Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Filebeat] Enable journald input in releases #27351

Merged

Conversation

andrewkroh
Copy link
Member

@andrewkroh andrewkroh commented Aug 13, 2021

What does this PR do?

Enables reading journald from Filebeat.

Use the main-debian8 variant of golang-crossbuild to build Filebeat
packages for linux/amd64 and linux/368. Previously a debian7 image was
used, but debian7 does not have the systemd libraries needed for journald.

Debian 8 uses glibc 2.19 and debian 7 uses 2.13. We used debian7 because
the binaries produced worked on RHEL 6 which has glibc 2.12.

To ensure that the Filebeat binaries for linux/amd64 and linux/386 continue
to work on RHEL 6 the build process will check the glibc requirement to
ensure it is <=2.12.

To keep the linked glibc version compatible with RHEL 6 I had to upgrade to
github.com/dgraph-io/badger/v3 from v2. v3 removed a bunch of cgo usages which
reduced the need on various libc functions.

badger adopted golang/glog for logging. This library is adds global CLI
flags that conflict with Beats own logging CLI flags (like '-v'). This is
a common problem for glog (k8s encountered this). To address the problem
I forked golang/glog and made the flag.FlagSet used by the library configurable.

Why is it important?

Users can collect all their logs with Filebeat and do not need a separate Journalbeat.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
    - [ ] I have made corresponding change to the default configuration files
    - [ ] I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Follow up tasks

  • Add a journald test to beats-tester.

Related issues

Logs

>> testBinaryGLIBCVersion: "build/golang-crossbuild/filebeat-linux-amd64" requires glibc 2.3.2 or greater

@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Aug 13, 2021
@elasticmachine
Copy link
Collaborator

elasticmachine commented Aug 13, 2021

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2021-09-09T13:45:46.585+0000

  • Duration: 224 min 49 sec

  • Commit: 8ea8280

Test stats 🧪

Test Results
Failed 0
Passed 53908
Skipped 5324
Total 59232

Trends 🧪

Image of Build Times

Image of Tests

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test Results
Failed 0
Passed 53908
Skipped 5324
Total 59232

@andrewkroh andrewkroh force-pushed the feature/fb/enable-journald-input branch from 13f7302 to eb56fa6 Compare August 13, 2021 04:31
@andrewkroh andrewkroh force-pushed the feature/fb/enable-journald-input branch 4 times, most recently from 490d3af to ff25d00 Compare September 1, 2021 18:14
@andrewkroh andrewkroh changed the title [Draft] Test Linux binaries built on debian8 [Filebeat] Enable journald input in releases Sep 1, 2021
@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Sep 1, 2021
@andrewkroh andrewkroh marked this pull request as ready for review September 1, 2021 21:07
@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@elasticmachine
Copy link
Collaborator

Pinging @elastic/agent (Team:Agent)

@andrewkroh andrewkroh requested a review from a team September 1, 2021 21:10
@andrewkroh andrewkroh force-pushed the feature/fb/enable-journald-input branch 2 times, most recently from 76d76d2 to 5d52027 Compare September 2, 2021 16:21
@andrewkroh andrewkroh requested a review from kvch September 2, 2021 20:57
Use the main-debian8 variant of golang-crossbuilder to build Filebeat
packages for linux/amd64 and linux/368. Previously a debian7 image was
used, but debian7 does not have the systemd libraries needed for journald.

Debian 8 uses glibc 2.19 and debian 7 uses 2.13. We used debian7 because
the binaries produced worked on RHEL 6 which has glibc 2.12.

To ensure that the Filebeat binaries for linux/amd64 and linux/386 continue
to work on RHEL 6 the build process will check the glibc requirement to
ensure it is <=2.12.

To keep the linked glibc version compatible with RHEL 6 I had to upgrade to
github.com/dgraph-io/badger/v3 from v2. v3 removed a bunch of cgo usages which
reduced the need on various libc functions.

badger adopted golang/glog for logging. This library is adds global CLI
flags that conflict with Beats own logging CLI flags (like '-v'). This is
a common problem for glog (k8s encountered this). To address the problem
I forked golang/glog and made the flag.FlagSet used by the library configurable.
@andrewkroh andrewkroh force-pushed the feature/fb/enable-journald-input branch from 5d52027 to e0702a1 Compare September 3, 2021 18:28
@elastic elastic deleted a comment from mergify bot Sep 6, 2021
Copy link
Contributor

@adriansr adriansr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM just a couple of questions that I'm not sure of

dev-tools/mage/common.go Show resolved Hide resolved
filebeat/docs/inputs/input-journald.asciidoc Outdated Show resolved Hide resolved
go.mod Outdated Show resolved Hide resolved
Copy link
Contributor

@kvch kvch left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please move the fork of glog to elastic org.

@andrewkroh andrewkroh requested a review from kvch September 9, 2021 13:45
@andrewkroh
Copy link
Member Author

The fork has been moved to github.com/elastic/glog.

@andrewkroh andrewkroh merged commit 6b41742 into elastic:master Sep 9, 2021
andrewkroh added a commit that referenced this pull request Sep 9, 2021
Use the main-debian8 variant of golang-crossbuilder to build Filebeat
packages for linux/amd64 and linux/368. Previously a debian7 image was
used, but debian7 does not have the systemd libraries needed for journald.

Debian 8 uses glibc 2.19 and debian 7 uses 2.13. We used debian7 because
the binaries produced worked on RHEL 6 which has glibc 2.12.

To ensure that the Filebeat binaries for linux/amd64 and linux/386 continue
to work on RHEL 6 the build process will check the glibc requirement to
ensure it is <=2.12.

To keep the linked glibc version compatible with RHEL 6 I had to upgrade to
github.com/dgraph-io/badger/v3 from v2. v3 removed a bunch of cgo usages which
reduced the need on various libc functions.

badger adopted golang/glog for logging. This library is adds global CLI
flags that conflict with Beats own logging CLI flags (like '-v'). This is
a common problem for glog (k8s encountered this). To address the problem
I forked golang/glog and made the flag.FlagSet used by the library configurable.
andrewkroh added a commit that referenced this pull request Sep 10, 2021
Use the main-debian8 variant of golang-crossbuilder to build Filebeat
packages for linux/amd64 and linux/368. Previously a debian7 image was
used, but debian7 does not have the systemd libraries needed for journald.

Debian 8 uses glibc 2.19 and debian 7 uses 2.13. We used debian7 because
the binaries produced worked on RHEL 6 which has glibc 2.12.

To ensure that the Filebeat binaries for linux/amd64 and linux/386 continue
to work on RHEL 6 the build process will check the glibc requirement to
ensure it is <=2.12.

To keep the linked glibc version compatible with RHEL 6 I had to upgrade to
github.com/dgraph-io/badger/v3 from v2. v3 removed a bunch of cgo usages which
reduced the need on various libc functions.

badger adopted golang/glog for logging. This library is adds global CLI
flags that conflict with Beats own logging CLI flags (like '-v'). This is
a common problem for glog (k8s encountered this). To address the problem
I forked golang/glog and made the flag.FlagSet used by the library configurable.
andrewkroh added a commit that referenced this pull request Sep 13, 2021
Use the main-debian8 variant of golang-crossbuilder to build Filebeat
packages for linux/amd64 and linux/368. Previously a debian7 image was
used, but debian7 does not have the systemd libraries needed for journald.

Debian 8 uses glibc 2.19 and debian 7 uses 2.13. We used debian7 because
the binaries produced worked on RHEL 6 which has glibc 2.12.

To ensure that the Filebeat binaries for linux/amd64 and linux/386 continue
to work on RHEL 6 the build process will check the glibc requirement to
ensure it is <=2.12.

To keep the linked glibc version compatible with RHEL 6 I had to upgrade to
github.com/dgraph-io/badger/v3 from v2. v3 removed a bunch of cgo usages which
reduced the need on various libc functions.

badger adopted golang/glog for logging. This library is adds global CLI
flags that conflict with Beats own logging CLI flags (like '-v'). This is
a common problem for glog (k8s encountered this). To address the problem
I forked golang/glog and made the flag.FlagSet used by the library configurable.

Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>
@andresrc andresrc mentioned this pull request Oct 15, 2021
3 tasks
Icedroid pushed a commit to Icedroid/beats that referenced this pull request Nov 1, 2021
Use the main-debian8 variant of golang-crossbuilder to build Filebeat
packages for linux/amd64 and linux/368. Previously a debian7 image was
used, but debian7 does not have the systemd libraries needed for journald.

Debian 8 uses glibc 2.19 and debian 7 uses 2.13. We used debian7 because
the binaries produced worked on RHEL 6 which has glibc 2.12.

To ensure that the Filebeat binaries for linux/amd64 and linux/386 continue
to work on RHEL 6 the build process will check the glibc requirement to
ensure it is <=2.12.

To keep the linked glibc version compatible with RHEL 6 I had to upgrade to
github.com/dgraph-io/badger/v3 from v2. v3 removed a bunch of cgo usages which
reduced the need on various libc functions.

badger adopted golang/glog for logging. This library is adds global CLI
flags that conflict with Beats own logging CLI flags (like '-v'). This is
a common problem for glog (k8s encountered this). To address the problem
I forked golang/glog and made the flag.FlagSet used by the library configurable.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
7.16 candidate backport-v7.16.0 Automated backport with mergify enhancement Filebeat Filebeat :Packaging Team:Elastic-Agent Label for the Agent team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants