From 76dd26104b747cefa5edf779663cac9caf923ed8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carlos=20P=C3=A9rez-Aradros=20Herce?= <exekias@gmail.com>
Date: Fri, 1 Dec 2017 15:54:00 +0100
Subject: [PATCH] Ignore docker kill signal in add_docker_metadata processor
 (#5788)

---
 CHANGELOG.asciidoc                            |  1 +
 .../processors/add_docker_metadata/watcher.go |  2 +-
 .../add_docker_metadata/watcher_test.go       | 30 +++++++++++++++++--
 3 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc
index 942754563caf..dc8286b814e3 100644
--- a/CHANGELOG.asciidoc
+++ b/CHANGELOG.asciidoc
@@ -31,6 +31,7 @@ https://github.com/elastic/beats/compare/v6.0.0...master[Check the HEAD diff]
 *Affecting all Beats*
 
 - Fix documentation links in README.md files. {pull}5710[5710]
+- Fix `add_docker_metadata` dropping some containers. {pull}5788[5788]
 
 *Auditbeat*
 
diff --git a/libbeat/processors/add_docker_metadata/watcher.go b/libbeat/processors/add_docker_metadata/watcher.go
index 91ea5fddb4a6..6f11810c625a 100644
--- a/libbeat/processors/add_docker_metadata/watcher.go
+++ b/libbeat/processors/add_docker_metadata/watcher.go
@@ -205,7 +205,7 @@ func (w *watcher) watch() {
 				}
 
 				// Delete
-				if event.Action == "die" || event.Action == "kill" {
+				if event.Action == "die" {
 					w.Lock()
 					w.deleted[event.Actor.ID] = time.Now()
 					w.Unlock()
diff --git a/libbeat/processors/add_docker_metadata/watcher_test.go b/libbeat/processors/add_docker_metadata/watcher_test.go
index 3508722649a5..155f3678913f 100644
--- a/libbeat/processors/add_docker_metadata/watcher_test.go
+++ b/libbeat/processors/add_docker_metadata/watcher_test.go
@@ -154,7 +154,8 @@ func TestWatcherUpdateEvent(t *testing.T) {
 }
 
 func TestWatcherKill(t *testing.T) {
-	watcher := runWatcher(t, false,
+	// Assert kill is ignored
+	watcher := runWatcher(t, true,
 		[]types.Container{
 			types.Container{
 				ID:     "0332dbd79e20",
@@ -173,6 +174,29 @@ func TestWatcherKill(t *testing.T) {
 		},
 	)
 
+	assert.Equal(t, len(watcher.deleted), 0)
+}
+
+func TestWatcherDie(t *testing.T) {
+	watcher := runWatcher(t, false,
+		[]types.Container{
+			types.Container{
+				ID:     "0332dbd79e20",
+				Names:  []string{"/containername", "othername"},
+				Image:  "busybox",
+				Labels: map[string]string{"label": "foo"},
+			},
+		},
+		[]interface{}{
+			events.Message{
+				Action: "die",
+				Actor: events.Actor{
+					ID: "0332dbd79e20",
+				},
+			},
+		},
+	)
+
 	// Check it doesn't get removed while we request meta for the container
 	for i := 0; i < 18; i++ {
 		watcher.Container("0332dbd79e20")
@@ -181,7 +205,7 @@ func TestWatcherKill(t *testing.T) {
 	}
 
 	// Now it should get removed
-	time.Sleep(150 * time.Millisecond)
+	time.Sleep(300 * time.Millisecond)
 	assert.Equal(t, len(watcher.Containers()), 0)
 }
 
@@ -192,7 +216,7 @@ func runWatcher(t *testing.T, kill bool, containers []types.Container, events []
 		done:       make(chan interface{}),
 	}
 
-	watcher, err := NewWatcherWithClient(client, 100*time.Millisecond)
+	watcher, err := NewWatcherWithClient(client, 150*time.Millisecond)
 	if err != nil {
 		t.Fatal(err)
 	}