>
module = 'sophos', fileset = 'xg'
test_file = '/go/src/github.com/elastic/beats/x-pack/filebeat/module/sophos/xg/test/event.log'
cfgfile = '/go/src/github.com/elastic/beats/x-pack/filebeat/build/system-tests/run/test_xpack_modules.XPackTest.test_fileset_file_067_sophos/filebeat.yml'

    def run_on_file(self, module, fileset, test_file, cfgfile):
        print("Testing {}/{} on {}".format(module, fileset, test_file))
    
        self.assert_explicit_ecs_version_set(module, fileset)
    
        try:
            self.es.indices.delete(index=self.index_name)
        except BaseException:
            pass
        self.wait_until(lambda: not self.es.indices.exists(self.index_name))
    
        cmd = [
            self.filebeat, "-systemTest",
            "-e", "-d", "*", "-once",
            "-c", cfgfile,
            "-E", "setup.ilm.enabled=false",
            "-modules={}".format(module),
            "-M", "{module}.*.enabled=false".format(module=module),
            "-M", "{module}.{fileset}.enabled=true".format(
                module=module, fileset=fileset),
            "-M", "{module}.{fileset}.var.input=file".format(
                module=module, fileset=fileset),
            "-M", "{module}.{fileset}.var.paths=[{test_file}]".format(
                module=module, fileset=fileset, test_file=test_file),
            "-M", "*.*.input.close_eof=true",
        ]
    
        # Based on the convention that if a name contains -json the json format is needed. Currently used for LS.
        if "-json" in test_file:
            cmd.append("-M")
            cmd.append("{module}.{fileset}.var.format=json".format(module=module, fileset=fileset))
    
        output_path = os.path.join(self.working_dir)
        # Runs inside a with block to ensure file is closed afterwards
        with open(os.path.join(output_path, "output.log"), "ab") as output:
            output.write(bytes(" ".join(cmd) + "\n", "utf-8"))
    
            # Use a fixed timezone so results don't vary depending on the environment
            # Don't use UTC to avoid hiding that non-UTC timezones are not being converted as needed,
            # this can happen because UTC uses to be the default timezone in date parsers when no other
            # timezone is specified.
            local_env = os.environ.copy()
            local_env["TZ"] = 'Etc/GMT+2'
    
            subprocess.Popen(cmd,
                             env=local_env,
                             stdin=None,
                             stdout=output,
                             stderr=subprocess.STDOUT,
                             bufsize=0).wait()
    
        # List of errors to check in filebeat output logs
        errors = ["Error loading pipeline for fileset", "Cannot index event"]
        # Checks if the output of filebeat includes errors
        contains_error, error_line = file_contains(os.path.join(output_path, "output.log"), errors)
>       assert contains_error is False, "Error found in log:{}".format(error_line)
E       AssertionError: Error found in log:2021-02-09T16:09:33.909-0200	WARN	[elasticsearch]	elasticsearch/client.go:408	Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc000d1d6e57b3e46, ext:92746046, loc:(*time.Location)(0x60b8d60)}, Meta:{"pipeline":"filebeat-8.0.0-sophos-xg-pipeline"}, Fields:{"_conf":{"default":"firewall.localgroup.local","mappings":[{"hostname":"my_fancy_host","serial":"1234567890123456"},{"hostname":"some_other_host.local","serial":"1234567890123457"}]},"agent":{"ephemeral_id":"ff582fcd-f7d4-4748-979e-0c7c68f93808","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"dataset":"sophos.xg","module":"sophos","timezone":"-02:00"},"fileset":{"name":"xg"},"host":{"name":"9911684e5ade"},"input":{"type":"log"},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/sophos/xg/test/event.log"},"offset":4674},"message":"\u003c30\u003edevice=\"SFW\" date=2020-05-18 time=14:39:07 timezone=\"CEST\" device_name=\"XG230\" device_id=1234567890123457 log_id=062009617502 log_type=\"Event\" log_component=\"GUI\" log_subtype=\"Admin\" status=\"Successful\" priority=Information user_name=\"admin\" src_ip=10.83.234.5 SysLog_SERVER_NAME='Logstash' message=\"SysLog Server 'Logstash' settings were changed by 'admin' from '10.83.234.5' using 'GUI'\"","service":{"type":"sophos"},"tags":["sophos-xg","forwarded"]}, Private:file.State{Id:"native::5680954-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc000735d40), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/sophos/xg/test/event.log", Offset:5069, Timestamp:time.Time{wall:0xc000d1d6e558bafd, ext:90484202, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56af3a, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse field [source.ip] of type [ip] in document with id '6Rr7h3cBlK8jOxC9-tPF'. Preview of field's value: '10.83.234.5 SysLog_SERVER_NAME='Logstash''","caused_by":{"type":"illegal_argument_exception","reason":"'10.83.234.5 SysLog_SERVER_NAME='Logstash'' is not an IP string literal."}}
E         
E       assert True is False

../../filebeat/tests/system/test_modules.py:156: AssertionError

`Build&Test / x-pack/filebeat-build / test_fileset_file_128_gsuite – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest`

Expand to view the error details

 AssertionError: Error found in log:2021-02-09T16:15:37.553-0200 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0x0, ext:63737247600, loc:(*time.Location)(nil)}, Meta:{"pipeline":"filebeat-8.0.0-gsuite-login-common"}, Fields:{"agent":{"ephemeral_id":"d25863e1-9578-4a3f-8bb2-2d1a2667c80d","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"action":"suspicious_login","category":["authentication"],"dataset":"gsuite.login","id":"1","module":"gsuite","original":"{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"login\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"ownerDomain\":\"elastic.com\",\"ipAddress\":\"98.235.162.24\",\"events\":{\"type\":\"account_warning\",\"name\":\"suspicious_login\",\"parameters\":[{\"name\":\"affected_email_address\",\"value\":\"foo@elastic.co\"},{\"name\":\"login_timestamp\",\"intValue\":1593695305123456}]}}","provider":"login","start":"Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)","type":["info"]},"fileset":{"name":"login"},"gsuite":{"actor":{"type":"USER"},"event":{"type":"account_warning"},"kind":"admin#reports#activity","login":{"affected_email_address":"foo@elastic.co"},"organization":{"domain":"elastic.com"}},"input":{"type":"log"},"json":{"actor":{},"events":{},"id":{"time":"2020-10-02T15:00:00Z"}},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/gsuite/login/test/gsuite-login-test.json.log"},"offset":406},"organization":{"id":"1"},"related":{"ip":["98.235.162.24"],"user":["foo"]},"service":{"type":"gsuite"},"source":{"ip":"98.235.162.24","user":{"domain":"bar.com","email":"foo@bar.com","id":"1","name":"foo"}},"tags":["forwarded"]}, Private:file.State{Id:"native::5681427-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc0009489c0), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/gsuite/login/test/gsuite-login-test.json.log", Offset:853, Timestamp:time.Time{wall:0xc000d2320c49cbbe, ext:88748748, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56b113, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse field [event.start] of type [date] in document with id 'cxsBiHcBlK8jOxC9hxNH'. Preview of field's value: 'Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)'","caused_by":{"type":"illegal_argument_exception","reason":"failed to parse date field [Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)] with format [strict_date_optional_time||epoch_millis]","caused_by":{"type":"date_time_parse_exception","reason":"Failed to parse with all enclosed parsers"}}}    assert True is False

Expand to view the stacktrace

 a = (<test_xpack_modules.XPackTest testMethod=test_fileset_file_128_gsuite>,)

    @wraps(func)
    def standalone_func(*a):
>       return func(*(a + p.args), **p.kwargs)

../../build/ve/docker/lib/python3.7/site-packages/parameterized/parameterized.py:518: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../../filebeat/tests/system/test_modules.py:99: in test_fileset_file
    cfgfile=cfgfile)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <test_xpack_modules.XPackTest testMethod=test_fileset_file_128_gsuite>
module = 'gsuite', fileset = 'login'
test_file = '/go/src/github.com/elastic/beats/x-pack/filebeat/module/gsuite/login/test/gsuite-login-test.json.log'
cfgfile = '/go/src/github.com/elastic/beats/x-pack/filebeat/build/system-tests/run/test_xpack_modules.XPackTest.test_fileset_file_128_gsuite/filebeat.yml'

    def run_on_file(self, module, fileset, test_file, cfgfile):
        print("Testing {}/{} on {}".format(module, fileset, test_file))
    
        self.assert_explicit_ecs_version_set(module, fileset)
    
        try:
            self.es.indices.delete(index=self.index_name)
        except BaseException:
            pass
        self.wait_until(lambda: not self.es.indices.exists(self.index_name))
    
        cmd = [
            self.filebeat, "-systemTest",
            "-e", "-d", "*", "-once",
            "-c", cfgfile,
            "-E", "setup.ilm.enabled=false",
            "-modules={}".format(module),
            "-M", "{module}.*.enabled=false".format(module=module),
            "-M", "{module}.{fileset}.enabled=true".format(
                module=module, fileset=fileset),
            "-M", "{module}.{fileset}.var.input=file".format(
                module=module, fileset=fileset),
            "-M", "{module}.{fileset}.var.paths=[{test_file}]".format(
                module=module, fileset=fileset, test_file=test_file),
            "-M", "*.*.input.close_eof=true",
        ]
    
        # Based on the convention that if a name contains -json the json format is needed. Currently used for LS.
        if "-json" in test_file:
            cmd.append("-M")
            cmd.append("{module}.{fileset}.var.format=json".format(module=module, fileset=fileset))
    
        output_path = os.path.join(self.working_dir)
        # Runs inside a with block to ensure file is closed afterwards
        with open(os.path.join(output_path, "output.log"), "ab") as output:
            output.write(bytes(" ".join(cmd) + "\n", "utf-8"))
    
            # Use a fixed timezone so results don't vary depending on the environment
            # Don't use UTC to avoid hiding that non-UTC timezones are not being converted as needed,
            # this can happen because UTC uses to be the default timezone in date parsers when no other
            # timezone is specified.
            local_env = os.environ.copy()
            local_env["TZ"] = 'Etc/GMT+2'
    
            subprocess.Popen(cmd,
                             env=local_env,
                             stdin=None,
                             stdout=output,
                             stderr=subprocess.STDOUT,
                             bufsize=0).wait()
    
        # List of errors to check in filebeat output logs
        errors = ["Error loading pipeline for fileset", "Cannot index event"]
        # Checks if the output of filebeat includes errors
        contains_error, error_line = file_contains(os.path.join(output_path, "output.log"), errors)
>       assert contains_error is False, "Error found in log:{}".format(error_line)
E       AssertionError: Error found in log:2021-02-09T16:15:37.553-0200	WARN	[elasticsearch]	elasticsearch/client.go:408	Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0x0, ext:63737247600, loc:(*time.Location)(nil)}, Meta:{"pipeline":"filebeat-8.0.0-gsuite-login-common"}, Fields:{"agent":{"ephemeral_id":"d25863e1-9578-4a3f-8bb2-2d1a2667c80d","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"action":"suspicious_login","category":["authentication"],"dataset":"gsuite.login","id":"1","module":"gsuite","original":"{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"login\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"ownerDomain\":\"elastic.com\",\"ipAddress\":\"98.235.162.24\",\"events\":{\"type\":\"account_warning\",\"name\":\"suspicious_login\",\"parameters\":[{\"name\":\"affected_email_address\",\"value\":\"foo@elastic.co\"},{\"name\":\"login_timestamp\",\"intValue\":1593695305123456}]}}","provider":"login","start":"Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)","type":["info"]},"fileset":{"name":"login"},"gsuite":{"actor":{"type":"USER"},"event":{"type":"account_warning"},"kind":"admin#reports#activity","login":{"affected_email_address":"foo@elastic.co"},"organization":{"domain":"elastic.com"}},"input":{"type":"log"},"json":{"actor":{},"events":{},"id":{"time":"2020-10-02T15:00:00Z"}},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/gsuite/login/test/gsuite-login-test.json.log"},"offset":406},"organization":{"id":"1"},"related":{"ip":["98.235.162.24"],"user":["foo"]},"service":{"type":"gsuite"},"source":{"ip":"98.235.162.24","user":{"domain":"bar.com","email":"foo@bar.com","id":"1","name":"foo"}},"tags":["forwarded"]}, Private:file.State{Id:"native::5681427-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc0009489c0), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/gsuite/login/test/gsuite-login-test.json.log", Offset:853, Timestamp:time.Time{wall:0xc000d2320c49cbbe, ext:88748748, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56b113, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse field [event.start] of type [date] in document with id 'cxsBiHcBlK8jOxC9hxNH'. Preview of field's value: 'Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)'","caused_by":{"type":"illegal_argument_exception","reason":"failed to parse date field [Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)] with format [strict_date_optional_time||epoch_millis]","caused_by":{"type":"date_time_parse_exception","reason":"Failed to parse with all enclosed parsers"}}}
E         
E       assert True is False

../../filebeat/tests/system/test_modules.py:156: AssertionError

`Build&Test / x-pack/filebeat-build / test_fileset_file_203_cisco – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest`

Expand to view the error details

 AssertionError: Error found in log:2021-02-09T16:20:17.543-0200 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc000d277fb0fdf3b, ext:96420354, loc:(*time.Location)(0x60b8d60)}, Meta:{"pipeline":"filebeat-8.0.0-cisco-asa-asa-ftd-pipeline"}, Fields:{"agent":{"ephemeral_id":"f4ddf009-8b6b-4c80-b222-84c19ce0dba8","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"dataset":"cisco.asa","module":"cisco","timezone":"-02:00"},"fileset":{"name":"asa"},"input":{"type":"log"},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/cisco/asa/test/additional_messages.log"},"offset":4472},"message":"May  5 19:02:58 dev01: %ASA-6-302022: Built director stub TCP connection for fw1111:10.10.10.10/38540 (8.8.8.5/38540) to net:192.168.2.2/10051 (8.8.8.8/10051)","service":{"type":"cisco"},"tags":["cisco-asa","forwarded"]}, Private:file.State{Id:"native::5681854-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc00047cdd0), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/cisco/asa/test/additional_messages.log", Offset:4631, Timestamp:time.Time{wall:0xc000d277fad71465, ext:92698411, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56b2be, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse field [destination.port] of type [long] in document with id 'ShsFiHcBlK8jOxC9zBf4'. Preview of field's value: '10051 (8.8.8.8/10051)'","caused_by":{"type":"illegal_argument_exception","reason":"For input string: \"10051 (8.8.8.8/10051)\""}}    assert True is False

Expand to view the stacktrace

 a = (<test_xpack_modules.XPackTest testMethod=test_fileset_file_203_cisco>,)

    @wraps(func)
    def standalone_func(*a):
>       return func(*(a + p.args), **p.kwargs)

../../build/ve/docker/lib/python3.7/site-packages/parameterized/parameterized.py:518: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../../filebeat/tests/system/test_modules.py:99: in test_fileset_file
    cfgfile=cfgfile)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <test_xpack_modules.XPackTest testMethod=test_fileset_file_203_cisco>
module = 'cisco', fileset = 'asa'
test_file = '/go/src/github.com/elastic/beats/x-pack/filebeat/module/cisco/asa/test/additional_messages.log'
cfgfile = '/go/src/github.com/elastic/beats/x-pack/filebeat/build/system-tests/run/test_xpack_modules.XPackTest.test_fileset_file_203_cisco/filebeat.yml'

    def run_on_file(self, module, fileset, test_file, cfgfile):
        print("Testing {}/{} on {}".format(module, fileset, test_file))
    
        self.assert_explicit_ecs_version_set(module, fileset)
    
        try:
            self.es.indices.delete(index=self.index_name)
        except BaseException:
            pass
        self.wait_until(lambda: not self.es.indices.exists(self.index_name))
    
        cmd = [
            self.filebeat, "-systemTest",
            "-e", "-d", "*", "-once",
            "-c", cfgfile,
            "-E", "setup.ilm.enabled=false",
            "-modules={}".format(module),
            "-M", "{module}.*.enabled=false".format(module=module),
            "-M", "{module}.{fileset}.enabled=true".format(
                module=module, fileset=fileset),
            "-M", "{module}.{fileset}.var.input=file".format(
                module=module, fileset=fileset),
            "-M", "{module}.{fileset}.var.paths=[{test_file}]".format(
                module=module, fileset=fileset, test_file=test_file),
            "-M", "*.*.input.close_eof=true",
        ]
    
        # Based on the convention that if a name contains -json the json format is needed. Currently used for LS.
        if "-json" in test_file:
            cmd.append("-M")
            cmd.append("{module}.{fileset}.var.format=json".format(module=module, fileset=fileset))
    
        output_path = os.path.join(self.working_dir)
        # Runs inside a with block to ensure file is closed afterwards
        with open(os.path.join(output_path, "output.log"), "ab") as output:
            output.write(bytes(" ".join(cmd) + "\n", "utf-8"))
    
            # Use a fixed timezone so results don't vary depending on the environment
            # Don't use UTC to avoid hiding that non-UTC timezones are not being converted as needed,
            # this can happen because UTC uses to be the default timezone in date parsers when no other
            # timezone is specified.
            local_env = os.environ.copy()
            local_env["TZ"] = 'Etc/GMT+2'
    
            subprocess.Popen(cmd,
                             env=local_env,
                             stdin=None,
                             stdout=output,
                             stderr=subprocess.STDOUT,
                             bufsize=0).wait()
    
        # List of errors to check in filebeat output logs
        errors = ["Error loading pipeline for fileset", "Cannot index event"]
        # Checks if the output of filebeat includes errors
        contains_error, error_line = file_contains(os.path.join(output_path, "output.log"), errors)
>       assert contains_error is False, "Error found in log:{}".format(error_line)
E       AssertionError: Error found in log:2021-02-09T16:20:17.543-0200	WARN	[elasticsearch]	elasticsearch/client.go:408	Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc000d277fb0fdf3b, ext:96420354, loc:(*time.Location)(0x60b8d60)}, Meta:{"pipeline":"filebeat-8.0.0-cisco-asa-asa-ftd-pipeline"}, Fields:{"agent":{"ephemeral_id":"f4ddf009-8b6b-4c80-b222-84c19ce0dba8","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"dataset":"cisco.asa","module":"cisco","timezone":"-02:00"},"fileset":{"name":"asa"},"input":{"type":"log"},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/cisco/asa/test/additional_messages.log"},"offset":4472},"message":"May  5 19:02:58 dev01: %ASA-6-302022: Built director stub TCP connection for fw1111:10.10.10.10/38540 (8.8.8.5/38540) to net:192.168.2.2/10051 (8.8.8.8/10051)","service":{"type":"cisco"},"tags":["cisco-asa","forwarded"]}, Private:file.State{Id:"native::5681854-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc00047cdd0), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/cisco/asa/test/additional_messages.log", Offset:4631, Timestamp:time.Time{wall:0xc000d277fad71465, ext:92698411, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56b2be, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse field [destination.port] of type [long] in document with id 'ShsFiHcBlK8jOxC9zBf4'. Preview of field's value: '10051 (8.8.8.8/10051)'","caused_by":{"type":"illegal_argument_exception","reason":"For input string: \"10051 (8.8.8.8/10051)\""}}
E         
E       assert True is False

../../filebeat/tests/system/test_modules.py:156: AssertionError

`Build&Test / x-pack/filebeat-build / test_fileset_file_280_google_workspace – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest`

Expand to view the error details

 AssertionError: Error found in log:2021-02-09T16:25:42.208-0200 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0x0, ext:63737247600, loc:(*time.Location)(nil)}, Meta:{"pipeline":"filebeat-8.0.0-google_workspace-login-common"}, Fields:{"agent":{"ephemeral_id":"e8a3477d-0641-4f95-af33-926eab4c0a3f","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"action":"suspicious_login","category":["authentication"],"dataset":"google_workspace.login","id":"1","module":"google_workspace","original":"{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"login\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"ownerDomain\":\"elastic.com\",\"ipAddress\":\"98.235.162.24\",\"events\":{\"type\":\"account_warning\",\"name\":\"suspicious_login\",\"parameters\":[{\"name\":\"affected_email_address\",\"value\":\"foo@elastic.co\"},{\"name\":\"login_timestamp\",\"intValue\":1593695305123456}]}}","provider":"login","start":"Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)","type":["info"]},"fileset":{"name":"login"},"google_workspace":{"actor":{"type":"USER"},"event":{"type":"account_warning"},"kind":"admin#reports#activity","login":{"affected_email_address":"foo@elastic.co"},"organization":{"domain":"elastic.com"}},"input":{"type":"log"},"json":{"actor":{},"events":{},"id":{"time":"2020-10-02T15:00:00Z"}},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/google_workspace/login/test/login-test.json.log"},"offset":406},"organization":{"id":"1"},"related":{"ip":["98.235.162.24"],"user":["foo"]},"service":{"type":"google_workspace"},"source":{"ip":"98.235.162.24","user":{"domain":"bar.com","email":"foo@bar.com","id":"1","name":"foo"}},"tags":["forwarded"]}, Private:file.State{Id:"native::5682513-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc0008a48f0), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/google_workspace/login/test/login-test.json.log", Offset:853, Timestamp:time.Time{wall:0xc000d2c931d9f350, ext:91170001, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56b551, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse field [event.start] of type [date] in document with id 'jBsKiHcBlK8jOxC9wRw3'. Preview of field's value: 'Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)'","caused_by":{"type":"illegal_argument_exception","reason":"failed to parse date field [Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)] with format [strict_date_optional_time||epoch_millis]","caused_by":{"type":"date_time_parse_exception","reason":"Failed to parse with all enclosed parsers"}}}    assert True is False

Expand to view the stacktrace

 a = (<test_xpack_modules.XPackTest testMethod=test_fileset_file_280_google_workspace>,)

    @wraps(func)
    def standalone_func(*a):
>       return func(*(a + p.args), **p.kwargs)

../../build/ve/docker/lib/python3.7/site-packages/parameterized/parameterized.py:518: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
../../filebeat/tests/system/test_modules.py:99: in test_fileset_file
    cfgfile=cfgfile)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

self = <test_xpack_modules.XPackTest testMethod=test_fileset_file_280_google_workspace>
module = 'google_workspace', fileset = 'login'
test_file = '/go/src/github.com/elastic/beats/x-pack/filebeat/module/google_workspace/login/test/login-test.json.log'
cfgfile = '/go/src/github.com/elastic/beats/x-pack/filebeat/build/system-tests/run/test_xpack_modules.XPackTest.test_fileset_file_280_google_workspace/filebeat.yml'

    def run_on_file(self, module, fileset, test_file, cfgfile):
        print("Testing {}/{} on {}".format(module, fileset, test_file))
    
        self.assert_explicit_ecs_version_set(module, fileset)
    
        try:
            self.es.indices.delete(index=self.index_name)
        except BaseException:
            pass
        self.wait_until(lambda: not self.es.indices.exists(self.index_name))
    
        cmd = [
            self.filebeat, "-systemTest",
            "-e", "-d", "*", "-once",
            "-c", cfgfile,
            "-E", "setup.ilm.enabled=false",
            "-modules={}".format(module),
            "-M", "{module}.*.enabled=false".format(module=module),
            "-M", "{module}.{fileset}.enabled=true".format(
                module=module, fileset=fileset),
            "-M", "{module}.{fileset}.var.input=file".format(
                module=module, fileset=fileset),
            "-M", "{module}.{fileset}.var.paths=[{test_file}]".format(
                module=module, fileset=fileset, test_file=test_file),
            "-M", "*.*.input.close_eof=true",
        ]
    
        # Based on the convention that if a name contains -json the json format is needed. Currently used for LS.
        if "-json" in test_file:
            cmd.append("-M")
            cmd.append("{module}.{fileset}.var.format=json".format(module=module, fileset=fileset))
    
        output_path = os.path.join(self.working_dir)
        # Runs inside a with block to ensure file is closed afterwards
        with open(os.path.join(output_path, "output.log"), "ab") as output:
            output.write(bytes(" ".join(cmd) + "\n", "utf-8"))
    
            # Use a fixed timezone so results don't vary depending on the environment
            # Don't use UTC to avoid hiding that non-UTC timezones are not being converted as needed,
            # this can happen because UTC uses to be the default timezone in date parsers when no other
            # timezone is specified.
            local_env = os.environ.copy()
            local_env["TZ"] = 'Etc/GMT+2'
    
            subprocess.Popen(cmd,
                             env=local_env,
                             stdin=None,
                             stdout=output,
                             stderr=subprocess.STDOUT,
                             bufsize=0).wait()
    
        # List of errors to check in filebeat output logs
        errors = ["Error loading pipeline for fileset", "Cannot index event"]
        # Checks if the output of filebeat includes errors
        contains_error, error_line = file_contains(os.path.join(output_path, "output.log"), errors)
>       assert contains_error is False, "Error found in log:{}".format(error_line)
E       AssertionError: Error found in log:2021-02-09T16:25:42.208-0200	WARN	[elasticsearch]	elasticsearch/client.go:408	Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0x0, ext:63737247600, loc:(*time.Location)(nil)}, Meta:{"pipeline":"filebeat-8.0.0-google_workspace-login-common"}, Fields:{"agent":{"ephemeral_id":"e8a3477d-0641-4f95-af33-926eab4c0a3f","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"action":"suspicious_login","category":["authentication"],"dataset":"google_workspace.login","id":"1","module":"google_workspace","original":"{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"login\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"ownerDomain\":\"elastic.com\",\"ipAddress\":\"98.235.162.24\",\"events\":{\"type\":\"account_warning\",\"name\":\"suspicious_login\",\"parameters\":[{\"name\":\"affected_email_address\",\"value\":\"foo@elastic.co\"},{\"name\":\"login_timestamp\",\"intValue\":1593695305123456}]}}","provider":"login","start":"Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)","type":["info"]},"fileset":{"name":"login"},"google_workspace":{"actor":{"type":"USER"},"event":{"type":"account_warning"},"kind":"admin#reports#activity","login":{"affected_email_address":"foo@elastic.co"},"organization":{"domain":"elastic.com"}},"input":{"type":"log"},"json":{"actor":{},"events":{},"id":{"time":"2020-10-02T15:00:00Z"}},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/google_workspace/login/test/login-test.json.log"},"offset":406},"organization":{"id":"1"},"related":{"ip":["98.235.162.24"],"user":["foo"]},"service":{"type":"google_workspace"},"source":{"ip":"98.235.162.24","user":{"domain":"bar.com","email":"foo@bar.com","id":"1","name":"foo"}},"tags":["forwarded"]}, Private:file.State{Id:"native::5682513-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc0008a48f0), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/google_workspace/login/test/login-test.json.log", Offset:853, Timestamp:time.Time{wall:0xc000d2c931d9f350, ext:91170001, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56b551, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse field [event.start] of type [date] in document with id 'jBsKiHcBlK8jOxC9wRw3'. Preview of field's value: 'Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)'","caused_by":{"type":"illegal_argument_exception","reason":"failed to parse date field [Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)] with format [strict_date_optional_time||epoch_millis]","caused_by":{"type":"date_time_parse_exception","reason":"Failed to parse with all enclosed parsers"}}}
E         
E       assert True is False

../../filebeat/tests/system/test_modules.py:156: AssertionError

Steps errors

Expand to view the steps failures

`filebeat-build - mage build test`

Took 18 min 59 sec . View more details on here
Description: mage build test

`filebeat-windows-8-windows-8 - mage build unitTest`

Took 5 min 9 sec . View more details on here
Description: mage build unitTest

`x-pack/filebeat-build - mage build test`

Took 31 min 23 sec . View more details on here
Description: mage build test

`Error signal`

Took 0 min 0 sec . View more details on here
Description: Error 'hudson.AbortException: script returned exit code 1'

Log output

Expand to view the last 100 lines of log output

[2021-02-09T18:26:23.104Z] ================== 6 failed, 300 passed in 1427.37s (0:23:47) ==================
[2021-02-09T18:26:23.104Z] >> python test: Integration Testing Complete
[2021-02-09T18:26:23.363Z] Error: running "/go/src/github.com/elastic/beats/build/ve/docker/bin/pytest --timeout=90 --durations=20 --junit-xml=build/TEST-python-integration.xml tests/system/test_filebeat_xpack.py tests/system/test_http_endpoint.py tests/system/test_xpack_modules.py" failed with exit code 1
[2021-02-09T18:26:26.651Z] Error: running "docker-compose -p filebeat_8_0_0_f23afb2a94-snapshot run -e DOCKER_COMPOSE_PROJECT_NAME=filebeat_8_0_0_f23afb2a94-snapshot -e BEAT_STRICT_PERMS=false -e STACK_ENVIRONMENT=snapshot -e TESTING_ENVIRONMENT=snapshot -e GOCACHE=/go/src/github.com/elastic/beats/build/docker-gocache -v /var/lib/jenkins/workspace/Beats_beats_PR-23944/pkg/mod/cache/download:/gocache:ro -e GOPROXY=file:///gocache,direct -e EXEC_UID=1161 -e EXEC_GID=1162 -e BEATS_INSIDE_INTEGRATION_TEST_ENV=true -e GOFLAGS=-mod=readonly -e TEST_COVERAGE=true -e RACE_DETECTOR=true -e TEST_TAGS=null,oracle beat /go/src/github.com/elastic/beats/x-pack/filebeat/build/mage-linux-amd64 pythonIntegTest" failed with exit code 1
[2021-02-09T18:26:27.097Z] Client: Docker Engine - Community
[2021-02-09T18:26:27.097Z]  Version:           20.10.3
[2021-02-09T18:26:27.097Z]  API version:       1.41
[2021-02-09T18:26:27.097Z]  Go version:        go1.13.15
[2021-02-09T18:26:27.097Z]  Git commit:        48d30b5
[2021-02-09T18:26:27.097Z]  Built:             Fri Jan 29 14:33:13 2021
[2021-02-09T18:26:27.097Z]  OS/Arch:           linux/amd64
[2021-02-09T18:26:27.097Z]  Context:           default
[2021-02-09T18:26:27.097Z]  Experimental:      true
[2021-02-09T18:26:27.097Z] 
[2021-02-09T18:26:27.097Z] Server: Docker Engine - Community
[2021-02-09T18:26:27.097Z]  Engine:
[2021-02-09T18:26:27.097Z]   Version:          20.10.3
[2021-02-09T18:26:27.097Z]   API version:      1.41 (minimum version 1.12)
[2021-02-09T18:26:27.097Z]   Go version:       go1.13.15
[2021-02-09T18:26:27.097Z]   Git commit:       46229ca
[2021-02-09T18:26:27.097Z]   Built:            Fri Jan 29 14:31:25 2021
[2021-02-09T18:26:27.097Z]   OS/Arch:          linux/amd64
[2021-02-09T18:26:27.097Z]   Experimental:     false
[2021-02-09T18:26:27.097Z]  containerd:
[2021-02-09T18:26:27.097Z]   Version:          1.4.3
[2021-02-09T18:26:27.097Z]   GitCommit:        269548fa27e0089a8b8278fc4fc781d7f65a939b
[2021-02-09T18:26:27.097Z]  runc:
[2021-02-09T18:26:27.097Z]   Version:          1.0.0-rc92
[2021-02-09T18:26:27.097Z]   GitCommit:        ff819c7e9184c13b7c2607fe6c30ae19403a7aff
[2021-02-09T18:26:27.097Z]  docker-init:
[2021-02-09T18:26:27.097Z]   Version:          0.19.0
[2021-02-09T18:26:27.097Z]   GitCommit:        de40ad0
[2021-02-09T18:26:27.097Z] Unable to find image 'alpine:3.4' locally
[2021-02-09T18:26:27.664Z] 3.4: Pulling from library/alpine
[2021-02-09T18:26:27.923Z] c1e54eec4b57: Pulling fs layer
[2021-02-09T18:26:28.180Z] c1e54eec4b57: Verifying Checksum
[2021-02-09T18:26:28.180Z] c1e54eec4b57: Download complete
[2021-02-09T18:26:28.439Z] c1e54eec4b57: Pull complete
[2021-02-09T18:26:28.439Z] Digest: sha256:b733d4a32c4da6a00a84df2ca32791bb03df95400243648d8c539e7b4cce329c
[2021-02-09T18:26:28.439Z] Status: Downloaded newer image for alpine:3.4
[2021-02-09T18:26:30.651Z] + python .ci/scripts/pre_archive_test.py
[2021-02-09T18:26:32.562Z] Copy ./x-pack/filebeat/build into build/x-pack/filebeat/build
[2021-02-09T18:26:32.586Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-23944/src/github.com/elastic/beats/build
[2021-02-09T18:26:32.926Z] + rm -rf ve
[2021-02-09T18:26:32.926Z] + find . -type d -name vendor -exec rm -r {} ;
[2021-02-09T18:26:32.951Z] Recording test results
[2021-02-09T18:26:34.267Z] [Checks API] No suitable checks publisher found.
[2021-02-09T18:26:34.588Z] + tar --version
[2021-02-09T18:26:34.936Z] + tar --exclude=test-build-artifacts-x-pack/filebeat-build.tgz -czf test-build-artifacts-x-pack/filebeat-build.tgz .
[2021-02-09T18:27:21.650Z] [INFO] Override default googleStorageUpload with some sleep
[2021-02-09T18:27:21.670Z] Sleeping for 35 sec
[2021-02-09T18:27:56.697Z] [Google Cloud Storage Plugin] Found 1 files to upload from pattern: test-build-artifacts-x-pack/filebeat-build.tgz
[2021-02-09T18:27:57.068Z] [Google Cloud Storage Plugin] Uploading: test-build-artifacts-x-pack/filebeat-build.tgz
[2021-02-09T18:28:08.734Z] + python .ci/scripts/search_system_tests.py
[2021-02-09T18:28:08.766Z] [INFO] system-tests='build/x-pack/filebeat/build/system-tests'. If no empty then let's create a tarball
[2021-02-09T18:28:09.126Z] + tar --version
[2021-02-09T18:28:09.496Z] + tar --exclude=x-pack-filebeat--system-tests-linux.tgz -czf x-pack-filebeat--system-tests-linux.tgz build/x-pack/filebeat/build/system-tests
[2021-02-09T18:28:36.086Z] [INFO] Override default googleStorageUpload with some sleep
[2021-02-09T18:28:36.108Z] Sleeping for 1 min 35 sec
[2021-02-09T18:30:11.132Z] [Google Cloud Storage Plugin] Found 1 files to upload from pattern: x-pack-filebeat--system-tests-linux.tgz
[2021-02-09T18:30:11.203Z] [Google Cloud Storage Plugin] Uploading: x-pack-filebeat--system-tests-linux.tgz
[2021-02-09T18:30:17.778Z] Client: Docker Engine - Community
[2021-02-09T18:30:17.778Z]  Version:           20.10.3
[2021-02-09T18:30:17.778Z]  API version:       1.41
[2021-02-09T18:30:17.778Z]  Go version:        go1.13.15
[2021-02-09T18:30:17.778Z]  Git commit:        48d30b5
[2021-02-09T18:30:17.778Z]  Built:             Fri Jan 29 14:33:13 2021
[2021-02-09T18:30:17.778Z]  OS/Arch:           linux/amd64
[2021-02-09T18:30:17.778Z]  Context:           default
[2021-02-09T18:30:17.778Z]  Experimental:      true
[2021-02-09T18:30:17.778Z] 
[2021-02-09T18:30:17.778Z] Server: Docker Engine - Community
[2021-02-09T18:30:17.778Z]  Engine:
[2021-02-09T18:30:17.778Z]   Version:          20.10.3
[2021-02-09T18:30:17.778Z]   API version:      1.41 (minimum version 1.12)
[2021-02-09T18:30:17.778Z]   Go version:       go1.13.15
[2021-02-09T18:30:17.778Z]   Git commit:       46229ca
[2021-02-09T18:30:17.778Z]   Built:            Fri Jan 29 14:31:25 2021
[2021-02-09T18:30:17.778Z]   OS/Arch:          linux/amd64
[2021-02-09T18:30:17.778Z]   Experimental:     false
[2021-02-09T18:30:17.778Z]  containerd:
[2021-02-09T18:30:17.778Z]   Version:          1.4.3
[2021-02-09T18:30:17.778Z]   GitCommit:        269548fa27e0089a8b8278fc4fc781d7f65a939b
[2021-02-09T18:30:17.778Z]  runc:
[2021-02-09T18:30:17.778Z]   Version:          1.0.0-rc92
[2021-02-09T18:30:17.778Z]   GitCommit:        ff819c7e9184c13b7c2607fe6c30ae19403a7aff
[2021-02-09T18:30:17.778Z]  docker-init:
[2021-02-09T18:30:17.778Z]   Version:          0.19.0
[2021-02-09T18:30:17.778Z]   GitCommit:        de40ad0
[2021-02-09T18:30:23.580Z] Failed in branch x-pack/filebeat-build
[2021-02-09T18:30:24.028Z] Stage "Packaging" skipped due to earlier failure(s)
[2021-02-09T18:30:24.133Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-23944/src/github.com/elastic/beats
[2021-02-09T18:30:25.150Z] Running on worker-395930 in /var/lib/jenkins/workspace/Beats_beats_PR-23944
[2021-02-09T18:30:25.255Z] [INFO] getVaultSecret: Getting secrets
[2021-02-09T18:30:25.344Z] Masking supported pattern matches of $VAULT_ADDR or $VAULT_ROLE_ID or $VAULT_SECRET_ID
[2021-02-09T18:30:27.418Z] + chmod 755 generate-build-data.sh
[2021-02-09T18:30:27.418Z] + ./generate-build-data.sh https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-23944/ https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-23944/runs/1 FAILURE 3167498
[2021-02-09T18:30:27.418Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-23944/runs/1/steps/?limit=10000 -o steps-info.json
[2021-02-09T18:30:28.875Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-23944/runs/1/tests/?status=FAILED -o tests-errors.json
[2021-02-09T18:30:30.331Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-23944/runs/1/log/ -o pipeline-log.txt

🐛 Flaky test report

❕ There are test failures but not known flaky tests.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	8
Passed	12992
Skipped	2033
Total	15033

Genuine test errors

💔 There are test failures but not known flaky tests, most likely a genuine test failure.

Name: Build&Test / filebeat-windows-8-windows-8 / test_syslog_with_udp – filebeat.tests.system.test_syslog.Test
Name: Build&Test / filebeat-build / test_fileset_file_023_kibana – filebeat.tests.system.test_modules.Test
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_043_zoom – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_045_zoom – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_067_sophos – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_128_gsuite – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_203_cisco – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest
Name: Build&Test / x-pack/filebeat-build / test_fileset_file_280_google_workspace – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest

andrewkroh added the Team:Security-External Integrations label

botelastic bot removed the needs_team label

Collaborator

elasticmachine commented Feb 9, 2021

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

This was referenced Feb 9, 2021

[Filebeat] Convert logstash logEvent.action objects to strings #23944

Merged

Cherry-pick #23944 to 7.x: [Filebeat] Convert logstash logEvent.action objects to strings #24063

Merged

botelastic bot commented Jan 27, 2022

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

botelastic bot added the Stalled label

botelastic bot closed this as completed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment