[9.4](backport #51781) Osquerybeat: emit pack_name and query_name in scheduled query results

[mergify]

Proposed commit message

Emit pack_name and query_name in osquerybeat scheduled query results.

WHAT:

• Add a new optional pack_name config field to packs, next to the existing pack_id.
• Scheduled pack queries — both osquery native interval schedules (handleQueryResult) and osquerybeat RRULE schedules (recurrenceQueryHandler) — now include two additional fields in their result documents and their synthetic response documents:
  • pack_name: from the new pack_name pack config field.
  • query_name: from the pack's queries config map key.
• Both fields are threaded through QueryInfo and emitted only when set. Live/ad-hoc queries are unaffected (they emit neither).

WHY:
The Osquery Manager dashboards group and label scheduled query results by pack and query name. Without pack_name/query_name on the documents, those dashboards cannot render scheduled pack results correctly.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works.
• I have added an entry in ./changelog/fragments using the changelog tool.

Disruptive User Impact

None. The pack_name field is opt-in and both fields are additive; documents without the new config keep their previous shape. pack_id and the existing correlation fields are unchanged.

How to test this PR locally

1. Build osquerybeat from this branch.
2. Configure a pack with a pack_name and one or more scheduled queries (native interval and/or rrule_schedule):

   osquery:
     packs:
       my_pack:
         pack_id: "pack-uuid-123"
         pack_name: "My Pack"
         default_native_schedule:
           interval: 60
           start_date: "2026-01-01T00:00:00Z"
         queries:
           uptime:
             query: "select * from uptime"

3. Confirm the osquery_manager.result documents include pack_name: "My Pack" and query_name: "uptime", and the osquery_manager.action.responses synthetic response document includes the same fields.
4. Confirm live/ad-hoc query results do not include pack_name/query_name.

Related issues

Use cases

• The Osquery Manager dashboards group scheduled results by pack and query name using the new pack_name/query_name fields.

---

This is an automatic backport of pull request #51781 done by [Mergify](https://mergify.com).

[mergify]

Cherry-pick of 5d82c71 has failed:

On branch mergify/bp/9.4/pr-51781
Your branch is up to date with 'origin/9.4'.

You are currently cherry-picking commit 5d82c7117.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	new file:   changelog/fragments/1783335960-osquerybeat-pack-name-query-name.yaml
	modified:   x-pack/osquerybeat/beater/action_handler.go
	modified:   x-pack/osquerybeat/beater/action_handler_test.go
	modified:   x-pack/osquerybeat/beater/config_plugin_test.go
	modified:   x-pack/osquerybeat/beater/osquerybeat.go
	modified:   x-pack/osquerybeat/beater/osquerybeat_publisher_test.go
	modified:   x-pack/osquerybeat/internal/pub/publisher.go
	modified:   x-pack/osquerybeat/internal/pub/publisher_test.go

Unmerged paths:
  (use "git add/rm <file>..." as appropriate to mark resolution)
	both modified:   x-pack/osquerybeat/beater/config_plugin.go
	deleted by us:   x-pack/osquerybeat/beater/recurrence_query_handler.go
	both modified:   x-pack/osquerybeat/internal/config/osquery.go

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)
• /test : Run the Buildkite pipeline.

[infra-vault-gh-plugin-prod]

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

[github-actions]

TL;DR

Build 49324 is failing because the 9.4 backport branch is left in an unresolved cherry-pick state. The same conflict is reported by both jobs: pre-commit finds conflict markers, while make check update also fails because the retained RRULE handler imports a scheduler package that does not exist on the 9.4 base.

Remediation

• Resolve the three unmerged paths from the cherry-pick (x-pack/osquerybeat/beater/config_plugin.go, x-pack/osquerybeat/internal/config/osquery.go, and x-pack/osquerybeat/beater/recurrence_query_handler.go); do not leave <<<<<<<, =======, or >>>>>>> markers in the tree.
• Reconcile the RRULE portion with 9.4: the current backport retains recurrence_query_handler.go, whose import at line 22 references github.com/elastic/beats/v7/x-pack/osquerybeat/internal/scheduler, but the 9.4 tree does not provide that package. Either backport the complete RRULE scheduler implementation and its integration, or drop the RRULE-specific changes and backport only functionality supported by 9.4.
• Rerun make -C x-pack/osquerybeat check update, make check-no-changes, and pre-commit run --all-files after resolving the branch.

Investigation details

Root Cause

The cherry-pick status in the existing PR comment identifies config_plugin.go and internal/config/osquery.go as both modified, and recurrence_query_handler.go as deleted by the 9.4 side. The Buildkite checkout nevertheless contains conflict markers in the first two files and the unresolved handler content. This is why the pre-commit check-merge-conflict hook fails and why Go vet cannot resolve the handler import.

Evidence

• Build: https://buildkite.com/elastic/beats/builds/49324
• Jobs: x-pack/osquerybeat: Run check/update; x-pack/osquerybeat: Run pre-commit
• Pre-commit log: x-pack/osquerybeat/internal/config/osquery.go:76,83,114 and x-pack/osquerybeat/beater/config_plugin.go:46,49,57 (plus lines 265-315) report merge-conflict strings.
• Check/update log: beater/recurrence_query_handler.go:22:2: no required module provides package github.com/elastic/beats/v7/x-pack/osquerybeat/internal/scheduler.

Verification

No code changes were made and no additional tests were run; the diagnosis is based on the captured Buildkite logs, PR #51902 metadata/diff, and the checked-out source tree.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[github-actions]

TL;DR

The golangci-lint step fails on all three platform jobs because PR #51902 introduces seven lint diagnostics in x-pack/osquerybeat. Fix the reported test error handling/logger usage and production logger/deprecation/unused-code issues, then rerun the workflow.

Remediation

• Handle the three unchecked return values reported in x-pack/osquerybeat/beater/action_handler_test.go at lines 167, 172, and 182.
• Replace the forbidden logp.NewLogger calls in action_handler_test.go:70, config_plugin_test.go:55, and osquerybeat.go:112 with the repository-approved injected logger/test logger pattern.
• Address SA1019 at osquerybeat.go:279 by migrating from deprecated b.Manager.Start to the supported lifecycle API, or add a narrowly justified suppression if migration is not part of this backport. Remove or wire getDiagnosticsQueryExecutor at osquerybeat.go:390.
• Run the scoped osquerybeat tests and golangci-lint (or the repository check target) before rerunning CI.

Investigation details

Root Cause

The workflow runs golangci-lint v2.12.2 with --whole-files; the changed osquerybeat files fail errcheck, forbidigo, staticcheck, and unused. The identical diagnostics appear on macOS, Ubuntu, and Windows, so this is source-level rather than platform-specific.

Evidence

• Workflow: https://github.com/elastic/beats/actions/runs/29312374361
• Jobs/step: lint (macos-latest), lint (ubuntu-latest), and lint (windows-latest) / golangci-lint
• Key log excerpt: action_handler_test.go:167:27, :172:26, :182:23 errcheck; action_handler_test.go:70:17, config_plugin_test.go:55:17, osquerybeat.go:112:9 forbidigo; osquerybeat.go:279:12 SA1019; osquerybeat.go:390:24 unused; followed by issues found.

Validation

No tests were run by this read-only detective workflow. All three CI jobs completed the same failing lint step.

Follow-up

The earlier Buildkite detective comment on this PR reported unresolved backport conflicts; this report covers the separate, current golangci-lint failure and does not repeat that diagnosis.

---

What is this? | From workflow: PR Actions Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.