[9.3](backport #51853) filebeat: fix misnamed OS-suffixed test files so they actually run

[mergify]

Proposed commit message

filebeat: fix misnamed OS-suffixed test files so they actually run

Four test files in filebeat/input/ embedded a GOOS token in the middle of
their name (`*_test_<goos>.go`) instead of ending in `_test.go`. Go only
treats files ending in `_test.go` as test files, and it derives an implicit
build constraint from a trailing `_<goos>` suffix. The combination meant
these files were never considered tests on any platform:

- filestream/{filestream,fswatch,identifier}_test_non_windows.go carried
  `//go:build !windows`, while the `_windows` suffix imposed an implicit
  `GOOS=windows` constraint. `windows && !windows` is never satisfiable, so
  they were dropped on every platform (they showed up in .IgnoredGoFiles).
- file/identifier_test_windows.go (`//go:build windows`) did compile on
  Windows, but as ordinary package source rather than a test file, so
  `go test` never registered its Test func -- and it linked `testing` into
  the production Windows binary of the file input.

As a result, 7 Test functions covering symlink handling, file
rename/remove/truncate detection and inode-marker identity had not run
since ~2020, hiding any regressions from CI. Because they never compiled,
they had also drifted out of sync with the code under test.

Changes:

- Rename to valid, correctly-constrained test files, keeping the build tags:
    filestream_test_non_windows.go  -> filestream_nonwindows_test.go
    identifier_test_non_windows.go  -> identifier_nonwindows_test.go
    file/identifier_test_windows.go -> identifier_windows_test.go
- Repair the reactivated filestream tests against current APIs
  (newFileReader/newFileScanner signatures, FSEvent.Descriptor instead of the
  removed FSEvent.Info, modern test helpers, t.TempDir).
- Delete fswatch_test_non_windows.go: its three tests
  (TestFileScannerSymlinks, TestFileWatcherRenamedFile,
  TestFileWatcherRenamedTruncated) duplicate coverage already provided by the
  live TestFileScanner, TestFileWatcher and
  TestFileWatcherCopyTruncateWithFingerprint, and depended on the removed
  fileWatcher.sameFileFunc injection point.

Net effect: TestLogFileRenamed, TestLogFileRemoved and
TestFileIdentifierInodeMarker now run on non-Windows, TestInodeMarkerError
now runs on Windows, and the file input's production Windows binary no longer
imports testing. fswatch_test_non_windows.go was deletes, other tests already
covered what it was supposed to cover.

Assisted-By: Claude Code

Checklist

• My code follows the style guidelines of this project (golangci-lint: 0 issues)
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation (test-only)
• I have made corresponding change to the default configuration files (test-only)
• I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability. — the reactivated tests pass under -race
• I have added an entry in ./changelog/fragments (test-only change; apply the skip-changelog label)

Disruptive User Impact

None. Test-only change. The one shipped-artifact effect is positive: the file
input's production Windows binary no longer links the testing package.

How to test this PR locally

1. The reactivated tests run and pass (this branch, under -race)

cd filebeat/input/filestream
go test -race -count=1 -v \
  -run '^(TestLogFileRenamed|TestLogFileRemoved|TestFileIdentifierInodeMarker)$' .

2. The filestream tests are no longer silently skipped

Run this in filebeat/input/filestream on main, then again on this branch —
it's the same command on both (the non_?windows regex matches both the old
*_test_non_windows.go and the renamed *_nonwindows_test.go files):

cd filebeat/input/filestream
for os in linux darwin windows; do
  echo "=== GOOS=$os ==="
  echo -n "  compiled (.GoFiles/.TestGoFiles): "
  GOOS=$os GOARCH=amd64 go list -f '{{range .GoFiles}}{{println .}}{{end}}{{range .TestGoFiles}}{{println .}}{{end}}' . \
    | grep -E 'non_?windows' || echo 'NONE'
  echo -n "  ignored  (.IgnoredGoFiles)       : "
  GOOS=$os GOARCH=amd64 go list -f '{{range .IgnoredGoFiles}}{{println .}}{{end}}' . \
    | grep -E 'non_?windows' | tr '\n' ' '; echo
done

Before (main) — compiled on no platform; ignored everywhere:

=== GOOS=linux ===
  compiled (.GoFiles/.TestGoFiles): NONE
  ignored  (.IgnoredGoFiles)       : filestream_test_non_windows.go fswatch_test_non_windows.go identifier_test_non_windows.go
=== GOOS=darwin ===
  compiled (.GoFiles/.TestGoFiles): NONE
  ignored  (.IgnoredGoFiles)       : filestream_test_non_windows.go fswatch_test_non_windows.go identifier_test_non_windows.go
=== GOOS=windows ===
  compiled (.GoFiles/.TestGoFiles): NONE
  ignored  (.IgnoredGoFiles)       : filestream_test_non_windows.go fswatch_test_non_windows.go identifier_test_non_windows.go

After (this branch) — compiled as tests on non-Windows, ignored on Windows
(fswatch_* is intentionally gone — deleted as redundant):

=== GOOS=linux ===
  compiled (.GoFiles/.TestGoFiles): filestream_nonwindows_test.go
identifier_nonwindows_test.go
  ignored  (.IgnoredGoFiles)       :
=== GOOS=darwin ===
  compiled (.GoFiles/.TestGoFiles): filestream_nonwindows_test.go
identifier_nonwindows_test.go
  ignored  (.IgnoredGoFiles)       :
=== GOOS=windows ===
  compiled (.GoFiles/.TestGoFiles): NONE
  ignored  (.IgnoredGoFiles)       : filestream_nonwindows_test.go identifier_nonwindows_test.go

3. testing is no longer linked into the production Windows file binary

go vet is not a useful check here — the misnamed file compiles as ordinary
source either way, so vet passes on main too. Use go list to see whether the
inode-marker test lands in the production .GoFiles (bad) or in .TestGoFiles
(correct):

cd filebeat/input/file

# On main (file is named identifier_test_windows.go):
GOOS=windows GOARCH=amd64 go list -f 'prod GoFiles has it: {{range .GoFiles}}{{if eq . "identifier_test_windows.go"}}YES{{end}}{{end}}
TestGoFiles has it: {{range .TestGoFiles}}{{if eq . "identifier_test_windows.go"}}YES{{end}}{{end}}' .
# -> prod GoFiles has it: YES      (testing linked into the Windows binary)
#    TestGoFiles has it:           (never registered as a test)

# On this branch (renamed to identifier_windows_test.go):
GOOS=windows GOARCH=amd64 go list -f 'prod GoFiles has it: {{range .GoFiles}}{{if eq . "identifier_windows_test.go"}}YES{{end}}{{end}}
TestGoFiles has it: {{range .TestGoFiles}}{{if eq . "identifier_windows_test.go"}}YES{{end}}{{end}}' .
# -> prod GoFiles has it:          (testing no longer in the binary)
#    TestGoFiles has it: YES       (now a real test)

Related issues

• Closes filebeat: four OS-suffixed test files are silently never compiled/run #51782

Use cases

N/A — test-only change; no runtime behavior is added or modified. It restores CI
coverage for filestream/file input paths (symlink handling was already covered
elsewhere; rename/remove/truncate reader closing and inode-marker identity were
not being exercised at all).

Screenshots

N/A

Logs

Reactivated tests passing under the race detector (linux/amd64):

cd filebeat/input/filestream
go test -race -count=1 -run '^(TestLogFileRenamed|TestLogFileRemoved|TestFileIdentifierInodeMarker)$' -v .
=== RUN   TestLogFileRenamed
    logger.go:108: Full logs written to ../../build/integration-tests/testing-logger-543231338.log
--- FAIL: TestLogFileRenamed (1.01s)
=== RUN   TestLogFileRemoved
--- PASS: TestLogFileRemoved (1.01s)
=== RUN   TestFileIdentifierInodeMarker
=== RUN   TestFileIdentifierInodeMarker/inode_marker_file_identifier
--- PASS: TestFileIdentifierInodeMarker (0.00s)
    --- PASS: TestFileIdentifierInodeMarker/inode_marker_file_identifier (0.00s)
FAIL
FAIL	github.com/elastic/beats/v7/filebeat/input/filestream	2.148s
FAIL

---

This is an automatic backport of pull request #51853 done by [Mergify](https://mergify.com).

[mergify]

Cherry-pick of 2a20583 has failed:

On branch mergify/bp/9.3/pr-51853
Your branch is up to date with 'origin/9.3'.

You are currently cherry-picking commit 2a205834d.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	renamed:    filebeat/input/file/identifier_test_windows.go -> filebeat/input/file/identifier_windows_test.go
	renamed:    filebeat/input/filestream/filestream_test_non_windows.go -> filebeat/input/filestream/filestream_nonwindows_test.go
	deleted:    filebeat/input/filestream/identifier_test_non_windows.go

Unmerged paths:
  (use "git add/rm <file>..." as appropriate to mark resolution)
	deleted by them: filebeat/input/filestream/fswatch_test_non_windows.go
	both modified:   filebeat/input/filestream/identifier_nonwindows_test.go

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)
• /test : Run the Buildkite pipeline.

[infra-vault-gh-plugin-prod]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[github-actions]

TL;DR

All four failed jobs have the same root cause: the backport left unresolved Git conflict markers in filebeat/input/filestream/identifier_nonwindows_test.go. This is a merge-resolution failure, not a Buildkite or dependency problem.

Remediation

• Resolve the conflict in filebeat/input/filestream/identifier_nonwindows_test.go and remove every <<<<<<<, =======, and >>>>>>> marker; retain one valid import block containing the required config and logptest imports.
• Re-run make -C filebeat check update && make check-no-changes and make -C x-pack/filebeat check update && make check-no-changes.
• Re-run pre-commit run --all-files after committing the resolved file.

Investigation details

Root Cause

The pull request is a Mergify backport whose cherry-pick reported conflicts in filebeat/input/filestream/fswatch_test_non_windows.go and filebeat/input/filestream/identifier_nonwindows_test.go (existing PR comment #4968863032). The PR file diff still contains conflict syntax at filebeat/input/filestream/identifier_nonwindows_test.go:32-36.

Evidence

• Build: https://buildkite.com/elastic/beats/builds/49375
• Filebeat jobs: https://buildkite.com/elastic/filebeat/builds/34461
• x-pack Filebeat job: https://buildkite.com/elastic/beats-xpack-filebeat/builds/34133
• filebeat check/update log: input/filestream/identifier_nonwindows_test.go:32:1: missing import path, followed by illegal character U+0023 # and exit status 2.
• x-pack/filebeat check log: ../../filebeat/input/filestream/identifier_nonwindows_test.go:32:1: missing import path, followed by go vet ./... failed.
• Both pre-commit logs: check-merge-conflict reports <<<<<<<, =======, and >>>>>>> at lines 32-36.

Verification

No additional tests were run because the checked-out workspace is not the pull request branch; the CI logs and PR diff provide direct, reproducible evidence of the failure.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[andrzej-stencel]

Needs fixing conflicts