…lastic#43199)

By default, beats require the config files to be writable only by the file
owner, so tests reading config files committed do the repo might fail depending
on how the host system is configured. For those tests the permission check is
relaxed. For those tests a the `testflag` package introduces a helper function
,`MustSetStrictPermsFalse`, to set `strict.perms` flag to false, preventing the
beats to perform the check for strict permissions on config files.

It also fixes the test framework and python tests which were saving the config
files with broader permissions than required by the beats by default.

(cherry picked from commit ced0b0c)

Co-authored-by: Anderson Queiroz <anderson.queiroz@elastic.co>

Enable FIPS compliant builds when the env var FIPS=true is set.

Artifacts are built with the microsfot/go toolchain with the env var GOEXPERIMENT=systemcrypto and the build tag "-tags=requirefips".
In order to run the resulting binary, the system must have a FIPS compliant crypto provider.

(cherry picked from commit 83e0ec0)

Co-authored-by: Michel Laterman <82832767+michel-laterman@users.noreply.github.com>

* create FIPSConfig loaded from yaml file and filter beats

* Refactor FIPS-compliant main

* fixup! Refactor FIPS-compliant main

* Log what beats are being packaged within agentbeat

* fix go.mod

* Add placeholders in fips settings yaml

* make notice

* Skip metricbeat integration tests for agentbeat

* Fix linter false positive

* Add details about skipping metribeat integration tests

* Clarify comment about filtering beats included in agentbeat

(cherry picked from commit 2dbb137)

Co-authored-by: Paolo Chilà <paolo.chila@elastic.co>

gotestcover has been archived and is no longer maintained
the readme recommends replacing the tool with xargs+tail
drop the dependency and update the makefile accordingly

(cherry picked from commit b8d6142)

Co-authored-by: kruskall <99559985+kruskall@users.noreply.github.com>

…lastic#43291)

* fix metricbeat/module/apache/status TestFetchTimeout

relax test assertion for metricbeat/module/apache/status TestFetchTimeout to also include "context deadline exceeded". The current way we do HTTP request might fail with either error, the original "Client.Timeout exceeded" but also with only "context deadline exceeded"

(cherry picked from commit 61c8f85)

Co-authored-by: Anderson Queiroz <anderson.queiroz@elastic.co>

…lastic#43301)

replace x/crypto with stdlib packages

Signed-off-by: kruskal <99559985+kruskall@users.noreply.github.com>
(cherry picked from commit eb117bd)

Co-authored-by: kruskall <99559985+kruskall@users.noreply.github.com>

…3062) (elastic#43203)

* feat(fips): do not allow scram sasl mechanism in fips mode

scram is using custom implementation of pbkdf2 which is not allowed
in fips mode

* Update sasl_fips.go

* Update sasl_fips.go

(cherry picked from commit 9761c36)

Co-authored-by: kruskall <99559985+kruskall@users.noreply.github.com>

…al monitoring (elastic#43229)

* [feat][fbreceiver] - enable http internal monitoring (elastic#42886)

* feat: enable http intenral monitoring

* enable metricreport

* review comments

* chore: review comments, final per namespace registry

* restore log

* notice

* add test cases

* public the lookup func

(cherry picked from commit da4c930)

# Conflicts:
#	go.mod
#	go.sum

* go.mod

* notice

---------

Co-authored-by: Vihas Makwana <121151420+VihasMakwana@users.noreply.github.com>
Co-authored-by: Vihas Makwana <vihas.makwana@elastic.co>

…lastic#43260)

(cherry picked from commit cd2ff13)

Co-authored-by: Fae Charlton <fae.charlton@elastic.co>

…or (elastic#43302) (elastic#43319)

* oteltest: make CheckReceivers environment more similar to the collector

The CheckReceivers function is designed to start receivers in the same
process to assert conditions. This simulated environment should closely
resemble the real OTel collector startup.

This PR fixes some inconsistencies in the test environment.

First, when instantiating receivers, the collector first creates them using
the factory and only then starts each component. Previously, we were
creating and starting each receiver sequentially, which is incorrect and
masked issues with global state when multiple receivers were present.

Second, a Beats receiver logger inherits from the zap.Core of the
collector logger. This core includes certain fields—specifically
data_type, kind, and name. In the tests, these fields were previously
missing, so this PR ensures they are included.

* remove i++

* use EventuallyWithT for assertions

* fix imports

* specify factory per receiver

(cherry picked from commit 8d31036)

Co-authored-by: Mauri de Souza Meneguzzo <mauri870@gmail.com>

* refactor: use go.mod mage version

do not overwrite mage version in makefile and use go.mod as the
source of truth

* Update mage-install.mk

* Update mage-install.mk

(cherry picked from commit 13f7cab)

Co-authored-by: kruskall <99559985+kruskall@users.noreply.github.com>

…lastic#43338)

Skip the flaky test in elastic#43253

(cherry picked from commit 61ec8ab)

Co-authored-by: Fae Charlton <fae.charlton@elastic.co>

Disable `metricbeat/module/system/process TestFetchDegradeOnPartial` reported in elastic#42809.

Also change the failing `t.Assert` to `t.Require` so that when it does fail, it doesn't fall through to a panic on the next line by accessing the first element of an empty array.

(cherry picked from commit 0b2e66a)

Co-authored-by: Fae Charlton <fae.charlton@elastic.co>

) (elastic#43340)

(cherry picked from commit d68410a)

Co-authored-by: kruskall <99559985+kruskall@users.noreply.github.com>

…ic#42582) (elastic#43353)

* feat(fips): disable usage of flowhash/communityid in fips mode

In version 1 of the ID, the hash algorithm is SHA1

usage of flowhash fails with the following message when the stdlib
is in fips only mode:

crypto/sha1: use of SHA-1 is not allowed in FIPS 140-only mode

* test: skip communityid tests in fips mode

* test: skip communityid tests in fips mode

* fix: resolve compile errors

* lint: fix linter issues

* refactor: add fips noop community implementation

* lint: fix linter issues

(cherry picked from commit 3b00fcb)

Co-authored-by: kruskall <99559985+kruskall@users.noreply.github.com>

)

(cherry picked from commit 3758912)

Co-authored-by: Mirko Bez <herrBez@users.noreply.github.com>

…43332)

The `libbeat/common/op` package has logic errors, and no remaining callers.

(cherry picked from commit 97f372b)

Co-authored-by: Fae Charlton <fae.charlton@elastic.co>

…in connection receive (elastic#42222) (elastic#43361)

---------

Co-authored-by: Tiago Queiroz <tiago.queiroz@elastic.co>
(cherry picked from commit 19a724d)

Co-authored-by: Joseph Heyburn <34041368+jdheyburn@users.noreply.github.com>

…#43063) (elastic#43365)

This centralises the state store to simplify and clarify the use of persistent
stores.

(cherry picked from commit df62e10)

Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>

…in from amd64 (elastic#43398)

) (elastic#43245)

(cherry picked from commit c80fbe1)

Co-authored-by: Victor Martinez <victormartinezrubio@gmail.com>

)

…43374)

There's an older faccessat(2) that is used by older glibc, particularly the one
in ubuntu 20.04.

Any cgo program (like any processor using quark) might end up needing that.

(cherry picked from commit 73353a8)

Co-authored-by: Christiano Haesbaert <haesbaert@elastic.co>

…te vSphere connection is configured as insecure (elastic#43325)

* feat: add warning log message to indicate vSphere connection is configured as insecure (elastic#43104)

* feat: add warning log message to indicate vSphere connection is configured as insecure

* chore: add CHANGELOG.asciidoc entry

* move changelog entry from CHANGELOG.asciidoc to CHANGELOG.next.asciidoc

* add missing license header

* fix linter issue

* fix changelog entry section

* Update metricbeat/module/vsphere/security/logging.go

Co-authored-by: Ishleen Kaur <102962586+ishleenk17@users.noreply.github.com>

---------

Co-authored-by: Ishleen Kaur <102962586+ishleenk17@users.noreply.github.com>
(cherry picked from commit 4c7d45c)

* fix: remove incorect CHANGELOG.next.asciidoc entries

---------

Co-authored-by: stefans-elastic <stefan.stas@elastic.co>

…lastic#43410)

* feat: move js processor registry to separate package

a lot processors register a js processor.
This is importing the javascript processor which is causing goja
and a few other dependencies to be pulled in.
For downstream users of libbeat and few beats that do not use the
javascript processor this is a non-trivial maintenance burden,
especially because they will have to add and maintain a replace
directive to ensure the binary builds.

Move jsprocessor registry to a separate package so goja and the
javascript processor are only imported when used, making them
self contained.

* Update chain.go

* Update processor_test.go

* lint: fix compile errors

(cherry picked from commit 0710350)

Co-authored-by: kruskall <99559985+kruskall@users.noreply.github.com>

… binaries (elastic#42719)

* feat: drop init.d support and go-daemon binaries (elastic#41845)

* feat: drop init.d support and go-daemon binaries

remove init.d scripts
drop go-daemon dep and daemon binaries
cleanup mage tasks

* lint: fix linter issues

* docs: remove reference to init.d scripts

(cherry picked from commit 5fbf359)

* fix: update functionbeat magefile

---------

Co-authored-by: kruskall <99559985+kruskall@users.noreply.github.com>
Co-authored-by: Andrew Kroh <andrew.kroh@elastic.co>

…lastic#43433)

* fix: resolve communityid compile errors in fips mode

* Update communityid_fips.go

(cherry picked from commit 3479a2f)

Co-authored-by: kruskall <99559985+kruskall@users.noreply.github.com>

Fix flaky timeout tests.

These tests confirmed that their timeouts worked by scanning the error text returned from the http request. The error text that they expected was:

`error in http fetch: error making http request: Get "http://127.0.0.1:57060/stats": context deadline exceeded (Client.Timeout exceeded while awaiting headers)`

However there are two other semi-common forms:

`error in http fetch: error making http request: Get "http://127.0.0.1:57052/stats": context deadline exceeded`

`error in http fetch: error making http request: Get "http://127.0.0.1:32839/stats": net/http: request canceled (Client.Timeout exceeded while awaiting headers)`

This result is still a successful check of the timeout feature, even though the propagated error string varies slightly. I've switched to checking substrings that are stable between all error strings.

I also reverted some of the changes in elastic#43283 that were unrelated to the test flakiness, and that made the test potentially less stable. These tests previously had near-identical code -- the original version used a channel to terminate the server response deterministically when the test was over, but elastic#43283 changed this to a fixed Sleep call that requires 5ms precision on timer triggers (which is _usually_ true but not always guaranteed on CI machines. Tests shouldn't use magic timeout values when a deterministic alternative is available, and since the channel code turned out to be unrelated to the flakiness I think we should keep it.)

(cherry picked from commit cb097b4)

Co-authored-by: Fae Charlton <fae.charlton@elastic.co>

…3447)

Disable the flaky test `metricbeat/module/zookeeper/test_zookeeper`, reported in elastic#43385.

Also add a message to the failing assertions indicating the actual data the tests failed on, so when a failure does happen we can see what caused it.

(cherry picked from commit 9e29bcb)

Co-authored-by: Fae Charlton <fae.charlton@elastic.co>

…astic#44769) (elastic#44778)

(cherry picked from commit df335f3)

Co-authored-by: subham sarkar <subham.sarkar@elastic.co>

Made with ❤️️ by updatecli

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…lastic#44810)

(cherry picked from commit b91d891)

Co-authored-by: Tiago Queiroz <tiago.queiroz@elastic.co>

…ebian11 (elastic#44819)

* Explicitly crossbuild linux/arm with debian11 (elastic#44816)

* Crossbuild linux/arm with debian11.

* Update changelog.

(cherry picked from commit 331c32e)

* Fix conflict in changelog.

---------

Co-authored-by: Craig MacKenzie <craig.mackenzie@elastic.co>

Made with ❤️️ by updatecli

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…24.4 (elastic#44841)

* [Automation] Bump Golang version to 1.24.4 (elastic#44696)

* chore: Update Filebeat debug Dockerfile

Made with ❤️️ by updatecli

* chore: Update Metricbeat debug Dockerfile

Made with ❤️️ by updatecli

* chore: Update version.asciidoc

Made with ❤️️ by updatecli

* chore: Update go.mod

Made with ❤️️ by updatecli

* chore: Update Auditbeat Dockerfile

Made with ❤️️ by updatecli

* chore: Update Heartbeat Dockerfile

Made with ❤️️ by updatecli

* chore: Update HTTP module Dockerfile

Made with ❤️️ by updatecli

* chore: Update from vsphere Dockerfile

Made with ❤️️ by updatecli

* chore: Update stan Dockerfile

Made with ❤️️ by updatecli

* chore: Update Heartbeat debug Dockerfile

Made with ❤️️ by updatecli

* chore: Update Metricbeat Dockerfile

Made with ❤️️ by updatecli

* chore: Update .go-version

Made with ❤️️ by updatecli

* chore: Update Packetbeat Dockerfile

Made with ❤️️ by updatecli

* Update changelog.

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Anderson Queiroz <anderson.queiroz@elastic.co>
Co-authored-by: Craig MacKenzie <craig.mackenzie@elastic.co>
Co-authored-by: Dimitrios Liappis <dimitrios.liappis@gmail.com>
(cherry picked from commit 6286492)

# Conflicts:
#	libbeat/docs/version.asciidoc

* Fix conflict in libbeat/docs/version.asciidoc

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Craig MacKenzie <craig.mackenzie@elastic.co>

…ection (elastic#44849)

* fix: AWS S3 improve unexpected EOF detection (elastic#44813)

* improve unexpected EOF detection

Signed-off-by: Kavindu Dodanduwa <kavindu.dodanduwa@elastic.co>

* add changelog entry

Signed-off-by: Kavindu Dodanduwa <kavindu.dodanduwa@elastic.co>

* fix lint issues

Signed-off-by: Kavindu Dodanduwa <kavindu.dodanduwa@elastic.co>

* review: receiver name

Signed-off-by: Kavindu Dodanduwa <kavindu.dodanduwa@elastic.co>

---------

Signed-off-by: Kavindu Dodanduwa <kavindu.dodanduwa@elastic.co>
(cherry picked from commit a75b4e7)

* Update CHANGELOG.next.asciidoc

* fix import

Signed-off-by: Kavindu Dodanduwa <kavindu.dodanduwa@elastic.co>

---------

Signed-off-by: Kavindu Dodanduwa <kavindu.dodanduwa@elastic.co>
Co-authored-by: Kavindu Dodanduwa <Kavindu-Dodan@users.noreply.github.com>
Co-authored-by: Kavindu Dodanduwa <kavindu.dodanduwa@elastic.co>

…csv" content-type filter support (elastic#44828)

Currently content-type "text/csv" did not have official filtering
support even though we support  csv decoding. This made blobs having this
content type defined were not picked up for processing. This PR as a "bugfix",
adds support for explicit "text/csv" content-type filtering in the
scheduler.

(cherry picked from commit fba3749)

---------

Co-authored-by: Shourie Ganguly <shourie.ganguly@elastic.co>

…vers (elastic#44863)

* otel: fix service.name for beats receivers (elastic#44831)

* otel: fix service.name for beats receivers

Beats receivers currently use the hostname as the "service.name" logger
field. Adjust it to reflect the beat name for consistency with standard
beats.

* use require.Contains before Equal

* fix linter issues

(cherry picked from commit df3dcad)

# Conflicts:
#	x-pack/filebeat/fbreceiver/receiver_test.go

* fix conflicts

---------

Co-authored-by: Mauri de Souza Meneguzzo <mauri870@gmail.com>

Made with ❤️️ by updatecli

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

…lastic#44646)

This PR updates Sarama to the current Elastic fork, targeting the commit:

```
commit 7672917f26b6112627457d6bd1736a8636449c5b (HEAD, upstream/beats-fork)
Merge: e414b10 a10b157
Author: Fae Charlton <fae.charlton@elastic.co>
Date:   Tue Jun 3 13:51:45 2025 -0400

    Merge pull request elastic#28 from faec/broker-rst-fix

    Clean up broker connections when returning a short-circuit error during metadata fetch
```

This includes the fix for elastic#44606.

(cherry picked from commit 4195119)

Co-authored-by: Fae Charlton <fae.charlton@elastic.co>

…to v1.33.0/v0.127.0 (elastic#44869)

* [chore] Update otel collector version to v1.33.0/v0.127.0 (elastic#44862)

…ching consumergroup member assignments (elastic#44871)

* [metricbeat][kafka] fix panic when fetching consumergroup member assignments (elastic#44576)

* [metricbeat][kafka] fix panic when fetching consumergroup member assignments

* add changelog entry

* mage fmt

* fix linter

* update new changelog

* fix behaviour in case of sarama error in MemberDescription conversion

* fix linter

* move changelog entry to appropriate version section

* remove entries from  docs/release-notes/index.md

---------

Co-authored-by: Ishleen Kaur <102962586+ishleenk17@users.noreply.github.com>
(cherry picked from commit 91de405)

# Conflicts:
#	metricbeat/module/kafka/broker_test.go

* resolve merge conflicts

* fix linter errors in metricbeat/module/windows

* fix linter errors in metricbeat/module/windows

* fix missing import

* fix linter errors in metricbeat/module/windows

* fix linter errors in metricbeat/module/windows

* fix linter errors in metricbeat/module/windows

* fix linter errors in metricbeat/module/windows

* fix linter errors in metricbeat/module/windows

---------

Co-authored-by: stefans-elastic <stefan.stas@elastic.co>

…atus updating (elastic#44887)

- Add fleet input status updating to the UDP input
- Removed redundant embedded struct selectors

(cherry picked from commit cbe3da9)

---------

Co-authored-by: Taylor Swanson <90622908+taylor-swanson@users.noreply.github.com>
Co-authored-by: Taylor Swanson <taylor.swanson@elastic.co>

* [FIPS] Disable Microsoft Go telemetry

* Add CHANGELOG entry

* Remove check for MS_GOTOOLCHAIN_TELEMETRY_ENABLED from package.

That env var affects the behavior of the Go toolchain at build time, not the behavior of the Beats binaries at runtime.

(cherry picked from commit b9ce100)

Co-authored-by: Shaunak Kashyap <ycombinator@gmail.com>

Made with ❤️️ by updatecli

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>

(cherry picked from commit 94df681)

Co-authored-by: Shaunak Kashyap <ycombinator@gmail.com>

…IPS builds (elastic#44906)

* Disable Metricbeat `mssql` module in FIPS builds (elastic#44890)

* Exclude non-generated Go code from FIPS build

* Add doc about module availability

* Adding CHANGELOG entry

* Adding doc.go files to workaround excluding all Go files in build

* Update PR number in CHANGELOG entry

* Remove CHANGELOG entry

(cherry picked from commit 9f5988f)

* Running mage update

---------

Co-authored-by: Shaunak Kashyap <ycombinator@gmail.com>

…uilds (elastic#44891) (elastic#44910)

* Exclude Azure provider in add_cloud_metadata processor in FIPS builds

* Add warning to doc

* Adding CHANGELOG entry

* Updating PR number in CHANGELOG entry

* Clarify provider in CHANGELOG entry

* Do not compile Azure provider code

* Do not compile Azure provider tests

* Remove CHANGELOG entries

(cherry picked from commit 383a4c6)

Co-authored-by: Shaunak Kashyap <ycombinator@gmail.com>

…stic#44905)

* Add doc about module availability

* Exclude non-generated Go code from FIPS build

* Adding CHANGELOG entry

* Adding doc.go files to workaround excluding all Go files in build

* Run make check

* Remove CHANGELOG entry

(cherry picked from commit 0425c03)

Co-authored-by: Shaunak Kashyap <ycombinator@gmail.com>

* add otel test binary

…t polling interval `period` 10s -> 60s (elastic#44876)

* [metricbeat] [mongodb] increase default polling interval `period` 10s -> 60s (elastic#44781)

(cherry picked from commit f889b64)

* make update

---------

Co-authored-by: mykola-elastic <mykola.kmet@elastic.co>

elastic#44689)

* [Heartbeat] Adds maintenance windows !! (elastic#41508)

* Add maint windows

* Initial maint win MVP

* added maintenance windows

* destroy cluster

* format

* revert file

* revert file

* added lib

* revert

* space

* add license

* update

* update

* fix tests

* lint

* skip run once

* Fix linting

* Remove unused fields

* Make update

* add more test cases

* utc

* lint

* handle errors

* bit of refactor

* emilio suggestion

* More PR feedback

* lint

* add validation for map

* nil condition

* set count to default

* add validation for only daily

* add dt start validation

* revrt

* revrt

* revert

* revert

* format

* PR feedback

* add docs

* Update heartbeat/monitors/maintwin/maintwin.go

Co-authored-by: Emilio Alvarez Piñeiro <95703246+emilioalvap@users.noreply.github.com>

* Update heartbeat/monitors/maintwin/maintwin.go

Co-authored-by: Emilio Alvarez Piñeiro <95703246+emilioalvap@users.noreply.github.com>

* fomat

* change log

---------

Co-authored-by: Andrew Cholakian <andrewvc@elastic.co>
Co-authored-by: emilioalvap <emilio.alvarezpineiro@elastic.co>
Co-authored-by: Emilio Alvarez Piñeiro <95703246+emilioalvap@users.noreply.github.com>
(cherry picked from commit f6fb08d)

# Conflicts:
#	go.mod
#	go.sum

* Fix conflicts

---------

Co-authored-by: Shahzad <shahzad31comp@gmail.com>
Co-authored-by: emilioalvap <emilio.alvarezpineiro@elastic.co>

Made with ❤️️ by updatecli

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>