search

elastic / beats

:tropical_fish: Beats - Lightweight shippers for Elasticsearch & Logstash
https://www.elastic.co/products/beats
Other
96 stars 4.92k forks source link

[Filebeat][testing] Module tests don't check if indexing the event fails #23947

Closed andrewkroh closed 2 years ago

andrewkroh commented 3 years ago

The tests for Filebeat modules index events then check the result against a golden file. But the test itself won't fail if an event that it sends in a _bulk request fails to index. The tests should be checking for Cannot index event errors at https://github.com/elastic/beats/blob/cc8f8705ab082113db72064e37399bc81da570b1/filebeat/tests/system/test_modules.py#L153

I did a check and found several modules that have index errors with their test logs. Attaching the failures below in a comment:

andrewkroh commented 3 years ago

:broken_heart: Tests Failed

the below badges are clickable and redirect to their specific view in the CI or DOCS Pipeline View Test View Changes Artifacts preview

Expand to view the summary

#### Build stats * Build Cause: `Pull request #23944 opened` * Start Time: 2021-02-09T17:37:38.503+0000 * Duration: 53 min 47 sec * Commit: e8dbd9ccb4f67215236cb4b9b264624f210f914a #### Test stats :test_tube: | Test | Results | | ------------ | :-----------------------------: | | Failed | 8 | | Passed | 12992 | | Skipped | 2033 | | Total | 15033 | #### Trends :test_tube: ![Image of Build Times](https://beats-ci.elastic.co/job/Beats/job/beats/job/PR-23944/buildTimeGraph/png) ![Image of Tests](https://beats-ci.elastic.co/job/Beats/job/beats/job/PR-23944/1/testReport/history/countGraph/png?start=0&end=25)

Test errors 8

Expand to view the tests failures

##### `Build&Test / filebeat-windows-8-windows-8 / test_syslog_with_udp – filebeat.tests.system.test_syslog.Test`

    Expand to view the error details

    ``` AssertionError: assert "'su root' fa.../dev/pts/8 33" == "'su root' fa... /dev/pts/8 0" Skipping 33 identical leading characters in diff, use -v to show - dev/pts/8 0 ? ^ + dev/pts/8 33 ? ^^ ```

    Expand to view the stacktrace

    ``` self = def test_syslog_with_udp(self): """ Test syslog input with events from TCP. """ host = "127.0.0.1" port = 8080 input_raw = """ - type: syslog protocol: udp: host: "{}:{}" """ input_raw = input_raw.format(host, port) self.render_config_template( input_raw=input_raw, inputs=False, ) filebeat = self.start_beat() self.wait_until(lambda: self.log_contains("Started listening for UDP connection")) sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) # TCP for n in range(0, 50): m = "<13>Oct 11 22:14:15 wopr.mymachine.co postfix/smtpd[2000]:" \ " 'su root' failed for lonvick on /dev/pts/8 {}\n" m = m.format(n) sock.sendto(m.encode("utf-8"), (host, port)) self.wait_until(lambda: self.output_count(lambda x: x >= 1)) filebeat.check_kill_and_wait() sock.close() output = self.read_output() > self.assert_syslog(output[0]) tests\system\test_syslog.py:131: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ self = syslog = {'@metadata.beat': 'filebeat', '@metadata.truncated': False, '@metadata.type': '_doc', '@metadata.version': '8.0.0', ...} has_address = True def assert_syslog(self, syslog, has_address=True): assert syslog["event.severity"] == 5 assert syslog["hostname"] == "wopr.mymachine.co" assert syslog["input.type"] == "syslog" > assert syslog["message"] == "'su root' failed for lonvick on /dev/pts/8 0" E AssertionError: assert "'su root' fa.../dev/pts/8 33" == "'su root' fa... /dev/pts/8 0" E Skipping 33 identical leading characters in diff, use -v to show E - dev/pts/8 0 E ? ^ E + dev/pts/8 33 E ? ^^ tests\system\test_syslog.py:257: AssertionError ```

##### `Build&Test / filebeat-build / test_fileset_file_023_kibana – filebeat.tests.system.test_modules.Test`
    Expand to view the error details

    ``` AssertionError: Error found in log:2021-02-09T16:08:04.250-0200 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc000d1c09a23c6ec, ext:50766929, loc:(*time.Location)(0x3ee6880)}, Meta:{"pipeline":"filebeat-8.0.0-kibana-log-pipeline"}, Fields:{"agent":{"ephemeral_id":"c58c43bd-cedd-4b3d-9996-9c8a71ed5842","id":"fa4a978e-3df0-4bef-be7e-3135179423f2","name":"e5e617242853","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"dataset":"kibana.log","module":"kibana"},"fileset":{"name":"log"},"host":{"name":"e5e617242853"},"input":{"type":"log"},"json":{"@timestamp":"2018-05-09T10:59:00Z","message":"Initializing plugin xpack_main@6.3.0","pid":69776,"plugin":{"author":"Elastic","build":{"date":"Thu May 03 2018 09:49:27 GMT+0000 (UTC)","git":{"count":"17130","date":"Wed, 2 May 2018 22:40:22 -0500","sha":"88e269d"}},"dependencies":{"@elastic/eui":"0.0.38","@elastic/node-crypto":"0.1.2","@elastic/node-phantom-simple":"2.2.4","@elastic/numeral":"2.3.2","@kbn/datemath":"file:../packages/kbn-datemath","@kbn/ui-framework":"file:../packages/kbn-ui-framework","angular-paging":"2.2.1","angular-resource":"1.4.9","angular-sanitize":"1.4.9","angular-ui-ace":"0.2.3","angular-ui-bootstrap":"1.2.5","babel-core":"^6.26.0","babel-preset-es2015":"^6.24.1","babel-runtime":"^6.26.0","bluebird":"3.1.1","boom":"3.1.1","brace":"0.10.0","chrome-remote-interface":"0.24.2","classnames":"2.2.5","concat-stream":"1.5.1","d3":"3.5.6","d3-scale":"1.0.6","dedent":"^0.7.0","dragselect":"1.7.17","elasticsearch":"13.0.1","extract-zip":"1.5.0","font-awesome":"4.4.0","get-port":"2.1.0","getos":"^3.1.0","glob":"6.0.4","hapi-auth-cookie":"6.1.1","history":"4.7.2","humps":"2.0.1","icalendar":"0.7.1","isomorphic-fetch":"2.2.1","joi":"6.10.1","jquery":"^3.3.1","jstimezonedetect":"1.0.5","lodash":"3.10.1","lodash.mean":"^4.1.0","lodash.orderby":"4.6.0","mkdirp":"0.5.1","moment":"^2.20.1","moment-duration-format":"^1.3.0","moment-timezone":"^0.5.14","ngreact":"^0.5.1","object-hash":"1.2.0","path-match":"1.2.4","pdfmake":"0.1.33","pivotal-ui":"13.0.1","pluralize":"3.1.0","pngjs":"3.3.1","prop-types":"^15.6.0","puid":"1.0.5","react":"^16.2.0","react-clipboard.js":"^1.1.2","react-dom":"^16.2.0","react-markdown-renderer":"^1.4.0","react-portal":"^3.2.0","react-redux":"^5.0.5","react-router-breadcrumbs-hoc":"1.1.2","react-router-dom":"^4.2.2","react-select":"^1.2.1","react-sticky":"^6.0.1","react-syntax-highlighter":"^5.7.0","react-vis":"^1.8.1","redux":"3.7.2","redux-actions":"2.2.1","redux-thunk":"2.2.0","request":"^2.85.0","reselect":"3.0.1","rimraf":"^2.6.2","rison-node":"0.3.1","rxjs":"5.3.0","semver":"5.1.0","stream-to-observable":"0.2.0","styled-components":"2.3.2","tar-fs":"1.13.0","tinycolor2":"1.3.0","ui-select":"0.19.4","unbzip2-stream":"1.0.9","uuid":"3.0.1","venn.js":"0.2.9","webcola":"3.3.6","xregexp":"3.2.0"},"engines":{"yarn":"^1.6.0"},"kibana":{"build":{"intermediateBuildDirectory":"build/plugin/kibana/x-pack"},"version":"6.3.0"},"license":"Elastic-License","name":"x-pack","private":true,"version":"6.3.0"},"tags":["plugins","debug"],"type":"log"},"log":{"file":{"path":"/go/src/github.com/elastic/beats/filebeat/module/kibana/log/test/log.verbose.624.log"},"offset":7209},"service":{"type":"kibana"}}, Private:file.State{Id:"native::5976257-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc0004696c0), Source:"/go/src/github.com/elastic/beats/filebeat/module/kibana/log/test/log.verbose.624.log", Offset:9719, Timestamp:time.Time{wall:0xc000d1c099d68d58, ext:45705928, loc:(*time.Location)(0x3ee6880)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x5b30c1, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"illegal_argument_exception","reason":"can't merge a non object mapping [kibana.log.meta.plugin.dependencies.lodash] with an object mapping"} assert True is False ```

    Expand to view the stacktrace

    ``` a = (,) @wraps(func) def standalone_func(*a): > return func(*(a + p.args), **p.kwargs) ../build/ve/docker/lib/python3.7/site-packages/parameterized/parameterized.py:518: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ tests/system/test_modules.py:99: in test_fileset_file cfgfile=cfgfile) _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ self = module = 'kibana', fileset = 'log' test_file = '/go/src/github.com/elastic/beats/filebeat/module/kibana/log/test/log.verbose.624.log' cfgfile = '/go/src/github.com/elastic/beats/filebeat/build/system-tests/run/test_modules.Test.test_fileset_file_023_kibana/filebeat.yml' def run_on_file(self, module, fileset, test_file, cfgfile): print("Testing {}/{} on {}".format(module, fileset, test_file)) self.assert_explicit_ecs_version_set(module, fileset) try: self.es.indices.delete(index=self.index_name) except BaseException: pass self.wait_until(lambda: not self.es.indices.exists(self.index_name)) cmd = [ self.filebeat, "-systemTest", "-e", "-d", "*", "-once", "-c", cfgfile, "-E", "setup.ilm.enabled=false", "-modules={}".format(module), "-M", "{module}.*.enabled=false".format(module=module), "-M", "{module}.{fileset}.enabled=true".format( module=module, fileset=fileset), "-M", "{module}.{fileset}.var.input=file".format( module=module, fileset=fileset), "-M", "{module}.{fileset}.var.paths=[{test_file}]".format( module=module, fileset=fileset, test_file=test_file), "-M", "*.*.input.close_eof=true", ] # Based on the convention that if a name contains -json the json format is needed. Currently used for LS. if "-json" in test_file: cmd.append("-M") cmd.append("{module}.{fileset}.var.format=json".format(module=module, fileset=fileset)) output_path = os.path.join(self.working_dir) # Runs inside a with block to ensure file is closed afterwards with open(os.path.join(output_path, "output.log"), "ab") as output: output.write(bytes(" ".join(cmd) + "\n", "utf-8")) # Use a fixed timezone so results don't vary depending on the environment # Don't use UTC to avoid hiding that non-UTC timezones are not being converted as needed, # this can happen because UTC uses to be the default timezone in date parsers when no other # timezone is specified. local_env = os.environ.copy() local_env["TZ"] = 'Etc/GMT+2' subprocess.Popen(cmd, env=local_env, stdin=None, stdout=output, stderr=subprocess.STDOUT, bufsize=0).wait() # List of errors to check in filebeat output logs errors = ["Error loading pipeline for fileset", "Cannot index event"] # Checks if the output of filebeat includes errors contains_error, error_line = file_contains(os.path.join(output_path, "output.log"), errors) > assert contains_error is False, "Error found in log:{}".format(error_line) E AssertionError: Error found in log:2021-02-09T16:08:04.250-0200 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc000d1c09a23c6ec, ext:50766929, loc:(*time.Location)(0x3ee6880)}, Meta:{"pipeline":"filebeat-8.0.0-kibana-log-pipeline"}, Fields:{"agent":{"ephemeral_id":"c58c43bd-cedd-4b3d-9996-9c8a71ed5842","id":"fa4a978e-3df0-4bef-be7e-3135179423f2","name":"e5e617242853","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"dataset":"kibana.log","module":"kibana"},"fileset":{"name":"log"},"host":{"name":"e5e617242853"},"input":{"type":"log"},"json":{"@timestamp":"2018-05-09T10:59:00Z","message":"Initializing plugin xpack_main@6.3.0","pid":69776,"plugin":{"author":"Elastic","build":{"date":"Thu May 03 2018 09:49:27 GMT+0000 (UTC)","git":{"count":"17130","date":"Wed, 2 May 2018 22:40:22 -0500","sha":"88e269d"}},"dependencies":{"@elastic/eui":"0.0.38","@elastic/node-crypto":"0.1.2","@elastic/node-phantom-simple":"2.2.4","@elastic/numeral":"2.3.2","@kbn/datemath":"file:../packages/kbn-datemath","@kbn/ui-framework":"file:../packages/kbn-ui-framework","angular-paging":"2.2.1","angular-resource":"1.4.9","angular-sanitize":"1.4.9","angular-ui-ace":"0.2.3","angular-ui-bootstrap":"1.2.5","babel-core":"^6.26.0","babel-preset-es2015":"^6.24.1","babel-runtime":"^6.26.0","bluebird":"3.1.1","boom":"3.1.1","brace":"0.10.0","chrome-remote-interface":"0.24.2","classnames":"2.2.5","concat-stream":"1.5.1","d3":"3.5.6","d3-scale":"1.0.6","dedent":"^0.7.0","dragselect":"1.7.17","elasticsearch":"13.0.1","extract-zip":"1.5.0","font-awesome":"4.4.0","get-port":"2.1.0","getos":"^3.1.0","glob":"6.0.4","hapi-auth-cookie":"6.1.1","history":"4.7.2","humps":"2.0.1","icalendar":"0.7.1","isomorphic-fetch":"2.2.1","joi":"6.10.1","jquery":"^3.3.1","jstimezonedetect":"1.0.5","lodash":"3.10.1","lodash.mean":"^4.1.0","lodash.orderby":"4.6.0","mkdirp":"0.5.1","moment":"^2.20.1","moment-duration-format":"^1.3.0","moment-timezone":"^0.5.14","ngreact":"^0.5.1","object-hash":"1.2.0","path-match":"1.2.4","pdfmake":"0.1.33","pivotal-ui":"13.0.1","pluralize":"3.1.0","pngjs":"3.3.1","prop-types":"^15.6.0","puid":"1.0.5","react":"^16.2.0","react-clipboard.js":"^1.1.2","react-dom":"^16.2.0","react-markdown-renderer":"^1.4.0","react-portal":"^3.2.0","react-redux":"^5.0.5","react-router-breadcrumbs-hoc":"1.1.2","react-router-dom":"^4.2.2","react-select":"^1.2.1","react-sticky":"^6.0.1","react-syntax-highlighter":"^5.7.0","react-vis":"^1.8.1","redux":"3.7.2","redux-actions":"2.2.1","redux-thunk":"2.2.0","request":"^2.85.0","reselect":"3.0.1","rimraf":"^2.6.2","rison-node":"0.3.1","rxjs":"5.3.0","semver":"5.1.0","stream-to-observable":"0.2.0","styled-components":"2.3.2","tar-fs":"1.13.0","tinycolor2":"1.3.0","ui-select":"0.19.4","unbzip2-stream":"1.0.9","uuid":"3.0.1","venn.js":"0.2.9","webcola":"3.3.6","xregexp":"3.2.0"},"engines":{"yarn":"^1.6.0"},"kibana":{"build":{"intermediateBuildDirectory":"build/plugin/kibana/x-pack"},"version":"6.3.0"},"license":"Elastic-License","name":"x-pack","private":true,"version":"6.3.0"},"tags":["plugins","debug"],"type":"log"},"log":{"file":{"path":"/go/src/github.com/elastic/beats/filebeat/module/kibana/log/test/log.verbose.624.log"},"offset":7209},"service":{"type":"kibana"}}, Private:file.State{Id:"native::5976257-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc0004696c0), Source:"/go/src/github.com/elastic/beats/filebeat/module/kibana/log/test/log.verbose.624.log", Offset:9719, Timestamp:time.Time{wall:0xc000d1c099d68d58, ext:45705928, loc:(*time.Location)(0x3ee6880)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x5b30c1, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"illegal_argument_exception","reason":"can't merge a non object mapping [kibana.log.meta.plugin.dependencies.lodash] with an object mapping"} E E assert True is False tests/system/test_modules.py:156: AssertionError ```

##### `Build&Test / x-pack/filebeat-build / test_fileset_file_043_zoom – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest`
    Expand to view the error details

    ``` AssertionError: Error found in log:2021-02-09T16:07:24.521-0200 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc000d1b696b9c1be, ext:89628658, loc:(*time.Location)(0x60b8d60)}, Meta:{"pipeline":"filebeat-8.0.0-zoom-webhook-pipeline"}, Fields:{"agent":{"ephemeral_id":"cb239993-ad8a-4d55-9e20-bac36c1aeb05","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"dataset":"zoom.webhook","module":"zoom","timezone":"-02:00"},"fileset":{"name":"webhook"},"input":{"type":"log"},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/zoom/webhook/test/chat_channel.ndjson.log"},"offset":403},"message":"{\"event\":\"chat_channel.updated\",\"payload\":{\"account_id\":\"vbbvnvAdsfe\",\"operator\":\"somememai@gmtsffjdfhail.com\",\"operator_id\":\"z8dfgdfguQrdfgdf\",\"object\":{\"name\":\"Building Happy\",\"id\":\"6dfgdfgdg444447b0egga\",\"type\":1,\"date_time\":\"2020-02-10T21:59:05Z\",\"timestamp\":1581371945584}}}","service":{"type":"zoom"},"tags":["zoom-webhook","forwarded"],"zoom":{"event":"chat_channel.updated","payload":{"account_id":"vbbvnvAdsfe","object":{"date_time":"2020-02-10T21:59:05Z","id":"6dfgdfgdg444447b0egga","name":"Building Happy","timestamp":1581371945584,"type":1},"operator":"somememai@gmtsffjdfhail.com","operator_id":"z8dfgdfguQrdfgdf"}}}, Private:file.State{Id:"native::5680847-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc000f73110), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/zoom/webhook/test/chat_channel.ndjson.log", Offset:683, Timestamp:time.Time{wall:0xc000d1b696a93b5e, ext:88545700, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56aecf, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"illegal_argument_exception","reason":"field [members] not present as part of path [zoom.chat_channel.members]"} assert True is False ```

    Expand to view the stacktrace

    ``` a = (,) @wraps(func) def standalone_func(*a): > return func(*(a + p.args), **p.kwargs) ../../build/ve/docker/lib/python3.7/site-packages/parameterized/parameterized.py:518: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ../../filebeat/tests/system/test_modules.py:99: in test_fileset_file cfgfile=cfgfile) _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ self = module = 'zoom', fileset = 'webhook' test_file = '/go/src/github.com/elastic/beats/x-pack/filebeat/module/zoom/webhook/test/chat_channel.ndjson.log' cfgfile = '/go/src/github.com/elastic/beats/x-pack/filebeat/build/system-tests/run/test_xpack_modules.XPackTest.test_fileset_file_043_zoom/filebeat.yml' def run_on_file(self, module, fileset, test_file, cfgfile): print("Testing {}/{} on {}".format(module, fileset, test_file)) self.assert_explicit_ecs_version_set(module, fileset) try: self.es.indices.delete(index=self.index_name) except BaseException: pass self.wait_until(lambda: not self.es.indices.exists(self.index_name)) cmd = [ self.filebeat, "-systemTest", "-e", "-d", "*", "-once", "-c", cfgfile, "-E", "setup.ilm.enabled=false", "-modules={}".format(module), "-M", "{module}.*.enabled=false".format(module=module), "-M", "{module}.{fileset}.enabled=true".format( module=module, fileset=fileset), "-M", "{module}.{fileset}.var.input=file".format( module=module, fileset=fileset), "-M", "{module}.{fileset}.var.paths=[{test_file}]".format( module=module, fileset=fileset, test_file=test_file), "-M", "*.*.input.close_eof=true", ] # Based on the convention that if a name contains -json the json format is needed. Currently used for LS. if "-json" in test_file: cmd.append("-M") cmd.append("{module}.{fileset}.var.format=json".format(module=module, fileset=fileset)) output_path = os.path.join(self.working_dir) # Runs inside a with block to ensure file is closed afterwards with open(os.path.join(output_path, "output.log"), "ab") as output: output.write(bytes(" ".join(cmd) + "\n", "utf-8")) # Use a fixed timezone so results don't vary depending on the environment # Don't use UTC to avoid hiding that non-UTC timezones are not being converted as needed, # this can happen because UTC uses to be the default timezone in date parsers when no other # timezone is specified. local_env = os.environ.copy() local_env["TZ"] = 'Etc/GMT+2' subprocess.Popen(cmd, env=local_env, stdin=None, stdout=output, stderr=subprocess.STDOUT, bufsize=0).wait() # List of errors to check in filebeat output logs errors = ["Error loading pipeline for fileset", "Cannot index event"] # Checks if the output of filebeat includes errors contains_error, error_line = file_contains(os.path.join(output_path, "output.log"), errors) > assert contains_error is False, "Error found in log:{}".format(error_line) E AssertionError: Error found in log:2021-02-09T16:07:24.521-0200 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc000d1b696b9c1be, ext:89628658, loc:(*time.Location)(0x60b8d60)}, Meta:{"pipeline":"filebeat-8.0.0-zoom-webhook-pipeline"}, Fields:{"agent":{"ephemeral_id":"cb239993-ad8a-4d55-9e20-bac36c1aeb05","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"dataset":"zoom.webhook","module":"zoom","timezone":"-02:00"},"fileset":{"name":"webhook"},"input":{"type":"log"},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/zoom/webhook/test/chat_channel.ndjson.log"},"offset":403},"message":"{\"event\":\"chat_channel.updated\",\"payload\":{\"account_id\":\"vbbvnvAdsfe\",\"operator\":\"somememai@gmtsffjdfhail.com\",\"operator_id\":\"z8dfgdfguQrdfgdf\",\"object\":{\"name\":\"Building Happy\",\"id\":\"6dfgdfgdg444447b0egga\",\"type\":1,\"date_time\":\"2020-02-10T21:59:05Z\",\"timestamp\":1581371945584}}}","service":{"type":"zoom"},"tags":["zoom-webhook","forwarded"],"zoom":{"event":"chat_channel.updated","payload":{"account_id":"vbbvnvAdsfe","object":{"date_time":"2020-02-10T21:59:05Z","id":"6dfgdfgdg444447b0egga","name":"Building Happy","timestamp":1581371945584,"type":1},"operator":"somememai@gmtsffjdfhail.com","operator_id":"z8dfgdfguQrdfgdf"}}}, Private:file.State{Id:"native::5680847-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc000f73110), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/zoom/webhook/test/chat_channel.ndjson.log", Offset:683, Timestamp:time.Time{wall:0xc000d1b696a93b5e, ext:88545700, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56aecf, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"illegal_argument_exception","reason":"field [members] not present as part of path [zoom.chat_channel.members]"} E E assert True is False ../../filebeat/tests/system/test_modules.py:156: AssertionError ```

##### `Build&Test / x-pack/filebeat-build / test_fileset_file_045_zoom – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest`
    Expand to view the error details

    ``` AssertionError: Error found in log:2021-02-09T16:07:31.149-0200 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc000d1b86487c9ad, ext:90284976, loc:(*time.Location)(0x60b8d60)}, Meta:{"pipeline":"filebeat-8.0.0-zoom-webhook-pipeline"}, Fields:{"agent":{"ephemeral_id":"ba2e4fb4-9d49-4ef8-b40b-63040cd3648a","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"dataset":"zoom.webhook","module":"zoom","timezone":"-02:00"},"fileset":{"name":"webhook"},"input":{"type":"log"},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/zoom/webhook/test/recording.ndjson.log"},"offset":0},"message":"{\"event\":\"recording.started\",\"payload\":{\"account_id\":\"lAAAAAAAAAAAAA\",\"object\":{\"uuid\":\"dj12vck6sdTn6yy7qdy3dQg==\",\"id\":150000008,\"host_id\":\"uLobbbbbbbbbb_qQsQ\",\"topic\":\"A test meeting\",\"type\":2,\"start_time\":\"2019-07-11T20:00:00Z\",\"duration\":1,\"timezone\":\"America/Los_Angeles\",\"recording_file\":{\"recording_start\":\"2019-07-31T22:41:02Z\",\"recording_end\":\"\"}}}}","service":{"type":"zoom"},"tags":["zoom-webhook","forwarded"],"zoom":{"event":"recording.started","payload":{"account_id":"lAAAAAAAAAAAAA","object":{"duration":1,"host_id":"uLobbbbbbbbbb_qQsQ","id":150000008,"recording_file":{"recording_end":"","recording_start":"2019-07-31T22:41:02Z"},"start_time":"2019-07-11T20:00:00Z","timezone":"America/Los_Angeles","topic":"A test meeting","type":2,"uuid":"dj12vck6sdTn6yy7qdy3dQg=="}}}}, Private:file.State{Id:"native::5680853-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc00080d040), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/zoom/webhook/test/recording.ndjson.log", Offset:359, Timestamp:time.Time{wall:0xc000d1b8647cb231, ext:89558078, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56aed5, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse field [zoom.recording.recording_file.recording_end] of type [date] in document with id '1Rr6h3cBlK8jOxC9G9E9'. Preview of field's value: ''","caused_by":{"type":"illegal_argument_exception","reason":"cannot parse empty date"}} assert True is False ```

    Expand to view the stacktrace

    ``` a = (,) @wraps(func) def standalone_func(*a): > return func(*(a + p.args), **p.kwargs) ../../build/ve/docker/lib/python3.7/site-packages/parameterized/parameterized.py:518: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ../../filebeat/tests/system/test_modules.py:99: in test_fileset_file cfgfile=cfgfile) _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ self = module = 'zoom', fileset = 'webhook' test_file = '/go/src/github.com/elastic/beats/x-pack/filebeat/module/zoom/webhook/test/recording.ndjson.log' cfgfile = '/go/src/github.com/elastic/beats/x-pack/filebeat/build/system-tests/run/test_xpack_modules.XPackTest.test_fileset_file_045_zoom/filebeat.yml' def run_on_file(self, module, fileset, test_file, cfgfile): print("Testing {}/{} on {}".format(module, fileset, test_file)) self.assert_explicit_ecs_version_set(module, fileset) try: self.es.indices.delete(index=self.index_name) except BaseException: pass self.wait_until(lambda: not self.es.indices.exists(self.index_name)) cmd = [ self.filebeat, "-systemTest", "-e", "-d", "*", "-once", "-c", cfgfile, "-E", "setup.ilm.enabled=false", "-modules={}".format(module), "-M", "{module}.*.enabled=false".format(module=module), "-M", "{module}.{fileset}.enabled=true".format( module=module, fileset=fileset), "-M", "{module}.{fileset}.var.input=file".format( module=module, fileset=fileset), "-M", "{module}.{fileset}.var.paths=[{test_file}]".format( module=module, fileset=fileset, test_file=test_file), "-M", "*.*.input.close_eof=true", ] # Based on the convention that if a name contains -json the json format is needed. Currently used for LS. if "-json" in test_file: cmd.append("-M") cmd.append("{module}.{fileset}.var.format=json".format(module=module, fileset=fileset)) output_path = os.path.join(self.working_dir) # Runs inside a with block to ensure file is closed afterwards with open(os.path.join(output_path, "output.log"), "ab") as output: output.write(bytes(" ".join(cmd) + "\n", "utf-8")) # Use a fixed timezone so results don't vary depending on the environment # Don't use UTC to avoid hiding that non-UTC timezones are not being converted as needed, # this can happen because UTC uses to be the default timezone in date parsers when no other # timezone is specified. local_env = os.environ.copy() local_env["TZ"] = 'Etc/GMT+2' subprocess.Popen(cmd, env=local_env, stdin=None, stdout=output, stderr=subprocess.STDOUT, bufsize=0).wait() # List of errors to check in filebeat output logs errors = ["Error loading pipeline for fileset", "Cannot index event"] # Checks if the output of filebeat includes errors contains_error, error_line = file_contains(os.path.join(output_path, "output.log"), errors) > assert contains_error is False, "Error found in log:{}".format(error_line) E AssertionError: Error found in log:2021-02-09T16:07:31.149-0200 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc000d1b86487c9ad, ext:90284976, loc:(*time.Location)(0x60b8d60)}, Meta:{"pipeline":"filebeat-8.0.0-zoom-webhook-pipeline"}, Fields:{"agent":{"ephemeral_id":"ba2e4fb4-9d49-4ef8-b40b-63040cd3648a","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"dataset":"zoom.webhook","module":"zoom","timezone":"-02:00"},"fileset":{"name":"webhook"},"input":{"type":"log"},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/zoom/webhook/test/recording.ndjson.log"},"offset":0},"message":"{\"event\":\"recording.started\",\"payload\":{\"account_id\":\"lAAAAAAAAAAAAA\",\"object\":{\"uuid\":\"dj12vck6sdTn6yy7qdy3dQg==\",\"id\":150000008,\"host_id\":\"uLobbbbbbbbbb_qQsQ\",\"topic\":\"A test meeting\",\"type\":2,\"start_time\":\"2019-07-11T20:00:00Z\",\"duration\":1,\"timezone\":\"America/Los_Angeles\",\"recording_file\":{\"recording_start\":\"2019-07-31T22:41:02Z\",\"recording_end\":\"\"}}}}","service":{"type":"zoom"},"tags":["zoom-webhook","forwarded"],"zoom":{"event":"recording.started","payload":{"account_id":"lAAAAAAAAAAAAA","object":{"duration":1,"host_id":"uLobbbbbbbbbb_qQsQ","id":150000008,"recording_file":{"recording_end":"","recording_start":"2019-07-31T22:41:02Z"},"start_time":"2019-07-11T20:00:00Z","timezone":"America/Los_Angeles","topic":"A test meeting","type":2,"uuid":"dj12vck6sdTn6yy7qdy3dQg=="}}}}, Private:file.State{Id:"native::5680853-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc00080d040), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/zoom/webhook/test/recording.ndjson.log", Offset:359, Timestamp:time.Time{wall:0xc000d1b8647cb231, ext:89558078, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56aed5, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse field [zoom.recording.recording_file.recording_end] of type [date] in document with id '1Rr6h3cBlK8jOxC9G9E9'. Preview of field's value: ''","caused_by":{"type":"illegal_argument_exception","reason":"cannot parse empty date"}} E E assert True is False ../../filebeat/tests/system/test_modules.py:156: AssertionError ```

##### `Build&Test / x-pack/filebeat-build / test_fileset_file_067_sophos – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest`
    Expand to view the error details

    ``` AssertionError: Error found in log:2021-02-09T16:09:33.909-0200 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc000d1d6e57b3e46, ext:92746046, loc:(*time.Location)(0x60b8d60)}, Meta:{"pipeline":"filebeat-8.0.0-sophos-xg-pipeline"}, Fields:{"_conf":{"default":"firewall.localgroup.local","mappings":[{"hostname":"my_fancy_host","serial":"1234567890123456"},{"hostname":"some_other_host.local","serial":"1234567890123457"}]},"agent":{"ephemeral_id":"ff582fcd-f7d4-4748-979e-0c7c68f93808","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"dataset":"sophos.xg","module":"sophos","timezone":"-02:00"},"fileset":{"name":"xg"},"host":{"name":"9911684e5ade"},"input":{"type":"log"},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/sophos/xg/test/event.log"},"offset":4674},"message":"\u003c30\u003edevice=\"SFW\" date=2020-05-18 time=14:39:07 timezone=\"CEST\" device_name=\"XG230\" device_id=1234567890123457 log_id=062009617502 log_type=\"Event\" log_component=\"GUI\" log_subtype=\"Admin\" status=\"Successful\" priority=Information user_name=\"admin\" src_ip=10.83.234.5 SysLog_SERVER_NAME='Logstash' message=\"SysLog Server 'Logstash' settings were changed by 'admin' from '10.83.234.5' using 'GUI'\"","service":{"type":"sophos"},"tags":["sophos-xg","forwarded"]}, Private:file.State{Id:"native::5680954-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc000735d40), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/sophos/xg/test/event.log", Offset:5069, Timestamp:time.Time{wall:0xc000d1d6e558bafd, ext:90484202, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56af3a, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse field [source.ip] of type [ip] in document with id '6Rr7h3cBlK8jOxC9-tPF'. Preview of field's value: '10.83.234.5 SysLog_SERVER_NAME='Logstash''","caused_by":{"type":"illegal_argument_exception","reason":"'10.83.234.5 SysLog_SERVER_NAME='Logstash'' is not an IP string literal."}} assert True is False ```

    Expand to view the stacktrace

    ``` a = (,) @wraps(func) def standalone_func(*a): > return func(*(a + p.args), **p.kwargs) ../../build/ve/docker/lib/python3.7/site-packages/parameterized/parameterized.py:518: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ../../filebeat/tests/system/test_modules.py:99: in test_fileset_file cfgfile=cfgfile) _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ self = module = 'sophos', fileset = 'xg' test_file = '/go/src/github.com/elastic/beats/x-pack/filebeat/module/sophos/xg/test/event.log' cfgfile = '/go/src/github.com/elastic/beats/x-pack/filebeat/build/system-tests/run/test_xpack_modules.XPackTest.test_fileset_file_067_sophos/filebeat.yml' def run_on_file(self, module, fileset, test_file, cfgfile): print("Testing {}/{} on {}".format(module, fileset, test_file)) self.assert_explicit_ecs_version_set(module, fileset) try: self.es.indices.delete(index=self.index_name) except BaseException: pass self.wait_until(lambda: not self.es.indices.exists(self.index_name)) cmd = [ self.filebeat, "-systemTest", "-e", "-d", "*", "-once", "-c", cfgfile, "-E", "setup.ilm.enabled=false", "-modules={}".format(module), "-M", "{module}.*.enabled=false".format(module=module), "-M", "{module}.{fileset}.enabled=true".format( module=module, fileset=fileset), "-M", "{module}.{fileset}.var.input=file".format( module=module, fileset=fileset), "-M", "{module}.{fileset}.var.paths=[{test_file}]".format( module=module, fileset=fileset, test_file=test_file), "-M", "*.*.input.close_eof=true", ] # Based on the convention that if a name contains -json the json format is needed. Currently used for LS. if "-json" in test_file: cmd.append("-M") cmd.append("{module}.{fileset}.var.format=json".format(module=module, fileset=fileset)) output_path = os.path.join(self.working_dir) # Runs inside a with block to ensure file is closed afterwards with open(os.path.join(output_path, "output.log"), "ab") as output: output.write(bytes(" ".join(cmd) + "\n", "utf-8")) # Use a fixed timezone so results don't vary depending on the environment # Don't use UTC to avoid hiding that non-UTC timezones are not being converted as needed, # this can happen because UTC uses to be the default timezone in date parsers when no other # timezone is specified. local_env = os.environ.copy() local_env["TZ"] = 'Etc/GMT+2' subprocess.Popen(cmd, env=local_env, stdin=None, stdout=output, stderr=subprocess.STDOUT, bufsize=0).wait() # List of errors to check in filebeat output logs errors = ["Error loading pipeline for fileset", "Cannot index event"] # Checks if the output of filebeat includes errors contains_error, error_line = file_contains(os.path.join(output_path, "output.log"), errors) > assert contains_error is False, "Error found in log:{}".format(error_line) E AssertionError: Error found in log:2021-02-09T16:09:33.909-0200 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc000d1d6e57b3e46, ext:92746046, loc:(*time.Location)(0x60b8d60)}, Meta:{"pipeline":"filebeat-8.0.0-sophos-xg-pipeline"}, Fields:{"_conf":{"default":"firewall.localgroup.local","mappings":[{"hostname":"my_fancy_host","serial":"1234567890123456"},{"hostname":"some_other_host.local","serial":"1234567890123457"}]},"agent":{"ephemeral_id":"ff582fcd-f7d4-4748-979e-0c7c68f93808","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"dataset":"sophos.xg","module":"sophos","timezone":"-02:00"},"fileset":{"name":"xg"},"host":{"name":"9911684e5ade"},"input":{"type":"log"},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/sophos/xg/test/event.log"},"offset":4674},"message":"\u003c30\u003edevice=\"SFW\" date=2020-05-18 time=14:39:07 timezone=\"CEST\" device_name=\"XG230\" device_id=1234567890123457 log_id=062009617502 log_type=\"Event\" log_component=\"GUI\" log_subtype=\"Admin\" status=\"Successful\" priority=Information user_name=\"admin\" src_ip=10.83.234.5 SysLog_SERVER_NAME='Logstash' message=\"SysLog Server 'Logstash' settings were changed by 'admin' from '10.83.234.5' using 'GUI'\"","service":{"type":"sophos"},"tags":["sophos-xg","forwarded"]}, Private:file.State{Id:"native::5680954-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc000735d40), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/sophos/xg/test/event.log", Offset:5069, Timestamp:time.Time{wall:0xc000d1d6e558bafd, ext:90484202, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56af3a, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse field [source.ip] of type [ip] in document with id '6Rr7h3cBlK8jOxC9-tPF'. Preview of field's value: '10.83.234.5 SysLog_SERVER_NAME='Logstash''","caused_by":{"type":"illegal_argument_exception","reason":"'10.83.234.5 SysLog_SERVER_NAME='Logstash'' is not an IP string literal."}} E E assert True is False ../../filebeat/tests/system/test_modules.py:156: AssertionError ```

##### `Build&Test / x-pack/filebeat-build / test_fileset_file_128_gsuite – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest`
    Expand to view the error details

    ``` AssertionError: Error found in log:2021-02-09T16:15:37.553-0200 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0x0, ext:63737247600, loc:(*time.Location)(nil)}, Meta:{"pipeline":"filebeat-8.0.0-gsuite-login-common"}, Fields:{"agent":{"ephemeral_id":"d25863e1-9578-4a3f-8bb2-2d1a2667c80d","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"action":"suspicious_login","category":["authentication"],"dataset":"gsuite.login","id":"1","module":"gsuite","original":"{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"login\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"ownerDomain\":\"elastic.com\",\"ipAddress\":\"98.235.162.24\",\"events\":{\"type\":\"account_warning\",\"name\":\"suspicious_login\",\"parameters\":[{\"name\":\"affected_email_address\",\"value\":\"foo@elastic.co\"},{\"name\":\"login_timestamp\",\"intValue\":1593695305123456}]}}","provider":"login","start":"Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)","type":["info"]},"fileset":{"name":"login"},"gsuite":{"actor":{"type":"USER"},"event":{"type":"account_warning"},"kind":"admin#reports#activity","login":{"affected_email_address":"foo@elastic.co"},"organization":{"domain":"elastic.com"}},"input":{"type":"log"},"json":{"actor":{},"events":{},"id":{"time":"2020-10-02T15:00:00Z"}},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/gsuite/login/test/gsuite-login-test.json.log"},"offset":406},"organization":{"id":"1"},"related":{"ip":["98.235.162.24"],"user":["foo"]},"service":{"type":"gsuite"},"source":{"ip":"98.235.162.24","user":{"domain":"bar.com","email":"foo@bar.com","id":"1","name":"foo"}},"tags":["forwarded"]}, Private:file.State{Id:"native::5681427-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc0009489c0), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/gsuite/login/test/gsuite-login-test.json.log", Offset:853, Timestamp:time.Time{wall:0xc000d2320c49cbbe, ext:88748748, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56b113, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse field [event.start] of type [date] in document with id 'cxsBiHcBlK8jOxC9hxNH'. Preview of field's value: 'Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)'","caused_by":{"type":"illegal_argument_exception","reason":"failed to parse date field [Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)] with format [strict_date_optional_time||epoch_millis]","caused_by":{"type":"date_time_parse_exception","reason":"Failed to parse with all enclosed parsers"}}} assert True is False ```

    Expand to view the stacktrace

    ``` a = (,) @wraps(func) def standalone_func(*a): > return func(*(a + p.args), **p.kwargs) ../../build/ve/docker/lib/python3.7/site-packages/parameterized/parameterized.py:518: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ../../filebeat/tests/system/test_modules.py:99: in test_fileset_file cfgfile=cfgfile) _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ self = module = 'gsuite', fileset = 'login' test_file = '/go/src/github.com/elastic/beats/x-pack/filebeat/module/gsuite/login/test/gsuite-login-test.json.log' cfgfile = '/go/src/github.com/elastic/beats/x-pack/filebeat/build/system-tests/run/test_xpack_modules.XPackTest.test_fileset_file_128_gsuite/filebeat.yml' def run_on_file(self, module, fileset, test_file, cfgfile): print("Testing {}/{} on {}".format(module, fileset, test_file)) self.assert_explicit_ecs_version_set(module, fileset) try: self.es.indices.delete(index=self.index_name) except BaseException: pass self.wait_until(lambda: not self.es.indices.exists(self.index_name)) cmd = [ self.filebeat, "-systemTest", "-e", "-d", "*", "-once", "-c", cfgfile, "-E", "setup.ilm.enabled=false", "-modules={}".format(module), "-M", "{module}.*.enabled=false".format(module=module), "-M", "{module}.{fileset}.enabled=true".format( module=module, fileset=fileset), "-M", "{module}.{fileset}.var.input=file".format( module=module, fileset=fileset), "-M", "{module}.{fileset}.var.paths=[{test_file}]".format( module=module, fileset=fileset, test_file=test_file), "-M", "*.*.input.close_eof=true", ] # Based on the convention that if a name contains -json the json format is needed. Currently used for LS. if "-json" in test_file: cmd.append("-M") cmd.append("{module}.{fileset}.var.format=json".format(module=module, fileset=fileset)) output_path = os.path.join(self.working_dir) # Runs inside a with block to ensure file is closed afterwards with open(os.path.join(output_path, "output.log"), "ab") as output: output.write(bytes(" ".join(cmd) + "\n", "utf-8")) # Use a fixed timezone so results don't vary depending on the environment # Don't use UTC to avoid hiding that non-UTC timezones are not being converted as needed, # this can happen because UTC uses to be the default timezone in date parsers when no other # timezone is specified. local_env = os.environ.copy() local_env["TZ"] = 'Etc/GMT+2' subprocess.Popen(cmd, env=local_env, stdin=None, stdout=output, stderr=subprocess.STDOUT, bufsize=0).wait() # List of errors to check in filebeat output logs errors = ["Error loading pipeline for fileset", "Cannot index event"] # Checks if the output of filebeat includes errors contains_error, error_line = file_contains(os.path.join(output_path, "output.log"), errors) > assert contains_error is False, "Error found in log:{}".format(error_line) E AssertionError: Error found in log:2021-02-09T16:15:37.553-0200 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0x0, ext:63737247600, loc:(*time.Location)(nil)}, Meta:{"pipeline":"filebeat-8.0.0-gsuite-login-common"}, Fields:{"agent":{"ephemeral_id":"d25863e1-9578-4a3f-8bb2-2d1a2667c80d","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"action":"suspicious_login","category":["authentication"],"dataset":"gsuite.login","id":"1","module":"gsuite","original":"{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"login\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"ownerDomain\":\"elastic.com\",\"ipAddress\":\"98.235.162.24\",\"events\":{\"type\":\"account_warning\",\"name\":\"suspicious_login\",\"parameters\":[{\"name\":\"affected_email_address\",\"value\":\"foo@elastic.co\"},{\"name\":\"login_timestamp\",\"intValue\":1593695305123456}]}}","provider":"login","start":"Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)","type":["info"]},"fileset":{"name":"login"},"gsuite":{"actor":{"type":"USER"},"event":{"type":"account_warning"},"kind":"admin#reports#activity","login":{"affected_email_address":"foo@elastic.co"},"organization":{"domain":"elastic.com"}},"input":{"type":"log"},"json":{"actor":{},"events":{},"id":{"time":"2020-10-02T15:00:00Z"}},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/gsuite/login/test/gsuite-login-test.json.log"},"offset":406},"organization":{"id":"1"},"related":{"ip":["98.235.162.24"],"user":["foo"]},"service":{"type":"gsuite"},"source":{"ip":"98.235.162.24","user":{"domain":"bar.com","email":"foo@bar.com","id":"1","name":"foo"}},"tags":["forwarded"]}, Private:file.State{Id:"native::5681427-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc0009489c0), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/gsuite/login/test/gsuite-login-test.json.log", Offset:853, Timestamp:time.Time{wall:0xc000d2320c49cbbe, ext:88748748, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56b113, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse field [event.start] of type [date] in document with id 'cxsBiHcBlK8jOxC9hxNH'. Preview of field's value: 'Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)'","caused_by":{"type":"illegal_argument_exception","reason":"failed to parse date field [Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)] with format [strict_date_optional_time||epoch_millis]","caused_by":{"type":"date_time_parse_exception","reason":"Failed to parse with all enclosed parsers"}}} E E assert True is False ../../filebeat/tests/system/test_modules.py:156: AssertionError ```

##### `Build&Test / x-pack/filebeat-build / test_fileset_file_203_cisco – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest`
    Expand to view the error details

    ``` AssertionError: Error found in log:2021-02-09T16:20:17.543-0200 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc000d277fb0fdf3b, ext:96420354, loc:(*time.Location)(0x60b8d60)}, Meta:{"pipeline":"filebeat-8.0.0-cisco-asa-asa-ftd-pipeline"}, Fields:{"agent":{"ephemeral_id":"f4ddf009-8b6b-4c80-b222-84c19ce0dba8","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"dataset":"cisco.asa","module":"cisco","timezone":"-02:00"},"fileset":{"name":"asa"},"input":{"type":"log"},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/cisco/asa/test/additional_messages.log"},"offset":4472},"message":"May 5 19:02:58 dev01: %ASA-6-302022: Built director stub TCP connection for fw1111:10.10.10.10/38540 (8.8.8.5/38540) to net:192.168.2.2/10051 (8.8.8.8/10051)","service":{"type":"cisco"},"tags":["cisco-asa","forwarded"]}, Private:file.State{Id:"native::5681854-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc00047cdd0), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/cisco/asa/test/additional_messages.log", Offset:4631, Timestamp:time.Time{wall:0xc000d277fad71465, ext:92698411, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56b2be, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse field [destination.port] of type [long] in document with id 'ShsFiHcBlK8jOxC9zBf4'. Preview of field's value: '10051 (8.8.8.8/10051)'","caused_by":{"type":"illegal_argument_exception","reason":"For input string: \"10051 (8.8.8.8/10051)\""}} assert True is False ```

    Expand to view the stacktrace

    ``` a = (,) @wraps(func) def standalone_func(*a): > return func(*(a + p.args), **p.kwargs) ../../build/ve/docker/lib/python3.7/site-packages/parameterized/parameterized.py:518: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ../../filebeat/tests/system/test_modules.py:99: in test_fileset_file cfgfile=cfgfile) _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ self = module = 'cisco', fileset = 'asa' test_file = '/go/src/github.com/elastic/beats/x-pack/filebeat/module/cisco/asa/test/additional_messages.log' cfgfile = '/go/src/github.com/elastic/beats/x-pack/filebeat/build/system-tests/run/test_xpack_modules.XPackTest.test_fileset_file_203_cisco/filebeat.yml' def run_on_file(self, module, fileset, test_file, cfgfile): print("Testing {}/{} on {}".format(module, fileset, test_file)) self.assert_explicit_ecs_version_set(module, fileset) try: self.es.indices.delete(index=self.index_name) except BaseException: pass self.wait_until(lambda: not self.es.indices.exists(self.index_name)) cmd = [ self.filebeat, "-systemTest", "-e", "-d", "*", "-once", "-c", cfgfile, "-E", "setup.ilm.enabled=false", "-modules={}".format(module), "-M", "{module}.*.enabled=false".format(module=module), "-M", "{module}.{fileset}.enabled=true".format( module=module, fileset=fileset), "-M", "{module}.{fileset}.var.input=file".format( module=module, fileset=fileset), "-M", "{module}.{fileset}.var.paths=[{test_file}]".format( module=module, fileset=fileset, test_file=test_file), "-M", "*.*.input.close_eof=true", ] # Based on the convention that if a name contains -json the json format is needed. Currently used for LS. if "-json" in test_file: cmd.append("-M") cmd.append("{module}.{fileset}.var.format=json".format(module=module, fileset=fileset)) output_path = os.path.join(self.working_dir) # Runs inside a with block to ensure file is closed afterwards with open(os.path.join(output_path, "output.log"), "ab") as output: output.write(bytes(" ".join(cmd) + "\n", "utf-8")) # Use a fixed timezone so results don't vary depending on the environment # Don't use UTC to avoid hiding that non-UTC timezones are not being converted as needed, # this can happen because UTC uses to be the default timezone in date parsers when no other # timezone is specified. local_env = os.environ.copy() local_env["TZ"] = 'Etc/GMT+2' subprocess.Popen(cmd, env=local_env, stdin=None, stdout=output, stderr=subprocess.STDOUT, bufsize=0).wait() # List of errors to check in filebeat output logs errors = ["Error loading pipeline for fileset", "Cannot index event"] # Checks if the output of filebeat includes errors contains_error, error_line = file_contains(os.path.join(output_path, "output.log"), errors) > assert contains_error is False, "Error found in log:{}".format(error_line) E AssertionError: Error found in log:2021-02-09T16:20:17.543-0200 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0xc000d277fb0fdf3b, ext:96420354, loc:(*time.Location)(0x60b8d60)}, Meta:{"pipeline":"filebeat-8.0.0-cisco-asa-asa-ftd-pipeline"}, Fields:{"agent":{"ephemeral_id":"f4ddf009-8b6b-4c80-b222-84c19ce0dba8","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"dataset":"cisco.asa","module":"cisco","timezone":"-02:00"},"fileset":{"name":"asa"},"input":{"type":"log"},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/cisco/asa/test/additional_messages.log"},"offset":4472},"message":"May 5 19:02:58 dev01: %ASA-6-302022: Built director stub TCP connection for fw1111:10.10.10.10/38540 (8.8.8.5/38540) to net:192.168.2.2/10051 (8.8.8.8/10051)","service":{"type":"cisco"},"tags":["cisco-asa","forwarded"]}, Private:file.State{Id:"native::5681854-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc00047cdd0), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/cisco/asa/test/additional_messages.log", Offset:4631, Timestamp:time.Time{wall:0xc000d277fad71465, ext:92698411, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56b2be, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse field [destination.port] of type [long] in document with id 'ShsFiHcBlK8jOxC9zBf4'. Preview of field's value: '10051 (8.8.8.8/10051)'","caused_by":{"type":"illegal_argument_exception","reason":"For input string: \"10051 (8.8.8.8/10051)\""}} E E assert True is False ../../filebeat/tests/system/test_modules.py:156: AssertionError ```

##### `Build&Test / x-pack/filebeat-build / test_fileset_file_280_google_workspace – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest`
    Expand to view the error details

    ``` AssertionError: Error found in log:2021-02-09T16:25:42.208-0200 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0x0, ext:63737247600, loc:(*time.Location)(nil)}, Meta:{"pipeline":"filebeat-8.0.0-google_workspace-login-common"}, Fields:{"agent":{"ephemeral_id":"e8a3477d-0641-4f95-af33-926eab4c0a3f","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"action":"suspicious_login","category":["authentication"],"dataset":"google_workspace.login","id":"1","module":"google_workspace","original":"{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"login\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"ownerDomain\":\"elastic.com\",\"ipAddress\":\"98.235.162.24\",\"events\":{\"type\":\"account_warning\",\"name\":\"suspicious_login\",\"parameters\":[{\"name\":\"affected_email_address\",\"value\":\"foo@elastic.co\"},{\"name\":\"login_timestamp\",\"intValue\":1593695305123456}]}}","provider":"login","start":"Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)","type":["info"]},"fileset":{"name":"login"},"google_workspace":{"actor":{"type":"USER"},"event":{"type":"account_warning"},"kind":"admin#reports#activity","login":{"affected_email_address":"foo@elastic.co"},"organization":{"domain":"elastic.com"}},"input":{"type":"log"},"json":{"actor":{},"events":{},"id":{"time":"2020-10-02T15:00:00Z"}},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/google_workspace/login/test/login-test.json.log"},"offset":406},"organization":{"id":"1"},"related":{"ip":["98.235.162.24"],"user":["foo"]},"service":{"type":"google_workspace"},"source":{"ip":"98.235.162.24","user":{"domain":"bar.com","email":"foo@bar.com","id":"1","name":"foo"}},"tags":["forwarded"]}, Private:file.State{Id:"native::5682513-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc0008a48f0), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/google_workspace/login/test/login-test.json.log", Offset:853, Timestamp:time.Time{wall:0xc000d2c931d9f350, ext:91170001, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56b551, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse field [event.start] of type [date] in document with id 'jBsKiHcBlK8jOxC9wRw3'. Preview of field's value: 'Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)'","caused_by":{"type":"illegal_argument_exception","reason":"failed to parse date field [Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)] with format [strict_date_optional_time||epoch_millis]","caused_by":{"type":"date_time_parse_exception","reason":"Failed to parse with all enclosed parsers"}}} assert True is False ```

    Expand to view the stacktrace

    ``` a = (,) @wraps(func) def standalone_func(*a): > return func(*(a + p.args), **p.kwargs) ../../build/ve/docker/lib/python3.7/site-packages/parameterized/parameterized.py:518: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ ../../filebeat/tests/system/test_modules.py:99: in test_fileset_file cfgfile=cfgfile) _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ self = module = 'google_workspace', fileset = 'login' test_file = '/go/src/github.com/elastic/beats/x-pack/filebeat/module/google_workspace/login/test/login-test.json.log' cfgfile = '/go/src/github.com/elastic/beats/x-pack/filebeat/build/system-tests/run/test_xpack_modules.XPackTest.test_fileset_file_280_google_workspace/filebeat.yml' def run_on_file(self, module, fileset, test_file, cfgfile): print("Testing {}/{} on {}".format(module, fileset, test_file)) self.assert_explicit_ecs_version_set(module, fileset) try: self.es.indices.delete(index=self.index_name) except BaseException: pass self.wait_until(lambda: not self.es.indices.exists(self.index_name)) cmd = [ self.filebeat, "-systemTest", "-e", "-d", "*", "-once", "-c", cfgfile, "-E", "setup.ilm.enabled=false", "-modules={}".format(module), "-M", "{module}.*.enabled=false".format(module=module), "-M", "{module}.{fileset}.enabled=true".format( module=module, fileset=fileset), "-M", "{module}.{fileset}.var.input=file".format( module=module, fileset=fileset), "-M", "{module}.{fileset}.var.paths=[{test_file}]".format( module=module, fileset=fileset, test_file=test_file), "-M", "*.*.input.close_eof=true", ] # Based on the convention that if a name contains -json the json format is needed. Currently used for LS. if "-json" in test_file: cmd.append("-M") cmd.append("{module}.{fileset}.var.format=json".format(module=module, fileset=fileset)) output_path = os.path.join(self.working_dir) # Runs inside a with block to ensure file is closed afterwards with open(os.path.join(output_path, "output.log"), "ab") as output: output.write(bytes(" ".join(cmd) + "\n", "utf-8")) # Use a fixed timezone so results don't vary depending on the environment # Don't use UTC to avoid hiding that non-UTC timezones are not being converted as needed, # this can happen because UTC uses to be the default timezone in date parsers when no other # timezone is specified. local_env = os.environ.copy() local_env["TZ"] = 'Etc/GMT+2' subprocess.Popen(cmd, env=local_env, stdin=None, stdout=output, stderr=subprocess.STDOUT, bufsize=0).wait() # List of errors to check in filebeat output logs errors = ["Error loading pipeline for fileset", "Cannot index event"] # Checks if the output of filebeat includes errors contains_error, error_line = file_contains(os.path.join(output_path, "output.log"), errors) > assert contains_error is False, "Error found in log:{}".format(error_line) E AssertionError: Error found in log:2021-02-09T16:25:42.208-0200 WARN [elasticsearch] elasticsearch/client.go:408 Cannot index event publisher.Event{Content:beat.Event{Timestamp:time.Time{wall:0x0, ext:63737247600, loc:(*time.Location)(nil)}, Meta:{"pipeline":"filebeat-8.0.0-google_workspace-login-common"}, Fields:{"agent":{"ephemeral_id":"e8a3477d-0641-4f95-af33-926eab4c0a3f","id":"ac12aed8-1be2-4c13-8a0a-151e8378d5c2","name":"9911684e5ade","type":"filebeat","version":"8.0.0"},"ecs":{"version":"1.7.0"},"event":{"action":"suspicious_login","category":["authentication"],"dataset":"google_workspace.login","id":"1","module":"google_workspace","original":"{\"kind\":\"admin#reports#activity\",\"id\":{\"time\":\"2020-10-02T15:00:00Z\",\"uniqueQualifier\":1,\"applicationName\":\"login\",\"customerId\":\"1\"},\"actor\":{\"callerType\":\"USER\",\"email\":\"foo@bar.com\",\"profileId\":1},\"ownerDomain\":\"elastic.com\",\"ipAddress\":\"98.235.162.24\",\"events\":{\"type\":\"account_warning\",\"name\":\"suspicious_login\",\"parameters\":[{\"name\":\"affected_email_address\",\"value\":\"foo@elastic.co\"},{\"name\":\"login_timestamp\",\"intValue\":1593695305123456}]}}","provider":"login","start":"Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)","type":["info"]},"fileset":{"name":"login"},"google_workspace":{"actor":{"type":"USER"},"event":{"type":"account_warning"},"kind":"admin#reports#activity","login":{"affected_email_address":"foo@elastic.co"},"organization":{"domain":"elastic.com"}},"input":{"type":"log"},"json":{"actor":{},"events":{},"id":{"time":"2020-10-02T15:00:00Z"}},"log":{"file":{"path":"/go/src/github.com/elastic/beats/x-pack/filebeat/module/google_workspace/login/test/login-test.json.log"},"offset":406},"organization":{"id":"1"},"related":{"ip":["98.235.162.24"],"user":["foo"]},"service":{"type":"google_workspace"},"source":{"ip":"98.235.162.24","user":{"domain":"bar.com","email":"foo@bar.com","id":"1","name":"foo"}},"tags":["forwarded"]}, Private:file.State{Id:"native::5682513-2049", PrevId:"", Finished:false, Fileinfo:(*os.fileStat)(0xc0008a48f0), Source:"/go/src/github.com/elastic/beats/x-pack/filebeat/module/google_workspace/login/test/login-test.json.log", Offset:853, Timestamp:time.Time{wall:0xc000d2c931d9f350, ext:91170001, loc:(*time.Location)(0x60b8d60)}, TTL:-1, Type:"log", Meta:map[string]string(nil), FileStateOS:file.StateOS{Inode:0x56b551, Device:0x801}, IdentifierName:"native"}, TimeSeries:false}, Flags:0x1, Cache:publisher.EventCache{m:common.MapStr(nil)}} (status=400): {"type":"mapper_parsing_exception","reason":"failed to parse field [event.start] of type [date] in document with id 'jBsKiHcBlK8jOxC9wRw3'. Preview of field's value: 'Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)'","caused_by":{"type":"illegal_argument_exception","reason":"failed to parse date field [Thu Jul 02 2020 13:08:25 GMT+0000 (UTC)] with format [strict_date_optional_time||epoch_millis]","caused_by":{"type":"date_time_parse_exception","reason":"Failed to parse with all enclosed parsers"}}} E E assert True is False ../../filebeat/tests/system/test_modules.py:156: AssertionError ```

Steps errors 4

Expand to view the steps failures

##### `filebeat-build - mage build test`

  • Took 18 min 59 sec . View more details on here
  • Description: mage build test
##### `filebeat-windows-8-windows-8 - mage build unitTest`
  • Took 5 min 9 sec . View more details on here
  • Description: mage build unitTest
##### `x-pack/filebeat-build - mage build test`
  • Took 31 min 23 sec . View more details on here
  • Description: mage build test
##### `Error signal`
  • Took 0 min 0 sec . View more details on here
  • Description: Error 'hudson.AbortException: script returned exit code 1'

Log output

Expand to view the last 100 lines of log output

``` [2021-02-09T18:26:23.104Z] ================== 6 failed, 300 passed in 1427.37s (0:23:47) ================== [2021-02-09T18:26:23.104Z] >> python test: Integration Testing Complete [2021-02-09T18:26:23.363Z] Error: running "/go/src/github.com/elastic/beats/build/ve/docker/bin/pytest --timeout=90 --durations=20 --junit-xml=build/TEST-python-integration.xml tests/system/test_filebeat_xpack.py tests/system/test_http_endpoint.py tests/system/test_xpack_modules.py" failed with exit code 1 [2021-02-09T18:26:26.651Z] Error: running "docker-compose -p filebeat_8_0_0_f23afb2a94-snapshot run -e DOCKER_COMPOSE_PROJECT_NAME=filebeat_8_0_0_f23afb2a94-snapshot -e BEAT_STRICT_PERMS=false -e STACK_ENVIRONMENT=snapshot -e TESTING_ENVIRONMENT=snapshot -e GOCACHE=/go/src/github.com/elastic/beats/build/docker-gocache -v /var/lib/jenkins/workspace/Beats_beats_PR-23944/pkg/mod/cache/download:/gocache:ro -e GOPROXY=file:///gocache,direct -e EXEC_UID=1161 -e EXEC_GID=1162 -e BEATS_INSIDE_INTEGRATION_TEST_ENV=true -e GOFLAGS=-mod=readonly -e TEST_COVERAGE=true -e RACE_DETECTOR=true -e TEST_TAGS=null,oracle beat /go/src/github.com/elastic/beats/x-pack/filebeat/build/mage-linux-amd64 pythonIntegTest" failed with exit code 1 [2021-02-09T18:26:27.097Z] Client: Docker Engine - Community [2021-02-09T18:26:27.097Z] Version: 20.10.3 [2021-02-09T18:26:27.097Z] API version: 1.41 [2021-02-09T18:26:27.097Z] Go version: go1.13.15 [2021-02-09T18:26:27.097Z] Git commit: 48d30b5 [2021-02-09T18:26:27.097Z] Built: Fri Jan 29 14:33:13 2021 [2021-02-09T18:26:27.097Z] OS/Arch: linux/amd64 [2021-02-09T18:26:27.097Z] Context: default [2021-02-09T18:26:27.097Z] Experimental: true [2021-02-09T18:26:27.097Z] [2021-02-09T18:26:27.097Z] Server: Docker Engine - Community [2021-02-09T18:26:27.097Z] Engine: [2021-02-09T18:26:27.097Z] Version: 20.10.3 [2021-02-09T18:26:27.097Z] API version: 1.41 (minimum version 1.12) [2021-02-09T18:26:27.097Z] Go version: go1.13.15 [2021-02-09T18:26:27.097Z] Git commit: 46229ca [2021-02-09T18:26:27.097Z] Built: Fri Jan 29 14:31:25 2021 [2021-02-09T18:26:27.097Z] OS/Arch: linux/amd64 [2021-02-09T18:26:27.097Z] Experimental: false [2021-02-09T18:26:27.097Z] containerd: [2021-02-09T18:26:27.097Z] Version: 1.4.3 [2021-02-09T18:26:27.097Z] GitCommit: 269548fa27e0089a8b8278fc4fc781d7f65a939b [2021-02-09T18:26:27.097Z] runc: [2021-02-09T18:26:27.097Z] Version: 1.0.0-rc92 [2021-02-09T18:26:27.097Z] GitCommit: ff819c7e9184c13b7c2607fe6c30ae19403a7aff [2021-02-09T18:26:27.097Z] docker-init: [2021-02-09T18:26:27.097Z] Version: 0.19.0 [2021-02-09T18:26:27.097Z] GitCommit: de40ad0 [2021-02-09T18:26:27.097Z] Unable to find image 'alpine:3.4' locally [2021-02-09T18:26:27.664Z] 3.4: Pulling from library/alpine [2021-02-09T18:26:27.923Z] c1e54eec4b57: Pulling fs layer [2021-02-09T18:26:28.180Z] c1e54eec4b57: Verifying Checksum [2021-02-09T18:26:28.180Z] c1e54eec4b57: Download complete [2021-02-09T18:26:28.439Z] c1e54eec4b57: Pull complete [2021-02-09T18:26:28.439Z] Digest: sha256:b733d4a32c4da6a00a84df2ca32791bb03df95400243648d8c539e7b4cce329c [2021-02-09T18:26:28.439Z] Status: Downloaded newer image for alpine:3.4 [2021-02-09T18:26:30.651Z] + python .ci/scripts/pre_archive_test.py [2021-02-09T18:26:32.562Z] Copy ./x-pack/filebeat/build into build/x-pack/filebeat/build [2021-02-09T18:26:32.586Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-23944/src/github.com/elastic/beats/build [2021-02-09T18:26:32.926Z] + rm -rf ve [2021-02-09T18:26:32.926Z] + find . -type d -name vendor -exec rm -r {} ; [2021-02-09T18:26:32.951Z] Recording test results [2021-02-09T18:26:34.267Z] [Checks API] No suitable checks publisher found. [2021-02-09T18:26:34.588Z] + tar --version [2021-02-09T18:26:34.936Z] + tar --exclude=test-build-artifacts-x-pack/filebeat-build.tgz -czf test-build-artifacts-x-pack/filebeat-build.tgz . [2021-02-09T18:27:21.650Z] [INFO] Override default googleStorageUpload with some sleep [2021-02-09T18:27:21.670Z] Sleeping for 35 sec [2021-02-09T18:27:56.697Z] [Google Cloud Storage Plugin] Found 1 files to upload from pattern: test-build-artifacts-x-pack/filebeat-build.tgz [2021-02-09T18:27:57.068Z] [Google Cloud Storage Plugin] Uploading: test-build-artifacts-x-pack/filebeat-build.tgz [2021-02-09T18:28:08.734Z] + python .ci/scripts/search_system_tests.py [2021-02-09T18:28:08.766Z] [INFO] system-tests='build/x-pack/filebeat/build/system-tests'. If no empty then let's create a tarball [2021-02-09T18:28:09.126Z] + tar --version [2021-02-09T18:28:09.496Z] + tar --exclude=x-pack-filebeat--system-tests-linux.tgz -czf x-pack-filebeat--system-tests-linux.tgz build/x-pack/filebeat/build/system-tests [2021-02-09T18:28:36.086Z] [INFO] Override default googleStorageUpload with some sleep [2021-02-09T18:28:36.108Z] Sleeping for 1 min 35 sec [2021-02-09T18:30:11.132Z] [Google Cloud Storage Plugin] Found 1 files to upload from pattern: x-pack-filebeat--system-tests-linux.tgz [2021-02-09T18:30:11.203Z] [Google Cloud Storage Plugin] Uploading: x-pack-filebeat--system-tests-linux.tgz [2021-02-09T18:30:17.778Z] Client: Docker Engine - Community [2021-02-09T18:30:17.778Z] Version: 20.10.3 [2021-02-09T18:30:17.778Z] API version: 1.41 [2021-02-09T18:30:17.778Z] Go version: go1.13.15 [2021-02-09T18:30:17.778Z] Git commit: 48d30b5 [2021-02-09T18:30:17.778Z] Built: Fri Jan 29 14:33:13 2021 [2021-02-09T18:30:17.778Z] OS/Arch: linux/amd64 [2021-02-09T18:30:17.778Z] Context: default [2021-02-09T18:30:17.778Z] Experimental: true [2021-02-09T18:30:17.778Z] [2021-02-09T18:30:17.778Z] Server: Docker Engine - Community [2021-02-09T18:30:17.778Z] Engine: [2021-02-09T18:30:17.778Z] Version: 20.10.3 [2021-02-09T18:30:17.778Z] API version: 1.41 (minimum version 1.12) [2021-02-09T18:30:17.778Z] Go version: go1.13.15 [2021-02-09T18:30:17.778Z] Git commit: 46229ca [2021-02-09T18:30:17.778Z] Built: Fri Jan 29 14:31:25 2021 [2021-02-09T18:30:17.778Z] OS/Arch: linux/amd64 [2021-02-09T18:30:17.778Z] Experimental: false [2021-02-09T18:30:17.778Z] containerd: [2021-02-09T18:30:17.778Z] Version: 1.4.3 [2021-02-09T18:30:17.778Z] GitCommit: 269548fa27e0089a8b8278fc4fc781d7f65a939b [2021-02-09T18:30:17.778Z] runc: [2021-02-09T18:30:17.778Z] Version: 1.0.0-rc92 [2021-02-09T18:30:17.778Z] GitCommit: ff819c7e9184c13b7c2607fe6c30ae19403a7aff [2021-02-09T18:30:17.778Z] docker-init: [2021-02-09T18:30:17.778Z] Version: 0.19.0 [2021-02-09T18:30:17.778Z] GitCommit: de40ad0 [2021-02-09T18:30:23.580Z] Failed in branch x-pack/filebeat-build [2021-02-09T18:30:24.028Z] Stage "Packaging" skipped due to earlier failure(s) [2021-02-09T18:30:24.133Z] Running in /var/lib/jenkins/workspace/Beats_beats_PR-23944/src/github.com/elastic/beats [2021-02-09T18:30:25.150Z] Running on worker-395930 in /var/lib/jenkins/workspace/Beats_beats_PR-23944 [2021-02-09T18:30:25.255Z] [INFO] getVaultSecret: Getting secrets [2021-02-09T18:30:25.344Z] Masking supported pattern matches of $VAULT_ADDR or $VAULT_ROLE_ID or $VAULT_SECRET_ID [2021-02-09T18:30:27.418Z] + chmod 755 generate-build-data.sh [2021-02-09T18:30:27.418Z] + ./generate-build-data.sh https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-23944/ https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-23944/runs/1 FAILURE 3167498 [2021-02-09T18:30:27.418Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-23944/runs/1/steps/?limit=10000 -o steps-info.json [2021-02-09T18:30:28.875Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-23944/runs/1/tests/?status=FAILED -o tests-errors.json [2021-02-09T18:30:30.331Z] INFO: curl https://beats-ci.elastic.co/blue/rest/organizations/jenkins/pipelines/Beats/beats/PR-23944/runs/1/log/ -o pipeline-log.txt ```

:bug: Flaky test report

:grey_exclamation: There are test failures but not known flaky tests.

Expand to view the summary

### Test stats :test_tube: | Test | Results | | ------------ | :-----------------------------: | | Failed | 8 | | Passed | 12992 | | Skipped | 2033 | | Total | 15033 | ### Genuine test errors [![8](https://img.shields.io/badge/8%20-red)](https://beats-ci.elastic.co/blue/organizations/jenkins/Beats%2Fbeats%2FPR-23944/detail/PR-23944/1//tests) :broken_heart: There are test failures but not known flaky tests, most likely a genuine test failure. * **Name**: `Build&Test / filebeat-windows-8-windows-8 / test_syslog_with_udp – filebeat.tests.system.test_syslog.Test` * **Name**: `Build&Test / filebeat-build / test_fileset_file_023_kibana – filebeat.tests.system.test_modules.Test` * **Name**: `Build&Test / x-pack/filebeat-build / test_fileset_file_043_zoom – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest` * **Name**: `Build&Test / x-pack/filebeat-build / test_fileset_file_045_zoom – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest` * **Name**: `Build&Test / x-pack/filebeat-build / test_fileset_file_067_sophos – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest` * **Name**: `Build&Test / x-pack/filebeat-build / test_fileset_file_128_gsuite – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest` * **Name**: `Build&Test / x-pack/filebeat-build / test_fileset_file_203_cisco – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest` * **Name**: `Build&Test / x-pack/filebeat-build / test_fileset_file_280_google_workspace – x-pack.filebeat.tests.system.test_xpack_modules.XPackTest`

elasticmachine commented 3 years ago

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

botelastic[bot] commented 2 years ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.