[Auditbeat] in windows-2008-r2 got some flakiness tests for TestEventReader

[v1v]

Flaky Test

• Test Name: TestEventReader and TestEventReader/deleted
• Link:
• Branch: [CI] support windows-2008-r2 #19791
• Artifact Link: https://gist.github.com/v1v/e62b58944fccec8f8262a358cf95c32b
• Notes:
  https://beats-ci.elastic.co/job/Beats/job/beats-windows-mbp/job/PR-19791/1/execution/node/1385/log/ <-- this might not be accessible in the future, therefore access the artifact link

Stack Trace

15:43:46  C:\Users\jenkins\workspace\Beats_beats-windows-mbp_PR-19791\src\github.com\elastic\beats\auditbeat>mage  build unitTest 
15:44:26  >> build: Building auditbeat
15:45:12  Generated fields.yml for auditbeat to C:\Users\jenkins\workspace\Beats_beats-windows-mbp_PR-19791\src\github.com\elastic\beats\auditbeat\fields.yml
15:45:12  >> go test: Unit Testing
15:47:04  FAILURES:
15:47:04  Package: github.com/elastic/beats/v7/auditbeat/module/file_integrity
15:47:04  Test:    TestEventReader
15:47:04  ----
15:47:04  Package: github.com/elastic/beats/v7/auditbeat/module/file_integrity
15:47:04  Test:    TestEventReader/deleted
15:47:04      TestEventReader/deleted: eventreader_test.go:320: {RootFields:null ModuleFields:null MetricSetFields:{"event":{"action":["updated"],"category":["file"],"kind":"event","type":["change"]},"file":{"ctime":"2020-07-09T14:46:46.1438758Z","drive_letter":"C","extension":".txt","hash":{"sha1":"430ce34d020724ed75a196dfc2ad67c77772d169"},"inode":"562949953713560","mtime":"2020-07-09T14:46:46.1536418Z","owner":"BUILTIN\\Administrators","path":"C:\\Windows\\TEMP\\audit259018545\\test2.txt","size":12,"type":"file","uid":"S-1-5-32-544"},"hash":{"sha1":"430ce34d020724ed75a196dfc2ad67c77772d169"}} Index: ID: Namespace: Timestamp:2020-07-09 14:46:46.1575482 +0000 UTC Error:<nil> Host: Service: Took:2.9297ms Period:0s DisableTimeSeries:false}
15:47:04      TestEventReader/deleted: eventreader_test.go:178: 
15:47:04  ----

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.