mod: replace gopkg.in/natefinch/lumberjack.v2 with elastic fork

[efd6]

Proposed commit message

See title.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
• I have added an entry in ./changelog/fragments using the changelog tool.

Disruptive User Impact

How to test this PR locally

Related issues

• Closes mod: replace github.com/natefinch/lumberjack with elastic fork #49092
• Fixes x-pack/filebeat/input: tracer leaks goroutines via lumberjack.Logger.Close #49035

Use cases

Screenshots

Logs

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)
• /test : Run the Buildkite pipeline.

[github-actions]

TL;DR

The Filebeat Go integration job did not reach Go integration tests. It failed while Docker was building the generated filebeat-oss and filebeat-oss-wolfi images because Chainguard returned HTTP 500 for the anonymous token request to cgr.dev. This is an external registry/infrastructure failure, not an error introduced by the lumberjack dependency replacement.

Remediation

• Retry the Buildkite job; the log shows the same cgr.dev/chainguard/wolfi-base:latest token failure for both image builds.
• If the retry fails again, investigate Chainguard registry availability or the Buildkite runner access to (cgr.dev/redacted) before changing PR code.

Investigation details

Root Cause

The job command was cd filebeat followed by mage goIntegTest, but packaging failed before tests could execute. The generated Dockerfile uses FROM --platform=linux/amd64 cgr.dev/chainguard/wolfi-base AS home; both the regular and Wolfi Filebeat image builds failed during base-image metadata resolution.

Evidence

• Build: https://buildkite.com/elastic/beats/builds/49452
• Job/step: Filebeat: Go Integration Tests
• Key log excerpt: ERROR: failed to fetch anonymous token: unexpected status from GET request to (cgr.dev/redacted) 500 Internal Server Error
• The build then reported: failed building filebeat-oss and failed building filebeat-oss-wolfi.
• PR mod: replace gopkg.in/natefinch/lumberjack.v2 with elastic fork #51950 changes the lumberjack module/imports and does not modify the Docker image definition or packaging logic.

Verification

No Go tests ran because the image build failed before test execution.

Follow-up

A successful retry should confirm whether this was transient registry availability.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[efd6]

/test

[infra-vault-gh-plugin-prod]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request