Skip to content

Commit

Permalink
Fix event time calculation on docker events (elastic#24318)
Browse files Browse the repository at this point in the history
(cherry picked from commit 8b673e6)
  • Loading branch information
ChrsMark committed Mar 3, 2021
1 parent 93b1f61 commit 0e302d3
Show file tree
Hide file tree
Showing 2 changed files with 29 additions and 1 deletion.
24 changes: 24 additions & 0 deletions CHANGELOG.next.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,30 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
- Add service resource in k8s cluster role. {pull}20546[20546]
- [Metricbeat][Kubernetes] Change cluster_ip field from ip to keyword. {pull}20571[20571]
- The `o365input` and `o365` module now recover from an authentication problem or other fatal errors, instead of terminating. {pull}21258[21258]
- Rename cloud.provider `az` value to `azure` inside the add_cloud_metadata processor. {pull}20689[20689]
- Add missing country_name geo field in `add_host_metadata` and `add_observer_metadata` processors. {issue}20796[20796] {pull}20811[20811]
- [Autodiscover] Handle input-not-finished errors in config reload. {pull}20915[20915]
- Explicitly detect missing variables in autodiscover configuration, log them at the debug level. {issue}20568[20568] {pull}20898[20898]
- Fix `libbeat.output.write.bytes` and `libbeat.output.read.bytes` metrics of the Elasticsearch output. {issue}20752[20752] {pull}21197[21197]
- The `o365input` and `o365` module now recover from an authentication problem or other fatal errors, instead of terminating. {pull}21259[21258]
- Orderly close processors when processing pipelines are not needed anymore to release their resources. {pull}16349[16349]
- Fix memory leak and events duplication in docker autodiscover and add_docker_metadata. {pull}21851[21851]
- Fixed documentation for commands in beats dev guide {pull}22194[22194]
- Fix parsing of expired licences. {issue}21112[21112] {pull}22180[22180]
- Fix duplicated pod events in kubernetes autodiscover for pods with init or ephemeral containers. {pull}22438[22438]
- Fix FileVersion contained in Windows exe files. {pull}22581[22581]
- Fix index template loading when the new index format is selected. {issue}22482[22482] {pull}22682[22682]
- Periodic metrics in logs will now report `libbeat.output.events.active` and `beat.memstats.rss`
as gauges (rather than counters). {pull}22877[22877]
- Use PROGRAMDATA environment variable instead of C:\ProgramData for windows install service {pull}22874[22874]
- Fix reporting of cgroup metrics when running under Docker {pull}22879[22879]
- Fix typo in config docs {pull}23185[23185]
- Fix `nested` subfield handling in generated Elasticsearch templates. {issue}23178[23178] {pull}23183[23183]
- Fix CPU usage metrics on VMs with dynamic CPU config {pull}23154[23154]
- Add FAQ entry for madvdontneed variable {pull}23429[23429]
- Fix panic due to unhandled DeletedFinalStateUnknown in k8s OnDelete {pull}23419[23419]
- Fix error loop with runaway CPU use when the Kafka output encounters some connection errors {pull}23484[23484]
- Fix issue discovering docker containers and metadata after reconnections {pull}24318[24318]

*Auditbeat*

Expand Down
6 changes: 5 additions & 1 deletion libbeat/common/docker/watcher.go
Original file line number Diff line number Diff line change
Expand Up @@ -276,7 +276,11 @@ func (w *watcher) watch() {
select {
case event := <-events:
w.log.Debugf("Got a new docker event: %v", event)
lastValidTimestamp = time.Unix(event.Time, event.TimeNano)
if event.TimeNano > 0 {
lastValidTimestamp = time.Unix(0, event.TimeNano)
} else {
lastValidTimestamp = time.Unix(event.Time, 0)
}
lastReceivedEventTime = w.clock.Now()

switch event.Action {
Expand Down

0 comments on commit 0e302d3

Please sign in to comment.