From 3432e546d80ae75d726bcec97f817c719252f5a4 Mon Sep 17 00:00:00 2001
From: Taylor Swanson <90622908+taylor-swanson@users.noreply.github.com>
Date: Tue, 10 Sep 2024 11:57:44 -0500
Subject: [PATCH] [netflow] Ensure custom fields configuration is applied
 (#40730)

- Fix custom fields not being applied when provided through configuration
- Add regression test

(cherry picked from commit f9b41f221db70bb2ef1f17b7e2895c1a9d01f9ba)
---
 CHANGELOG.next.asciidoc                     |  1 +
 x-pack/filebeat/input/netflow/input.go      |  1 +
 x-pack/filebeat/input/netflow/input_test.go | 22 +++++++++++++++++++++
 3 files changed, 24 insertions(+)

diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index c856b639743..6fd14509886 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -164,6 +164,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - awss3 input: Fix handling of SQS notifications that don't contain a region. {pull}40628[40628]
 - Fix credential handling when workload identity is being used in GCS input. {issue}39977[39977] {pull}40663[40663]
 - Fix publication of group data from the Okta entity analytics provider. {pull}40681[40681]
+- Ensure netflow custom field configuration is applied. {issue}40735[40735] {pull}40730[40730]
 
 *Heartbeat*
 
diff --git a/x-pack/filebeat/input/netflow/input.go b/x-pack/filebeat/input/netflow/input.go
index f65ab6e2bc9..bb4046b74a9 100644
--- a/x-pack/filebeat/input/netflow/input.go
+++ b/x-pack/filebeat/input/netflow/input.go
@@ -68,6 +68,7 @@ func (im *netflowInputManager) Create(cfg *conf.C) (v2.Input, error) {
 
 	input := &netflowInput{
 		cfg:              inputCfg,
+		customFields:     customFields,
 		internalNetworks: inputCfg.InternalNetworks,
 		logger:           im.log,
 		queueSize:        inputCfg.PacketQueueSize,
diff --git a/x-pack/filebeat/input/netflow/input_test.go b/x-pack/filebeat/input/netflow/input_test.go
index 2f78cf83c7e..a45cc260092 100644
--- a/x-pack/filebeat/input/netflow/input_test.go
+++ b/x-pack/filebeat/input/netflow/input_test.go
@@ -10,6 +10,7 @@ import (
 	"testing"
 
 	"github.com/elastic/beats/v7/libbeat/tests/resources"
+	"github.com/elastic/beats/v7/x-pack/filebeat/input/netflow/decoder/fields"
 
 	conf "github.com/elastic/elastic-agent-libs/config"
 	"github.com/elastic/elastic-agent-libs/logp"
@@ -29,3 +30,24 @@ func TestNewInputDone(t *testing.T) {
 	_, err = Plugin(logp.NewLogger("netflow_test")).Manager.Create(config)
 	require.NoError(t, err)
 }
+
+func TestConfig_CustomDefinitions(t *testing.T) {
+	goroutines := resources.NewGoroutinesChecker()
+	defer goroutines.Check(t)
+
+	wantDefinitions, err := LoadFieldDefinitionsFromFile("testdata/fields/netflow9_cisco_asa_custom.yaml")
+	require.NoError(t, err)
+	want := []fields.FieldDict{wantDefinitions}
+
+	config, err := conf.NewConfigFrom(mapstr.M{
+		"custom_definitions": []string{"testdata/fields/netflow9_cisco_asa_custom.yaml"},
+	})
+	require.NoError(t, err)
+
+	v2input, err := Plugin(logp.NewLogger("netflow_test")).Manager.Create(config)
+	require.NoError(t, err)
+
+	input := v2input.(*netflowInput)
+
+	require.EqualValues(t, input.customFields, want)
+}