Merge branch 'main' into azure-eventhub-dependencies

.ci/packaging.groovy

@@ -222,7 +222,6 @@ def generateSteps() {
     'heartbeat',
     'metricbeat',
     'packetbeat',
-    'x-pack/agentbeat',
     'x-pack/auditbeat',
     'x-pack/dockerlogbeat',
     'x-pack/filebeat',
@@ -282,9 +281,6 @@ def generateLinuxStep(beat) {
       withEnv(["HOME=${env.WORKSPACE}", "PLATFORMS=${linuxPlatforms()}", "BEATS_FOLDER=${beat}"]) {
         withGithubNotify(context: "Packaging Linux ${beat}") {
           deleteDir()
-          if (beat.equals('x-pack/agentbeat') || beat.equals('x-pack/osquerybeat')) {
-            sh(label: 'install msitools', script: '.buildkite/scripts/install-msitools.sh')
-          }
           release('snapshot')
           dir("${BASE_DIR}"){
             pushCIDockerImages(arch: 'amd64')
@@ -382,6 +378,16 @@ def release(type){
     withEnv([
       "DEV=${!type.equals('staging')}"
     ]) {
+      dir("${BASE_DIR}"){
+        if (env.BEATS_FOLDER.equals('x-pack/agentbeat') || env.BEATS_FOLDER.equals('x-pack/osquerybeat')) {
+          // sh(label: 'install msitools', script: '.buildkite/scripts/install-msitools.sh')
+          sh '''#!/usr/bin/env bash
+                set -euo pipefail
+                sudo apt-get update -y
+                DEBIAN_FRONTEND=noninteractive sudo apt-get install --no-install-recommends --yes msitools
+          '''
+        }
+      }
       dockerLogin(secret: "${DOCKERELASTIC_SECRET}", registry: "${DOCKER_REGISTRY}")
       dir("${env.BEATS_FOLDER}") {
         sh(label: "mage package ${type} ${env.BEATS_FOLDER} ${env.PLATFORMS}", script: 'mage package')
@@ -451,4 +457,4 @@ def notifyStatus(def args = [:]) {
                              to: "${env.NOTIFY_TO}",
                              subject: subject,
                              body: "Build: (<${env.RUN_DISPLAY_URL}|here>).\n ${body}")
-}
+}

CHANGELOG.next.asciidoc

@@ -133,6 +133,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - [threatintel] MISP splitting fix for empty responses {issue}38739[38739] {pull}38917[38917]
 - Prevent GCP Pub/Sub input blockage by increasing default value of `max_outstanding_messages` {issue}35029[35029] {pull}38985[38985]
 - Fix config validation for CEL and HTTPJSON inputs when using password grant authentication and `client.id` or `client.secret` are not present. {pull}38962[38962]
+- Updated Websocket input title to align with existing inputs {pull}39006[39006]
 - Upgrade azure-event-hubs-go and azure-storage-blob-go dependencies. {pull}38861[38861]
 
 *Heartbeat*

x-pack/agentbeat/magefile.go

@@ -134,6 +134,14 @@ func TestPackages() error {
 	return devtools.TestPackages()
 }
 
+// Package packages the Beat for IronBank distribution.
+//
+// Use SNAPSHOT=true to build snapshots.
+func Ironbank() error {
+	fmt.Println(">> Ironbank: this module is not subscribed to the IronBank releases.")
+	return nil
+}
+
 // Update is an alias for running fields, dashboards, config.
 func Update() {
 	callForEachBeat("update")

x-pack/filebeat/docs/inputs/input-websocket.asciidoc

@@ -8,6 +8,10 @@
 === Websocket Input
 experimental[]
 
+++++
+<titleabbrev>Websocket</titleabbrev>
+++++
+
 The `websocket` input reads messages from a websocket server or api endpoint. This input uses the `CEL engine` and the `mito` library interally to parse and process the messages. Having support for `CEL` allows you to parse and process the messages in a more flexible way. It has many similarities with the `cel` input as to how the `CEL` programs are written but deviates in the way the messages are read and processed. The `websocket` input is a `streaming` input and can only be used to read messages from a websocket server or api endpoint. 
 
 This input supports: