package/filebeat: new package

From: "Yann E. MORIN" <[email protected]>

For some packages, it may be necessary to pass extra extldflags. For example, some packages will need to be able to specify what ld to use, and so will need to pass -fuse-ld={bfd,gold} as extldflags.

Introduce FOO_EXTLDFLAGS, that packages can set to pass such flags.

Signed-off-by Yann E. MORIN <[email protected]>

---
  docs/manual/adding-packages-golang.adoc | 6 ++++--
  package/pkg-golang.mk                   | 6 +++++-
  2 files changed, 9 insertions(+), 3 deletions(-)

docs/manual/adding-packages-golang.adoc +4 -2

index c952cde577..c238050096 100644
@@ -84,8 +84,10 @@ therefore only use a few of them, or none.
    infrastructure will automatically generate a minimal +go.mod+ file
    in the package source tree if it doesn't exist.
 
-* +FOO_LDFLAGS+ and +FOO_TAGS+ can be used to pass respectively the
-  +LDFLAGS+ or the +TAGS+ to the +go+ build command.
+* +FOO_LDFLAGS+, +FOO_EXTLDFLAGS+, and +FOO_TAGS+ can be used to pass
+  respectively the go +LDFLAGS+ (via the `-ldflags` command line flag),
+  the external linker flags +EXTLDFLAGS+ (via the `-extldflags`
+  command line flag), or the +TAGS+ to the +go+ build command.
 
  * +FOO_BUILD_TARGETS+ can be used to pass the list of targets that
    should be built. If +FOO_BUILD_TARGETS+ is not specified, it

package/pkg-golang.mk +1 -1

index 7ba82284f3..ba49ce153e 100644
@@ -101,10 +101,14 @@ ifndef $(2)_BUILD_CMDS
  ifeq ($(4),target)
 
  ifeq ($(BR2_STATIC_LIBS),y)
-$(2)_LDFLAGS += -extldflags '-static'
+$(2)_EXTLDFLAGS += -static

From: "Yann E. MORIN" <[email protected]>

filebeat is one of the many Elastic 'beats' that can send data to a remote ElasticSearch (ES) engine or to a remote logstash.

This is a go package, but the ES developers are using layers upon layers of abstractions to try and fail to provide an easier build mechanism.

First, they use a convoluted set of Makefiles to wrap a lot of arcane commands. There is no obvious way to follow what's going on, especially as...

... second they use mage [0] as a first layer to abstract 'go build', but mage really does not play nicely in cross-compilation; it is a PITA to use, and it very easily gets confused. Building natively is also very fragile and heavily dependent on the user's environment (env, path, tools versions...), which makes it fails quite easily and spectacularly...

But in the end, a simple "go build" works like a charm to build the beats' executable. This means we can just use Buildroot's golang-package infrastructure. Wee!

However, there does not seem to be actual commands to generate the dataset (like the modules definitions or the kibana dashboards) from source (they basically are YAML descriptions, but they need to be aggregated in a special way, not just concatenated); even running the Makefile as described in the documentation for a native build does not produce those modules...

To work around this issue, we just grab the release tarball, and copy all the data from it. This is an ugly workaround, indeed, but this is the best we can do before our mental health degrades beyond hope...

On AArch64, the link may fail with errors like:

[...]
github.com/elastic/beats/v7/filebeat
# github.com/elastic/beats/v7/filebeat
[...]/output/per-package/filebeat/host/lib/go/pkg/tool/linux_amd64/link: running [...]/output/per-package/filebeat/host/bin/aarch64-linux-gcc failed: exit status 1
collect2: fatal error: cannot find ‘ld’
compilation terminated.

The error happens because go, on AArch64, will forcibly want to use ld.gold, as a workaround for a alleged binutils breakage:

     https://github.com/golang/go/commit/3c8d6af8e02bbf230c2bef9f181d8ea393068299
     https://github.com/golang/go/issues/22040
     https://go-review.googlesource.com/c/go/+/22141
     https://sourceware.org/bugzilla/show_bug.cgi?id=19962

This is supposedly fixed in binutils 2.36, but go still wants to use ld.gold. As not all toolchains have gold, force use of ld.bfd, which in practice has been shown to work correctly with recent-ish binutils
versions: the link succeeds, and the program runs. This may still break on older toolchains, especially those with older binutils that did not have ld.gold (so they would not have ld.bfd either, just ld), but better have breakage on older toolchains, for which there's not much we can do, than on newer ones.

(the same issue also occurred for ARM, but the ld.gold requirement was dropped in cd77738198ff, first included in go 1.21, which is now what we use in Buildroot)

On riscv64, the build fails because of missing atomic ints:
github.com/elastic/beats/v7/libbeat/statestore github.com/elastic/beats/v7/filebeat/inputsource/common/streaming # github.com/elastic/beats/v7/libbeat/statestore libbeat/statestore/store.go:28:18: undefined: atomic.Int libbeat/statestore/store.go:48:20: undefined: atomic.MakeInt github.com/elastic/beats/v7/libbeat/processors/ratelimit github.com/elastic/beats/v7/filebeat/input/kafka
# github.com/elastic/beats/v7/filebeat/inputsource/common/streaming filebeat/inputsource/common/streaming/listener.go:48:25: undefined: atomic.Int # github.com/elastic/beats/v7/libbeat/processors/ratelimit libbeat/processors/ratelimit/token_bucket.go:53:20: undefined: atomic.Uint libbeat/processors/ratelimit/token_bucket.go:96:21: undefined: atomic.Uint libbeat/processors/ratelimit/token_bucket.go:193:34: undefined: atomic.MakeUint # github.com/elastic/beats/v7/filebeat/input/kafka filebeat/input/kafka/input.go:395:23: undefined: atomic.MakeInt

That's because beats reimplement/wrap atomic ints, but the file implementing those is not whitelisted for riscv64 (yes, 7.0 because this is what kafka's input module imports even in 8.2.2):

     https://github.com/elastic/beats/blame/7.0/libbeat/common/atomic/atomic64.go#L18

and it has still not changed in 8.2.2 anyway:

     https://github.com/elastic/beats/blame/v8.2.2/libbeat/common/atomic/atomic64.go#L18

(thanks to Vincent Fazzio for pointing this out.)

Finally, we only package version 8.8.2, because any later version can't be vendored, see: https://github.com/elastic/beats/issues/36949

[0] https://magefile.org/

Signed-off-by Yann E. MORIN <[email protected]>

Cc Vincent Fazio <[email protected]>

---
  package/Config.in                 |  1 +
  package/filebeat/Config.in        | 14 +++++
  package/filebeat/filebeat.default |  1 +
  package/filebeat/filebeat.hash    |  5 ++
  package/filebeat/filebeat.mk      | 85 +++++++++++++++++++++++++++++++
  package/filebeat/filebeat.service | 13 +++++
  package/filebeat/filebeat.yml     |  5 ++
  7 files changed, 124 insertions(+)

create mode 100644 package/filebeat/Config.in create mode 100644 package/filebeat/filebeat.default create mode 100644 package/filebeat/filebeat.hash create mode 100644 package/filebeat/filebeat.mk create mode 100644 package/filebeat/filebeat.service create mode 100644 package/filebeat/filebeat.yml

package/Config.in +1 -0

index 4e489c4706..11deb7ccee 100644
@@ -2350,6 +2350,7 @@ endif
  	source "package/fail2ban/Config.in"
  	source "package/fastd/Config.in"
  	source "package/fcgiwrap/Config.in"
+	source "package/filebeat/Config.in"
  	source "package/firewalld/Config.in"
  	source "package/flannel/Config.in"
  	source "package/fmc/Config.in"

package/filebeat/Config.in new file +14 -0

new file mode 100644
index 0000000000..78adae11cd
@@ -0,0 +1,14 @@
+config BR2_PACKAGE_FILEBEAT
+	bool "filebeat"
+	depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS
+	depends on !BR2_RISCV_64
+	help
+	  Lightweight data shippers
+
+	  Beats is a free and open platform for single-purpose data
+	  shippers. They send data from hundreds or thousands of
+	  machines and systems to Logstash or Elasticsearch.
+
+	  This package only installs filebeat.
+
+	  https://www.elastic.co/products/beats

package/filebeat/filebeat.default new file +1 -0

new file mode 100644
index 0000000000..ab51c81018
@@ -0,0 +1 @@
+FILEBEAT_OPTS=-c /etc/filebeat/filebeat.yml

package/filebeat/filebeat.hash new file +5 -0

new file mode 100644
index 0000000000..11a86f81f2
@@ -0,0 +1,5 @@
+# Locally computed
+sha256  713d109760bbdfcdb30651861bd3899945114325ed65cb2bd744d7ff02c399a9  filebeat-8.8.2.tar.gz
+sha256  23e50a1dead216922519026a878d3c75cc2860eb4ca6de186ac64100f85623f3  filebeat-8.8.2-linux-x86_64.tar.gz
+sha256  7f0eb504dd0b8b090b52cff384296249be3168374f271b142ce03130c987c8e5  LICENSE.txt
+sha256  928b3ded5ea8db33fadb8e5bea8bb10e1f79d2a904e9c97745f54b57e6a1588b  NOTICE.txt

package/filebeat/filebeat.mk new file +85 -0

new file mode 100644
index 0000000000..02cc8d917f
@@ -0,0 +1,85 @@
+################################################################################
+#
+# filebeat
+#
+################################################################################
+
+# When updating, regenerate the list of licenses, below
+FILEBEAT_VERSION = 8.8.2
+FILEBEAT_SITE = $(call github,elastic,beats,v$(FILEBEAT_VERSION))
+FILEBEAT_DL_SUBDIR = elastic-beats
+FILEBEAT_EXTRA_SITE = https://artifacts.elastic.co/downloads/beats/filebeat
+FILEBEAT_EXTRA_SOURCE = filebeat-$(FILEBEAT_VERSION)-linux-x86_64.tar.gz
+FILEBEAT_EXTRA_DOWNLOADS = $(FILEBEAT_EXTRA_SITE)/$(FILEBEAT_EXTRA_SOURCE)
+
+# License list obtained with:
+#   sed -r -e '/^Licence type.*: (.+)$/!d; s//\1/;' NOTICE.txt |sort -u
+FILEBEAT_LICENSE = \
+	Apache-2.0, \
+	BSD, \
+	BSD-2-Clause, \
+	BSD-2-Clause-FreeBSD, \
+	BSD-3-Clause, \
+	Elastic, \
+	ISC, \
+	MIT, \
+	MPL-2.0
+
+FILEBEAT_LICENSE_FILES = LICENSE.txt NOTICE.txt
+
+FILEBEAT_GOMOD = github.com/elastic/beats/v7
+FILEBEAT_BUILD_TARGETS = filebeat
+
+ifeq ($(BR2_arm)$(BR2_aarch64),y)
+# On aarch64, go will forcibly use gold, on the assumption that ld.bfd is
+# broken, but that is supposedly fixed on binutils master, and at least
+# released in 2.36 onward. So, we force it back to use ld.bfd, as not all
+# toolchains have ld.gold (for example, the Bootlin toolchians, built with
+# Buildroot, do not).
+FILEBEAT_EXTLDFLAGS += -fuse-ld=bfd
+endif
+
+FILEBEAT_PREBUILT_MODULES_DIR = $(@D)/.elastic-pre-built-for-modules
+
+# We extract the pre-built release of filebeat, just for the modules
+# and stuff (building those from the actual source tree seems to be
+# so arcanne that it is not documented anywhere). Modules are but
+# a large collection of yaml and json files, though.
+define FILEBEAT_EXTRACT_MODULES
+	$(Q)mkdir -p $(FILEBEAT_PREBUILT_MODULES_DIR)
+	$(Q)$(call suitable-extractor,$(FILEBEAT_EXTRA_SOURCE)) \
+		$(FILEBEAT_DL_DIR)/$(FILEBEAT_EXTRA_SOURCE) \
+	|$(TAR) --strip-components=1 \
+		-C $(FILEBEAT_PREBUILT_MODULES_DIR) \
+		$(TAR_OPTIONS) -
+endef
+FILEBEAT_POST_EXTRACT_HOOKS += FILEBEAT_EXTRACT_MODULES
+
+# This layout mirrors the one in the .deb released by Elastic
+define FILEBEAT_INSTALL_MODULES
+	$(Q)mkdir -p $(TARGET_DIR)/etc/filebeat $(TARGET_DIR)/usr/share/filebeat
+	cp -a \
+		$(FILEBEAT_PREBUILT_MODULES_DIR)/fields.yml \
+		$(FILEBEAT_PREBUILT_MODULES_DIR)/modules.d \
+		$(TARGET_DIR)/etc/filebeat/
+	cp -a \
+		$(FILEBEAT_PREBUILT_MODULES_DIR)/kibana \
+		$(FILEBEAT_PREBUILT_MODULES_DIR)/module \
+		$(TARGET_DIR)/usr/share/filebeat/
+endef
+FILEBEAT_POST_INSTALL_TARGET_HOOKS += FILEBEAT_INSTALL_MODULES
+
+define FILEBEAT_INSTALL_CONFIG
+	$(INSTALL) -D -m 0644 $(FILEBEAT_PKGDIR)/filebeat.yml \
+		$(TARGET_DIR)/etc/filebeat/filebeat.yml
+	$(INSTALL) -D -m 0644 $(FILEBEAT_PKGDIR)/filebeat.default \
+		$(TARGET_DIR)/etc/default/filebeat
+endef
+FILEBEAT_POST_INSTALL_TARGET_HOOKS += FILEBEAT_INSTALL_CONFIG
+
+define FILEBEAT_INSTALL_INIT_SYSTEMD
+	$(INSTALL) -D -m 0644 $(FILEBEAT_PKGDIR)/filebeat.service \
+		$(TARGET_DIR)/usr/lib/systemd/system/filebeat.service
+endef
+
+$(eval $(golang-package))

package/filebeat/filebeat.service new file +13 -0

new file mode 100644
index 0000000000..08234f50b6
@@ -0,0 +1,13 @@
+[Unit]
+Description=Filebeat
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+UMask=0027
+EnvironmentFile=/etc/default/filebeat
+ExecStart=/usr/bin/filebeat --environment systemd $FILEBEAT_OPTS
+Restart=always
+
+[Install]
+WantedBy=multi-user.target

package/filebeat/filebeat.yml new file +0 -0

new file mode 100644
index 0000000000..147c1d55dd

This two-patch series introduces filebeat, an ElasticSearch-related tool to grab local log files and send them to a remote ElasticSearch server.