Filebeat: Mixed up fileset.module

[sophiec20]

• Version:
  Filebeat 5.6.0-SNAPSHOT from Jul 24 13:17

• Operating System:
  Linux ip-10-0-1-124 4.4.35-33.55.amzn1.x86_64 #1 SMP Tue Dec 6 20:30:04 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
  2 node cluster.

• Steps to Reproduce:
  I'd tell you if I knew ;)

Whilst trying several different commands using filebeat modules, I noticed that apache2 data had been uploaded with an nginx label.

Commands used were probably a combination of:
./filebeat -v -e -modules=apache2,nginx
./filebeat -v -e -modules=apache2
./filebeat -v -e -modules=nginx

Ingest pipelines were reviewed and appeared to be ok.

Will wipe down kit, and attempt to replicate.

[tsg]

Proof reading the code didn't so far reveal conditions where this could happen. I started 1k runs like this:

for ((i=0;i<1000;i++)); do
  echo $i;
  rm data/registry;
  ./filebeat -modules=nginx,apache2 -M "nginx.access.var.paths=[/test/*.log]" -M "apache2.access.var.paths=[module/apache2/access/test/ubuntu-2.2.22.log]" -M "*.*.prospector.close_eof=true" -d "publish" -once -e 2>&1  | grep '"module": "nginx';
done

I'm monitoring the FB output and the ES index. Lets see if it happens on my mac. If not, I'm going to try on Linux as well.

[sophiec20]

Consistent reproduction with this

./filebeat -e -modules=apache2,nginx -v

Only changes to apache2 and nginx manifest.yml were the data paths.

Only change to filebeat.yml was data path set to non-existent location, and username and password enabled.

Happy to screen share.

[tsg]

Aha! I could also reproduce it now. Thanks!

[tsg]

Got a fix in #4772. This was kind of embarrassing 😊