Skip to content

Conversation

@mauri870
Copy link
Member

Proposed commit message

Windows, starting with Go 1.23+, provides high-resolution timers, but the effective clock resolution remains around 0.5 ms. When event processing is very fast, the elapsed time between start and end timestamps may be less than this resolution, resulting in a diff of zero.

A zero event duration is interpreted as absence of value and discarded when setting event fields.

This commit ensures a minimum duration is set to preserve event.duration in the ingested event.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

How to test this PR locally

Related issues

Windows, starting with Go 1.23+, provides high-resolution timers, but the
effective clock resolution remains around 0.5 ms. When event processing is
very fast, the elapsed time between start and end may be below this
resolution, resulting in a zero duration.

A zero event duration is interpreted as absence of value and discarded when
setting event fields. This commit ensures a minimum duration is always set.
@mauri870 mauri870 self-assigned this May 22, 2025
@mauri870 mauri870 added cleanup Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team labels May 22, 2025
@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels May 22, 2025
@github-actions
Copy link
Contributor

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

  • run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

@mauri870 mauri870 added bug and removed cleanup labels May 22, 2025
@mergify
Copy link
Contributor

mergify bot commented May 22, 2025

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @mauri870? 🙏.
For such, you'll need to label your PR with:

  • The upcoming major version of the Elastic Stack
  • The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

  • backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit
  • backport-active-all is the label that automatically backports to all active branches.
  • backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
  • backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

@mauri870 mauri870 added backport-8.17 Automated backport with mergify backport-8.18 Automated backport to the 8.18 branch backport-8.19 Automated backport to the 8.19 branch backport-9.0 Automated backport to the 9.0 branch labels May 22, 2025
@mauri870 mauri870 changed the title metricbeat: ensure event.duration field is not discarded on Windows metricbeat: ensure event.duration field is not discarded May 22, 2025
@mauri870 mauri870 changed the title metricbeat: ensure event.duration field is not discarded metricbeat: ensure event.duration field is not discarded on Windows May 22, 2025
@mauri870 mauri870 marked this pull request as ready for review May 22, 2025 22:35
@mauri870 mauri870 requested a review from a team as a code owner May 22, 2025 22:35
@mauri870 mauri870 requested review from khushijain21 and rdner May 22, 2025 22:35
@elasticmachine
Copy link
Contributor

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

@mauri870 mauri870 force-pushed the event-duration-windows-zero branch from 6856bef to 32f6b57 Compare May 23, 2025 11:53
@mauri870 mauri870 force-pushed the event-duration-windows-zero branch from 487ad2d to 04a7578 Compare May 23, 2025 12:09
@pierrehilbert pierrehilbert merged commit 7839c6b into elastic:main May 23, 2025
46 checks passed
mergify bot pushed a commit that referenced this pull request May 23, 2025
…44442)

* metricbeat: ensure event.duration field is not discarded on Windows

Windows, starting with Go 1.23+, provides high-resolution timers, but the
effective clock resolution remains around 0.5 ms. When event processing is
very fast, the elapsed time between start and end may be below this
resolution, resulting in a zero duration.

A zero event duration is interpreted as absence of value and discarded when
setting event fields. This commit ensures a minimum duration is always set.

* linter fixes

* use rand.N

* add changelog

(cherry picked from commit 7839c6b)
mergify bot pushed a commit that referenced this pull request May 23, 2025
…44442)

* metricbeat: ensure event.duration field is not discarded on Windows

Windows, starting with Go 1.23+, provides high-resolution timers, but the
effective clock resolution remains around 0.5 ms. When event processing is
very fast, the elapsed time between start and end may be below this
resolution, resulting in a zero duration.

A zero event duration is interpreted as absence of value and discarded when
setting event fields. This commit ensures a minimum duration is always set.

* linter fixes

* use rand.N

* add changelog

(cherry picked from commit 7839c6b)
mergify bot pushed a commit that referenced this pull request May 23, 2025
…44442)

* metricbeat: ensure event.duration field is not discarded on Windows

Windows, starting with Go 1.23+, provides high-resolution timers, but the
effective clock resolution remains around 0.5 ms. When event processing is
very fast, the elapsed time between start and end may be below this
resolution, resulting in a zero duration.

A zero event duration is interpreted as absence of value and discarded when
setting event fields. This commit ensures a minimum duration is always set.

* linter fixes

* use rand.N

* add changelog

(cherry picked from commit 7839c6b)
mergify bot pushed a commit that referenced this pull request May 23, 2025
…44442)

* metricbeat: ensure event.duration field is not discarded on Windows

Windows, starting with Go 1.23+, provides high-resolution timers, but the
effective clock resolution remains around 0.5 ms. When event processing is
very fast, the elapsed time between start and end may be below this
resolution, resulting in a zero duration.

A zero event duration is interpreted as absence of value and discarded when
setting event fields. This commit ensures a minimum duration is always set.

* linter fixes

* use rand.N

* add changelog

(cherry picked from commit 7839c6b)
mauri870 added a commit that referenced this pull request May 23, 2025
…t discarded on Windows (#44453)

* metricbeat: ensure event.duration field is not discarded on Windows (#44442)

* metricbeat: ensure event.duration field is not discarded on Windows

Windows, starting with Go 1.23+, provides high-resolution timers, but the
effective clock resolution remains around 0.5 ms. When event processing is
very fast, the elapsed time between start and end may be below this
resolution, resulting in a zero duration.

A zero event duration is interpreted as absence of value and discarded when
setting event fields. This commit ensures a minimum duration is always set.

* linter fixes

* use rand.N

* add changelog

(cherry picked from commit 7839c6b)

* Update CHANGELOG.next.asciidoc

---------

Co-authored-by: Mauri de Souza Meneguzzo <[email protected]>
Co-authored-by: Pierre HILBERT <[email protected]>
mauri870 added a commit that referenced this pull request May 23, 2025
…44442) (#44455)

* metricbeat: ensure event.duration field is not discarded on Windows

Windows, starting with Go 1.23+, provides high-resolution timers, but the
effective clock resolution remains around 0.5 ms. When event processing is
very fast, the elapsed time between start and end may be below this
resolution, resulting in a zero duration.

A zero event duration is interpreted as absence of value and discarded when
setting event fields. This commit ensures a minimum duration is always set.

* linter fixes

* use rand.N

* add changelog

(cherry picked from commit 7839c6b)

Co-authored-by: Mauri de Souza Meneguzzo <[email protected]>
mauri870 added a commit that referenced this pull request May 23, 2025
…44442) (#44454)

* metricbeat: ensure event.duration field is not discarded on Windows

Windows, starting with Go 1.23+, provides high-resolution timers, but the
effective clock resolution remains around 0.5 ms. When event processing is
very fast, the elapsed time between start and end may be below this
resolution, resulting in a zero duration.

A zero event duration is interpreted as absence of value and discarded when
setting event fields. This commit ensures a minimum duration is always set.

* linter fixes

* use rand.N

* add changelog

(cherry picked from commit 7839c6b)

Co-authored-by: Mauri de Souza Meneguzzo <[email protected]>
mauri870 added a commit that referenced this pull request May 23, 2025
… discarded on Windows (#44456)

* metricbeat: ensure event.duration field is not discarded on Windows (#44442)

* metricbeat: ensure event.duration field is not discarded on Windows

Windows, starting with Go 1.23+, provides high-resolution timers, but the
effective clock resolution remains around 0.5 ms. When event processing is
very fast, the elapsed time between start and end may be below this
resolution, resulting in a zero duration.

A zero event duration is interpreted as absence of value and discarded when
setting event fields. This commit ensures a minimum duration is always set.

* linter fixes

* use rand.N

* add changelog

(cherry picked from commit 7839c6b)

* Update CHANGELOG.next.asciidoc

* fix signature of module.NewWrapper

---------

Co-authored-by: Mauri de Souza Meneguzzo <[email protected]>
Co-authored-by: Pierre HILBERT <[email protected]>
@ldemailly
Copy link

For anyone landing here from:
https://blog.mauri870.com/posts/why-time-differences-cant-be-trusted/

While they work on golang/go#67066 you can use https://github.com/loov/hrtime

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport-8.17 Automated backport with mergify backport-8.18 Automated backport to the 8.18 branch backport-8.19 Automated backport to the 8.19 branch backport-9.0 Automated backport to the 9.0 branch bug Team:Elastic-Agent-Data-Plane Label for the Agent Data Plane team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants