@@ -678,6 +678,50 @@ func TestFilestreamTakeOverFromLogInput(t *testing.T) {
678678	}
679679}
680680
681+ func  TestFilestreamHasOwnerAndGroup (t  * testing.T ) {
682+ 	cfg  :=  ` 
683+ filebeat.inputs: 
684+   - type: filestream 
685+     enabled: true 
686+     paths: 
687+       - /var/log/*.log 
688+ 	include_file_owner_name: true 
689+ 	include_file_owner_group_name: true 
690+ 
691+ output.discard.enabled: true 
692+ logging: 
693+   level: debug 
694+   metrics: 
695+     enabled: false 
696+ ` 
697+ 	filebeat  :=  integration .NewBeat (
698+ 		t ,
699+ 		"filebeat" ,
700+ 		"../../filebeat.test" ,
701+ 	)
702+ 
703+ 	// Write configuration file and start Filebeat 
704+ 	filebeat .WriteConfigFile (cfg )
705+ 	filebeat .Start ()
706+ 
707+ 	// Wait for log 
708+ 	filebeat .WaitPublishedEvents (20 * time .Second , 5 )
709+ 	type  evt  struct  {
710+ 		Message  string  `json:"message"` 
711+ 	}
712+ 
713+ 	evts  :=  integration .GetEventsFromFileOutput [evt ](filebeat , 5 , false )
714+ 	for  i , e  :=  range  evts  {
715+ 		owner , err  :=  e .Fields .GetValue ("log.file.owner" )
716+ 		require .NoError (t , err , "event %d: could not get owner field" , i )
717+ 		require .NotEmpty (t , owner , "event %d: owner field is empty" , i )
718+ 
719+ 		group , err  :=  e .Fields .GetValue ("log.file.group" )
720+ 		require .NoError (t , err , "event %d: could not get group field" , i )
721+ 		require .NotEmpty (t , group , "event %d: group field is empty" , i )
722+ 	}
723+ }
724+ 
681725// getConfig renders the template in testdata/<folder>/<tmplPath> using vars 
682726func  getConfig (t  * testing.T , vars  map [string ]any , folder , tmplPath  string ) string  {
683727	t .Helper ()
0 commit comments