Filebeat fails to decode a zero-value time.Time from the registry

[belimawr]

• Version: main
• Operating System: Linux (probably all)

The registry entry for a filestream input looks like this:

{
  "k": "filestream::my-filestream-id::native::158035-34",
  "v": {
    "meta": {
      "identifier_name": "native",
      "source": "/tmp/flog.log"
    },
    "ttl": 0,
    "updated": [
      281470681743360,
      18446744011573954816
    ],
    "cursor": null
  }
}

The updated field is a timestamp encoded by our typeconv package. time.Time are encoded as a array of two uint64, the code that does this transformation is:
https://github.com/elastic/elastic-agent-libs/blob/f17cb1de6337603f16629d4754bcf8c27e0cc8be/transform/typeconv/typeconv.go#L217-L268.

This code alone can successfully encode/decode a zero-value time.Time, however when it gets serialised/deserialised as JSON by Filebeat's registry it is read as 0000-12-31T23:55:44Z, here is an example of the state being dumped by delve:

github.com/elastic/beats/v7/filebeat/input/filestream/internal/input-logfile.state {
        TTL: 0,
        Updated: time.Time(0000-12-31T23:55:44Z){
                wall: 0,
                ext: -256,
                loc: *time.Location nil,},
        Cursor: interface {} nil,
        Meta: interface {}(map[string]interface {}) [
                "source": *(*interface {})(0xc000174ce8), 
                "identifier_name": *(*interface {})(0xc000174cf8), 
        ],}
(dlv) 

Only the first entry from a file in the registry contains a zero-value timestamp in the updated field, at the moment I am not aware of any bug caused by this behaviour. updated seem only to be used to perform some store clean up tasks.

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!