Fix the wrong event type for a new file (#36098) (#36102)

It's supposed to emit a `create` event, not a `write` event when a previously ignored empty file gets written to. (cherry picked from commit f52d38a) Co-authored-by: Denis <denis.rechkunov@elastic.co>
elastic · Jul 18, 2023 · ec49a82 · ec49a82
1 parent 195e58e
commit ec49a82
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/filebeat/input/filestream/fswatch.go b/filebeat/input/filestream/fswatch.go
@@ -202,6 +202,7 @@ func (w *fileWatcher) watch(ctx unison.Canceler) {
  // no need to react on empty new files
  if fd.Info.Size() == 0 {
  w.log.Warnf("file %q has no content yet, skipping", fd.Filename)
+ delete(paths, path)
  continue
  }
  select {

diff --git a/filebeat/input/filestream/fswatch_test.go b/filebeat/input/filestream/fswatch_test.go
@@ -295,8 +295,7 @@ scanner:
  e := fw.Event()
  expEvent := loginp.FSEvent{
  NewPath: filename,
- OldPath: filename,
- Op: loginp.OpWrite,
+ Op: loginp.OpCreate,
  Descriptor: loginp.FileDescriptor{
  Filename: filename,
  Info: testFileInfo{path: basename, size: 5}, // +5 bytes appended