x-pack/winlogbeat/module: fix and enable ingest pipeline tests

[efd6]

Proposed commit message

x-pack/winlogbeat/module: fix and enable ingest pipeline tests

The module ingest pipeline tests (security, sysmon, powershell) were
never run in CI. The test files are tagged //go:build !windows but
all CI steps ran on Windows agents, so the tests were structurally
excluded. This resulted in several issues accumulating undetected:

- Pipeline count assertions were stale (5 pipelines, but
  security_standard was added as a 6th).
- The ECS version in golden files drifted from 1.12.0 to 8.17.0.
- The splitSidList Painless function in security_standard.yml used
  splitOnToken which returns a String[] incompatible with ES 9.x
  document context, causing event 4908 to fail with
  illegal_argument_exception.
- The powershell.file.script_block_hash field produced by the
  fingerprint processor was undocumented in fields.yml.

Fix the pipeline script to split on \s+ with regex and store results
as ArrayList. Add the missing field definition. Update test assertions
and regenerate golden files against the current ES. Add a Linux CI
step to the x-pack/winlogbeat Buildkite pipeline so these tests
run on every build.

Assisted-By: Cursor

Note

Not user-facing, so no changelog entry.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
• I have added an entry in ./changelog/fragments using the changelog tool.

Disruptive User Impact

How to test this PR locally

Related issues

Use cases

Screenshots

Logs

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)
• /test : Run the Buildkite pipeline.

[github-actions]

🔍 Preview links for changed docs

• docs/reference/winlogbeat/exported-fields-powershell.md

[github-actions]

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

TL;DR

The Linux x-pack/winlogbeat: Module Ingest Tests job is a completed test failure, not an infrastructure timeout: the runner reports DONE 125 tests, 4 failures in 395.319s and exits with status 1. The supplied Buildkite log is truncated before the individual failing test names, assertion diffs, and ingest errors, so a source-level root cause cannot be identified defensibly from the available evidence.

Remediation

• Re-run the job with the complete test output, or attach/read x-pack/winlogbeat/build/TEST-go-unit.xml and TEST-go-unit.out.json from the failed build artifacts.
• Capture the four failing test case names and their assertion or Elasticsearch simulate errors; those details are required to map the failures to the changed fixtures or security_standard.yml.
• After applying the targeted fix, rerun cd x-pack/winlogbeat && mage build goUnitTest.

Investigation details

Root Cause

Inconclusive from the prefetched log. The job completed 125 tests and recorded four failures, but the available log ends with a serialized ingest-pipeline dump and the aggregate result. It does not include the failing subtest names, expected-versus-actual diffs, or pipeline execution errors needed to trace the failure to a changed source file.

Evidence

• Build: https://buildkite.com/elastic/beats/builds/49350
• Job/step: x-pack/winlogbeat: Module Ingest Tests, https://buildkite.com/elastic/beats-xpack-winlogbeat/builds/30546
• Key log excerpt: DONE 125 tests, 4 failures in 395.319s (line 113), followed by Error: failed to execute go: exit status 1 (line 115).
• The job command was cd x-pack/winlogbeat followed by mage build goUnitTest (failure summary lines 9-11).

Verification

Not run locally. These ingest tests require the test Elasticsearch container and the missing failing-case details would still be needed to validate a specific fix.

Follow-up

Please provide the full test-collector output or the uploaded JUnit/JSON artifacts before making a source change; diagnosing from the aggregate count would risk attributing the failure to the wrong PR change.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[infra-vault-gh-plugin-prod]

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

[andrewkroh]

LGTM.

The PR I mentioned when we were talking is #47395. I don't remember exactly what I was debugging but when I was looking at this so long ago, but I added error checking on the simulate pipeline API response in pipelineIngestedDocument of x-pack/winlogbeat/module/wintest/simulate.go (probably for when the Painless is bad and a pipeline won't even load). Just mentioning it in case it helps debugging failures.