x-pack/winlogbeat/module: fix and enable ingest pipeline tests

The module ingest pipeline tests (security, sysmon, powershell) were
never run in CI. The test files are tagged //go:build !windows but
all CI steps ran on Windows agents, so the tests were structurally
excluded. This resulted in several issues accumulating undetected:

- Pipeline count assertions were stale (5 pipelines, but
  security_standard was added as a 6th).
- The ECS version in golden files drifted from 1.12.0 to 8.17.0.
- The splitSidList Painless function in security_standard.yml used
  splitOnToken which returns a String[] incompatible with ES 9.x
  document context, causing event 4908 to fail with
  illegal_argument_exception.
- The powershell.file.script_block_hash field produced by the
  fingerprint processor was undocumented in fields.yml.

Fix the pipeline script to split on \s+ with regex and store results
as ArrayList. Add the missing field definition. Update test assertions
and regenerate golden files against the current ES. Add a Linux CI
step to the x-pack/winlogbeat Buildkite pipeline so these tests
run on every build.

Assisted-By: Cursor

Author: efd6

.buildkite/x-pack/pipeline.xpack.winlogbeat.yml

@@ -80,6 +80,36 @@ steps:
     key: "x-pack-winlogbeat-mandatory-tests"
 
     steps:
+      - label: ":linux: x-pack/winlogbeat: Module Ingest Tests"
+        key: "mandatory-module-ingest-tests"
+        command: |
+          set -eo pipefail
+          cd x-pack/winlogbeat
+          mage build goUnitTest
+        retry:
+          automatic:
+            - limit: 1
+        plugins:
+          - *dockerhub_login_plugin
+          - *docker_elastic_login_plugin
+          - test-collector#v1.10.2:
+              files: "x-pack/winlogbeat/build/TEST-*.xml"
+              format: "junit"
+              branches: "main"
+              debug: true
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_UBUNTU_X86_64}"
+          machineType: "${GCP_HI_PERF_MACHINE_TYPE}"
+          disk_size: 100
+          disk_type: "pd-ssd"
+        artifact_paths:
+          - "x-pack/winlogbeat/build/*.xml"
+          - "x-pack/winlogbeat/build/*.json"
+        notify:
+          - github_commit_status:
+              context: "x-pack/winlogbeat: Module Ingest Tests"
+
       - label: ":windows: x-pack/winlogbeat Win 2019 Unit Tests"
         key: "mandatory-win-2019-unit-tests"
         command: |

docs/reference/winlogbeat/exported-fields-powershell.md

@@ -178,6 +178,12 @@ Data related to the PowerShell engine.
 
 Data related to the executed script file.
 
+**`powershell.file.script_block_hash`**
+:   SHA-256 hash of the executed script block.
+
+    type: keyword
+
+
 **`powershell.file.script_block_id`**
 :   Id of the executed script block.
 

x-pack/winlogbeat/module/powershell/_meta/fields.yml

@@ -120,6 +120,10 @@
       type: group
       description: Data related to the executed script file.
       fields:
+        - name: script_block_hash
+          type: keyword
+          description: SHA-256 hash of the executed script block.
+
         - name: script_block_id
           type: keyword
           description: Id of the executed script block.

x-pack/winlogbeat/module/powershell/fields.go

@@ -2,18 +2,22 @@
   {
     "@timestamp": "2020-05-14T07:00:30.8914235Z",
     "ecs": {
-      "version": "1.12.0"
+      "version": "8.17.0"
     },
     "event": {
       "action": "Engine Lifecycle",
-      "category": "process",
+      "category": [
+        "process"
+      ],
       "code": "400",
-      "ingested": "2025-01-15T10:02:22.041691914Z",
+      "ingested": "2026-07-14T03:51:16.442888256Z",
       "kind": "event",
       "module": "powershell",
       "provider": "PowerShell",
       "sequence": 13,
-      "type": "start"
+      "type": [
+        "start"
+      ]
     },
     "host": {
       "name": "vagrant",
@@ -62,18 +66,22 @@
   {
     "@timestamp": "2020-05-14T07:01:14.3715076Z",
     "ecs": {
-      "version": "1.12.0"
+      "version": "8.17.0"
     },
     "event": {
       "action": "Engine Lifecycle",
-      "category": "process",
+      "category": [
+        "process"
+      ],
       "code": "400",
-      "ingested": "2025-01-15T10:02:22.042381068Z",
+      "ingested": "2026-07-14T03:51:16.443386273Z",
       "kind": "event",
       "module": "powershell",
       "provider": "PowerShell",
       "sequence": 13,
-      "type": "start"
+      "type": [
+        "start"
+      ]
     },
     "host": {
       "name": "vagrant",
@@ -124,18 +132,22 @@
   {
     "@timestamp": "2020-05-14T11:32:51.9892568Z",
     "ecs": {
-      "version": "1.12.0"
+      "version": "8.17.0"
     },
     "event": {
       "action": "Engine Lifecycle",
-      "category": "process",
+      "category": [
+        "process"
+      ],
       "code": "400",
-      "ingested": "2025-01-15T10:02:22.042395560Z",
+      "ingested": "2026-07-14T03:51:16.443397663Z",
       "kind": "event",
       "module": "powershell",
       "provider": "PowerShell",
       "sequence": 13,
-      "type": "start"
+      "type": [
+        "start"
+      ]
     },
     "host": {
       "name": "vagrant",
@@ -184,18 +196,22 @@
   {
     "@timestamp": "2020-06-04T07:20:27.7472275Z",
     "ecs": {
-      "version": "1.12.0"
+      "version": "8.17.0"
     },
     "event": {
       "action": "Engine Lifecycle",
-      "category": "process",
+      "category": [
+        "process"
+      ],
       "code": "400",
-      "ingested": "2025-01-15T10:02:22.042402302Z",
+      "ingested": "2026-07-14T03:51:16.443403844Z",
       "kind": "event",
       "module": "powershell",
       "provider": "PowerShell",
       "sequence": 9,
-      "type": "start"
+      "type": [
+        "start"
+      ]
     },
     "host": {
       "name": "vagrant",

x-pack/winlogbeat/module/powershell/test/testdata/ingest/400.golden.json

@@ -2,18 +2,22 @@
   {
     "@timestamp": "2020-05-14T15:31:22.4269238Z",
     "ecs": {
-      "version": "1.12.0"
+      "version": "8.17.0"
     },
     "event": {
       "action": "Engine Lifecycle",
-      "category": "process",
+      "category": [
+        "process"
+      ],
       "code": "403",
-      "ingested": "2025-01-15T10:02:22.075700098Z",
+      "ingested": "2026-07-14T03:51:16.481393912Z",
       "kind": "event",
       "module": "powershell",
       "provider": "PowerShell",
       "sequence": 33,
-      "type": "end"
+      "type": [
+        "end"
+      ]
     },
     "host": {
       "name": "vagrant",
@@ -61,18 +65,22 @@
   {
     "@timestamp": "2020-05-15T08:11:47.932007Z",
     "ecs": {
-      "version": "1.12.0"
+      "version": "8.17.0"
     },
     "event": {
       "action": "Engine Lifecycle",
-      "category": "process",
+      "category": [
+        "process"
+      ],
       "code": "403",
-      "ingested": "2025-01-15T10:02:22.075721610Z",
+      "ingested": "2026-07-14T03:51:16.481415877Z",
       "kind": "event",
       "module": "powershell",
       "provider": "PowerShell",
       "sequence": 37,
-      "type": "end"
+      "type": [
+        "end"
+      ]
     },
     "host": {
       "name": "vagrant",
@@ -121,18 +129,22 @@
   {
     "@timestamp": "2020-05-15T08:28:53.6266982Z",
     "ecs": {
-      "version": "1.12.0"
+      "version": "8.17.0"
     },
     "event": {
       "action": "Engine Lifecycle",
-      "category": "process",
+      "category": [
+        "process"
+      ],
       "code": "403",
-      "ingested": "2025-01-15T10:02:22.075728323Z",
+      "ingested": "2026-07-14T03:51:16.481422399Z",
       "kind": "event",
       "module": "powershell",
       "provider": "PowerShell",
       "sequence": 37,
-      "type": "end"
+      "type": [
+        "end"
+      ]
     },
     "host": {
       "name": "vagrant",
@@ -188,18 +200,22 @@
   {
     "@timestamp": "2020-06-04T07:20:28.6861939Z",
     "ecs": {
-      "version": "1.12.0"
+      "version": "8.17.0"
     },
     "event": {
       "action": "Engine Lifecycle",
-      "category": "process",
+      "category": [
+        "process"
+      ],
       "code": "403",
-      "ingested": "2025-01-15T10:02:22.075733622Z",
+      "ingested": "2026-07-14T03:51:16.481427357Z",
       "kind": "event",
       "module": "powershell",
       "provider": "PowerShell",
       "sequence": 10,
-      "type": "end"
+      "type": [
+        "end"
+      ]
     },
     "host": {
       "name": "vagrant",

x-pack/winlogbeat/module/powershell/test/testdata/ingest/403.golden.json

@@ -8,18 +8,22 @@
       }
     },
     "ecs": {
-      "version": "1.12.0"
+      "version": "8.17.0"
     },
     "event": {
       "action": "Executing Pipeline",
-      "category": "process",
+      "category": [
+        "process"
+      ],
       "code": "4103",
-      "ingested": "2025-01-15T10:02:22.083664757Z",
+      "ingested": "2026-07-14T03:51:16.489794412Z",
       "kind": "event",
       "module": "powershell",
       "provider": "Microsoft-Windows-PowerShell",
       "sequence": 34,
-      "type": "info"
+      "type": [
+        "info"
+      ]
     },
     "host": {
       "name": "vagrant",
@@ -117,18 +121,22 @@
   {
     "@timestamp": "2020-05-15T08:13:06.7032939Z",
     "ecs": {
-      "version": "1.12.0"
+      "version": "8.17.0"
     },
     "event": {
       "action": "Executing Pipeline",
-      "category": "process",
+      "category": [
+        "process"
+      ],
       "code": "4103",
-      "ingested": "2025-01-15T10:02:22.083688734Z",
+      "ingested": "2026-07-14T03:51:16.489826472Z",
       "kind": "event",
       "module": "powershell",
       "provider": "Microsoft-Windows-PowerShell",
       "sequence": 22,
-      "type": "info"
+      "type": [
+        "info"
+      ]
     },
     "host": {
       "name": "vagrant",

x-pack/winlogbeat/module/powershell/test/testdata/ingest/4103.golden.json

@@ -2,17 +2,21 @@
   {
     "@timestamp": "2020-05-14T11:33:51.3892662Z",
     "ecs": {
-      "version": "1.12.0"
+      "version": "8.17.0"
     },
     "event": {
       "action": "Execute a Remote Command",
-      "category": "process",
+      "category": [
+        "process"
+      ],
       "code": "4104",
-      "ingested": "2025-01-15T10:02:22.104487839Z",
+      "ingested": "2026-07-14T03:51:16.507024201Z",
       "kind": "event",
       "module": "powershell",
       "provider": "Microsoft-Windows-PowerShell",
-      "type": "info"
+      "type": [
+        "info"
+      ]
     },
     "host": {
       "name": "vagrant",
@@ -27,6 +31,7 @@
     "message": "Creating Scriptblock text (1 of 1):\n.\\patata.ps1\n\nScriptBlock ID: 50d2dbda-7361-4926-a94d-d9eadfdb43fa\nPath: ",
     "powershell": {
       "file": {
+        "script_block_hash": "64TcviMSSJ/OdhiN8lVcBQeKWDU=",
         "script_block_id": "50d2dbda-7361-4926-a94d-d9eadfdb43fa",
         "script_block_text": ".\\patata.ps1"
       },
@@ -61,17 +66,21 @@
   {
     "@timestamp": "2020-05-14T11:33:51.3938848Z",
     "ecs": {
-      "version": "1.12.0"
+      "version": "8.17.0"
     },
     "event": {
       "action": "Execute a Remote Command",
-      "category": "process",
+      "category": [
+        "process"
+      ],
       "code": "4104",
-      "ingested": "2025-01-15T10:02:22.104615177Z",
+      "ingested": "2026-07-14T03:51:16.507053493Z",
       "kind": "event",
       "module": "powershell",
       "provider": "Microsoft-Windows-PowerShell",
-      "type": "info"
+      "type": [
+        "info"
+      ]
     },
     "file": {
       "directory": "C:\\Users\\vagrant\\Desktop",