feat: Make opt-in with include_file_owner_name and include_file_owner_group_name

Author: Hiruma31

filebeat/input/filestream/config.go

@@ -49,6 +49,11 @@ type config struct {
 	// This feature is experimental and subject to change.
 	GZIPExperimental bool `config:"gzip_experimental"`
 
+	// Whether to add the file owner name and group to the event metadata.
+	// Disabled by default.
+	IncludeFileOwnerName 		bool `config:"include_file_owner_name"`
+	IncludeFileOwnerGroupName	bool `config:"include_file_owner_group_name"`
+
 	// -1 means that registry will never be cleaned, disabling clean_inactive.
 	// Setting it to 0 also disables clean_inactive
 	// "clean_inactive" is parsed, again, and used by internal/input-logfile/manager.go
@@ -134,6 +139,8 @@ func defaultConfig() config {
 		Reader:         defaultReaderConfig(),
 		Paths:          []string{},
 		Close:          defaultCloserConfig(),
+		IncludeFileOwnerName: 		false,
+		IncludeFileOwnerGroupName: 	false,
 		CleanInactive:  -1,
 		CleanRemoved:   true,
 		HarvesterLimit: 0,

filebeat/input/filestream/input.go

@@ -61,14 +61,16 @@ type fileMeta struct {
 // filestream is the input for reading from files which
 // are actively written by other applications.
 type filestream struct {
-	readerConfig         readerConfig
-	encodingFactory      encoding.EncodingFactory
-	closerConfig         closerConfig
-	deleterConfig        deleterConfig
-	parsers              parser.Config
-	takeOver             loginp.TakeOverConfig
-	scannerCheckInterval time.Duration
-	gzipExperimental     bool
+	readerConfig              readerConfig
+	encodingFactory           encoding.EncodingFactory
+	closerConfig              closerConfig
+	deleterConfig             deleterConfig
+	parsers                   parser.Config
+	takeOver                  loginp.TakeOverConfig
+	scannerCheckInterval      time.Duration
+	gzipExperimental          bool
+	includeFileOwnerName      bool
+	includeFileOwnerGroupName bool
 
 	// Function references for testing
 	waitGracePeriodFn func(
@@ -132,17 +134,19 @@ func configure(cfg *conf.C, log *logp.Logger) (loginp.Prospector, loginp.Harvest
 	}
 
 	filestream := &filestream{
-		readerConfig:      c.Reader,
-		encodingFactory:   encodingFactory,
-		closerConfig:      c.Close,
-		parsers:           c.Reader.Parsers,
-		takeOver:          c.TakeOver,
-		gzipExperimental:  c.GZIPExperimental,
-		deleterConfig:     c.Delete,
-		waitGracePeriodFn: waitGracePeriod,
-		tickFn:            time.Tick,
-		removeFn:          os.Remove,
-		statFn:            os.Stat,
+		readerConfig:              c.Reader,
+		encodingFactory:           encodingFactory,
+		closerConfig:              c.Close,
+		parsers:                   c.Reader.Parsers,
+		takeOver:                  c.TakeOver,
+		gzipExperimental:          c.GZIPExperimental,
+		includeFileOwnerName:      c.IncludeFileOwnerName,
+		includeFileOwnerGroupName: c.IncludeFileOwnerGroupName,
+		deleterConfig:             c.Delete,
+		waitGracePeriodFn:         waitGracePeriod,
+		tickFn:                    time.Tick,
+		removeFn:                  os.Remove,
+		statFn:                    os.Stat,
 	}
 
 	// Read the scan interval from the prospector so we can use during the
@@ -481,7 +485,7 @@ func (inp *filestream) open(
 
 	r = readfile.NewStripNewline(r, inp.readerConfig.LineTerminator)
 
-	r = readfile.NewFilemeta(r, fs.newPath, fs.desc.Info, fs.desc.Fingerprint, offset)
+	r = readfile.NewFilemeta(r, fs.newPath, fs.desc.Info, inp.includeFileOwnerName, inp.includeFileOwnerGroupName, fs.desc.Fingerprint, offset)
 
 	r = inp.parsers.Create(r, log)
 

libbeat/reader/readfile/fs_metafields_other.go

@@ -35,7 +35,7 @@ const (
 	group       = "log.file.group"
 )
 
-func setFileSystemMetadata(fi file.ExtendedFileInfo, fields mapstr.M) error {
+func setFileSystemMetadata(fi file.ExtendedFileInfo, fields mapstr.M, includeOwner bool, includeGroup bool) error {
 	osstate := fi.GetOSState()
 	_, err := fields.Put(deviceIDKey, strconv.FormatUint(osstate.Device, 10))
 	if err != nil {
@@ -46,22 +46,26 @@ func setFileSystemMetadata(fi file.ExtendedFileInfo, fields mapstr.M) error {
 		return fmt.Errorf("failed to set %q: %w", inodeKey, err)
 	}
 
-	o, err := user.LookupId(strconv.FormatUint(osstate.UID, 10))
-	if err != nil {
-		return fmt.Errorf("failed to lookup uid %q: %w", osstate.UID, err)
-	}
-	_, err = fields.Put(owner, o.Username)
-	if err != nil {
-		return fmt.Errorf("failed to set %q: %w", owner, err)
+	if includeOwner {
+		o, err := user.LookupId(strconv.FormatUint(osstate.UID, 10))
+		if err != nil {
+			return fmt.Errorf("failed to lookup uid %q: %w", osstate.UID, err)
+		}
+		_, err = fields.Put(owner, o.Username)
+		if err != nil {
+			return fmt.Errorf("failed to set %q: %w", owner, err)
+		}
 	}
 
-	g, err := user.LookupGroupId(strconv.FormatUint(osstate.GID, 10))
-	if err != nil {
-		return fmt.Errorf("failed to lookup gid %q: %w", osstate.GID, err)
-	}
-	_, err = fields.Put(group, g.Name)
-	if err != nil {
-		return fmt.Errorf("failed to set %q: %w", group, err)
+	if includeGroup {
+		g, err := user.LookupGroupId(strconv.FormatUint(osstate.GID, 10))
+		if err != nil {
+			return fmt.Errorf("failed to lookup gid %q: %w", osstate.GID, err)
+		}
+		_, err = fields.Put(group, g.Name)
+		if err != nil {
+			return fmt.Errorf("failed to set %q: %w", group, err)
+		}
 	}
 	return nil
 }

libbeat/reader/readfile/fs_metafields_windows.go

@@ -31,7 +31,7 @@ const (
 	volKey   = "log.file.vol"
 )
 
-func setFileSystemMetadata(fi file.ExtendedFileInfo, fields mapstr.M) error {
+func setFileSystemMetadata(fi file.ExtendedFileInfo, fields mapstr.M, includeOwner bool, includeGroup bool) error {
 	osstate := fi.GetOSState()
 	_, err := fields.Put(idxhiKey, strconv.FormatUint(osstate.IdxHi, 10))
 	if err != nil {

libbeat/reader/readfile/metafields.go

@@ -28,17 +28,19 @@ import (
 // Reader produces lines by reading lines from an io.Reader
 // through a decoder converting the reader it's encoding to utf-8.
 type FileMetaReader struct {
-	reader      reader.Reader
-	path        string
-	fi          file.ExtendedFileInfo
-	fingerprint string
-	offset      int64
+	reader       reader.Reader
+	path         string
+	fi           file.ExtendedFileInfo
+	includeOwner bool
+	includeGroup bool
+	fingerprint  string
+	offset       int64
 }
 
 // New creates a new Encode reader from input reader by applying
 // the given codec.
-func NewFilemeta(r reader.Reader, path string, fi file.ExtendedFileInfo, fingerprint string, offset int64) reader.Reader {
-	return &FileMetaReader{r, path, fi, fingerprint, offset}
+func NewFilemeta(r reader.Reader, path string, fi file.ExtendedFileInfo, includeOwner bool, includeGroup bool, fingerprint string, offset int64) reader.Reader {
+	return &FileMetaReader{r, path, fi, includeOwner, includeGroup, fingerprint, offset}
 }
 
 // Next reads the next line from it's initial io.Reader
@@ -61,7 +63,7 @@ func (r *FileMetaReader) Next() (reader.Message, error) {
 		},
 	})
 
-	err = setFileSystemMetadata(r.fi, message.Fields)
+	err = setFileSystemMetadata(r.fi, message.Fields, r.includeOwner, r.includeGroup)
 	if err != nil {
 		return message, fmt.Errorf("failed to set file system metadata: %w", err)
 	}

libbeat/reader/readfile/metafields_other_test.go

@@ -35,7 +35,7 @@ func createTestFileInfo() file.ExtendedFileInfo {
 		name: "filename",
 		size: 42,
 		time: time.Now(),
-		sys:  &syscall.Stat_t{Dev: 17, Ino: 999},
+		sys:  &syscall.Stat_t{Dev: 17, Ino: 999, Uid: 0, Gid: 0},
 	})
 }
 
@@ -54,5 +54,17 @@ func checkFields(t *testing.T, expected, actual mapstr.M) {
 	err = actual.Delete(inodeKey)
 	require.NoError(t, err)
 
+	o, err := actual.GetValue(owner)
+	require.NoError(t, err)
+	require.Equal(t, "root", o)
+	err = actual.Delete(owner)
+	require.NoError(t, err)
+
+	g, err := actual.GetValue(group)
+	require.NoError(t, err)
+	require.Equal(t, "root", g)
+	err = actual.Delete(group)
+	require.NoError(t, err)
+
 	require.Equal(t, expected, actual)
 }

libbeat/reader/readfile/metafields_test.go

@@ -52,7 +52,7 @@ func TestMetaFields(t *testing.T) {
 	path := "test/path"
 	offset := int64(0)
 
-	in := &FileMetaReader{msgReader(messages), path, createTestFileInfo(), "hash", offset}
+	in := &FileMetaReader{msgReader(messages), path, createTestFileInfo(), true, true, "hash", offset}
 	for {
 		msg, err := in.Next()
 		if errors.Is(err, io.EOF) {
@@ -66,8 +66,6 @@ func TestMetaFields(t *testing.T) {
 					"file": mapstr.M{
 						"path":        path,
 						"fingerprint": "hash",
-						"owner":      "root",
-						"group":     "root",
 					},
 					"offset": offset,
 				},