Cherry-pick #16116 to 7.x: [Journalbeat] Improve parsing of syslog.pid in journalbeat to strip the username when present #16213
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…he username when present (elastic#16116) * Improve parsing of syslog.pid in journalbeat to strip the username in pid when present. * Add entry to changelog with pull ID. * Improve the comment on the username strip. (cherry picked from commit 6a7dbd6)
kaiyan-sheng
approved these changes
Feb 10, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Cherry-pick of PR #16116 to 7.x branch. Original message:
What does this PR do?
Fixes an issue where syslog.pid is reported as an integer followed by the username.
Why is it important?
In some cases journald reports the syslog.pid with the user that started the pid following it. This strips the username and only sends the pid in the event.
Checklist
[ ] I have made corresponding change to the default configuration filesAuthor's Checklist
How to test this PR locally
I was unable to reproduce this issue with journald on Ubuntu 19.10. But was able to reproduce the failure using a unit test, so best way to test is just by running the unit tests.
Related issues
Use cases
Screenshots
Logs