add_host_metadata processor fails with GetNativeSystemInfo failed: invalid argument

[danleerunk]

• Version: Tested Filebeat and Metricbeat 6.3.2
• Operating System: Windows 10 Pro, Version 1803, x64
• Steps to Reproduce:
  Add the add_host_metadata processor to the configuration yaml for either beat and attempt to start:

processors:
- add_host_metadata: ~

The x64 version of both Filebeat and Metricbeat fail with the following message:

Exiting: error initializing publisher: error initializing processors: 1 error: GetNativeSystemInfo failed: invalid argument

The x86 versions of both programs start without issue, however. I suspect this will impact all beats, but I've only tested Filebeat and Metricbeat.

Initially discovered by @strawgate

[strawgate]

This issue also occurs with Winlogbeat (so likely all beats).

[strawgate]

It looks like the issue is here:

https://github.com/elastic/go-windows/blob/5d078fa9943c7549875ad32ed0f5cc0efa9546e1/zsyscall_windows.go#L54

On 64-bit windows, r1 gets set to 0 which then causes the logic here to proceed into an error state and return syscall.EINVAL (which gets printed as "invalid argument").

On 32-bit windows, r1 gets set to 262144 which is 0x400000 which then returns successfully.

This syscall does not provide a return code per: https://msdn.microsoft.com/en-us/library/windows/desktop/ms724340(v=vs.85).aspx -- i might be misunderstanding the semantics of GO syscalls but I think checking that r1 == 0 is incorrect here. If that's the case then why does it return 0x400000 on x86....

[andrewkroh]

Nice. I was just checking our builds in go-sysinfo to confirm that it does work there on Windows 2016 (x64). https://ci.appveyor.com/project/elastic-beats/go-sysinfo/build/40#L97

The fix will require an adjustment to this line which generates that file to tell it that the method has no return. https://github.com/elastic/go-windows/blob/5d078fa9943c7549875ad32ed0f5cc0efa9546e1/kernel32.go#L32

[strawgate]

It looks like that test might be running on 2012 R2

"os": {
		      "family": "windows",
		      "platform": "windows",
		      "name": "Windows Server 2012 R2 Datacenter",
		      "version": "6.3",
		      "major": 3,
		      "minor": 0,
		      "patch": 0,
		      "build": "9600.19023"
		    }

I dont see another example of how to change it to not have a return or I'd make a PR for that -- I closed my initial PR as I didnt realize they were generated files.