x-pack/filebeat/input/http_endpoint: fix request trace logging file names

CHANGELOG.next.asciidoc

@@ -148,6 +148,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Upgrade azure-event-hubs-go and azure-storage-blob-go dependencies. {pull}38861[38861]
 - Fix concurrency/error handling bugs in the AWS S3 input that could drop data and prevent ingestion of large buckets. {pull}39131[39131]
 - Fix EntraID query handling. {issue}39419[39419] {pull}39420[39420]
+- Expand ID patterns in request trace logger for HTTP Endpoint. {pull}39656[39656]
 
 *Heartbeat*
 

x-pack/filebeat/input/http_endpoint/input.go

@@ -14,7 +14,9 @@ import (
 	"net"
 	"net/http"
 	"net/url"
+	"path/filepath"
 	"reflect"
+	"strings"
 	"sync"
 	"time"
 
@@ -101,13 +103,28 @@ func (e *httpEndpoint) Test(_ v2.TestContext) error {
 func (e *httpEndpoint) Run(ctx v2.Context, publisher stateless.Publisher) error {
 	metrics := newInputMetrics(ctx.ID)
 	defer metrics.Close()
+
+	if e.config.Tracer != nil {
+		id := sanitizeFileName(ctx.ID)
+		e.config.Tracer.Filename = strings.ReplaceAll(e.config.Tracer.Filename, "*", id)
+	}
+
 	err := servers.serve(ctx, e, publisher, metrics)
 	if err != nil && !errors.Is(err, http.ErrServerClosed) {
 		return fmt.Errorf("unable to start server due to error: %w", err)
 	}
 	return nil
 }
 
+// sanitizeFileName returns name with ":" and "/" replaced with "_", removing repeated instances.
+// The request.tracer.filename may have ":" when a http_endpoint input has cursor config and
+// the macOS Finder will treat this as path-separator and causes to show up strange filepaths.
+func sanitizeFileName(name string) string {
+	name = strings.ReplaceAll(name, ":", string(filepath.Separator))
+	name = filepath.Clean(name)
+	return strings.ReplaceAll(name, string(filepath.Separator), "_")
+}
+
 // servers is the package-level server pool.
 var servers = pool{servers: make(map[string]*server)}