From 33ec85bc9b49fa12a38ac7615e466a627c2b7482 Mon Sep 17 00:00:00 2001
From: ruflin <spam@ruflin.com>
Date: Tue, 10 Jan 2017 15:43:29 +0100
Subject: [PATCH] Always use absolute path for event and registry

During some testing with filebeat I realised that when a relative path glob is put into the filebeat config, the event will contain the relative path and also the state. In most cases this should not be an issue and so far no issues were reported.

For the state itself it is not an issue as they are compared based on inode/device. It could become an issue on restart in case a config was changed from a relative to an absolute path and the prospector does not detect, that the state would belong to the same prospector. This could also have an affect when migrating to this solutions. Old states could be left over in the registry file. But this requires, that someone was using relative paths before which was never recommended.
---
 CHANGELOG.asciidoc                    | 3 ++-
 filebeat/_meta/fields.common.yml      | 2 +-
 filebeat/docs/fields.asciidoc         | 2 +-
 filebeat/prospector/prospector_log.go | 5 +++++
 4 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc
index 5919ae27c8f..b1fc502bfbd 100644
--- a/CHANGELOG.asciidoc
+++ b/CHANGELOG.asciidoc
@@ -17,6 +17,7 @@ https://github.com/elastic/beats/compare/v5.1.1...master[Check the HEAD diff]
 - Change beat generator. Use `$GOPATH/src/github.com/elastic/beats/script/generate.py` to generate a beat. {pull}3452[3452]
 
 *Filebeat*
+- Always use absolute path for event and registry. This can lead to issues when relative paths were used before. {pull}3328[3328]
 
 *Heartbeat*
 
@@ -38,6 +39,7 @@ https://github.com/elastic/beats/compare/v5.1.1...master[Check the HEAD diff]
 - Add `_id`, `_type`, `_index` and `_score` fields in the generated index pattern. {pull}3282[3282]
 
 *Filebeat*
+- Always use absolute path for event and registry. {pull}3328[3328]
 
 *Heartbeat*
 
@@ -47,7 +49,6 @@ https://github.com/elastic/beats/compare/v5.1.1...master[Check the HEAD diff]
 
 *Packetbeat*
 
-
 *Winlogbeat*
 
 
diff --git a/filebeat/_meta/fields.common.yml b/filebeat/_meta/fields.common.yml
index 54a37b7c2ee..c34200224a1 100644
--- a/filebeat/_meta/fields.common.yml
+++ b/filebeat/_meta/fields.common.yml
@@ -7,7 +7,7 @@
       type: keyword
       required: true
       description: >
-        The file from which the line was read. This field contains the full path to the file.
+        The file from which the line was read. This field contains the absolute path to the file.
         For example: `/var/log/system.log`.
 
     - name: offset
diff --git a/filebeat/docs/fields.asciidoc b/filebeat/docs/fields.asciidoc
index d933b336314..069e3b10d44 100644
--- a/filebeat/docs/fields.asciidoc
+++ b/filebeat/docs/fields.asciidoc
@@ -403,7 +403,7 @@ type: keyword
 
 required: True
 
-The file from which the line was read. This field contains the full path to the file. For example: `/var/log/system.log`.
+The file from which the line was read. This field contains the absolute path to the file. For example: `/var/log/system.log`.
 
 
 [float]
diff --git a/filebeat/prospector/prospector_log.go b/filebeat/prospector/prospector_log.go
index ff4b62a5c61..c255763f3a7 100644
--- a/filebeat/prospector/prospector_log.go
+++ b/filebeat/prospector/prospector_log.go
@@ -215,6 +215,11 @@ func (p *ProspectorLog) scan() {
 		default:
 		}
 
+		var err error
+		path, err = filepath.Abs(path)
+		if err != nil {
+			logp.Err("could not fetch abs path for file %s: %s", path, err)
+		}
 		logp.Debug("prospector", "Check file for harvesting: %s", path)
 
 		// Create new state for comparison