Skip to content

x-pack/filebeat/input/streaming: do not timeout falcon hose requests#44720

Merged
efd6 merged 1 commit intoelastic:mainfrom
efd6:destale_crowdstrike_falcon_hose
Jun 10, 2025
Merged

x-pack/filebeat/input/streaming: do not timeout falcon hose requests#44720
efd6 merged 1 commit intoelastic:mainfrom
efd6:destale_crowdstrike_falcon_hose

Conversation

@efd6
Copy link
Contributor

@efd6 efd6 commented Jun 10, 2025

Proposed commit message

x-pack/filebeat/input/streaming: do not timeout falcon hose requests

The streaming Crowdstrike falcon follower maintains long-lived requests to the
API, but the default config has a timeout configuration of 180s which means that
requests are killed shortly into their life. Reset the value to zero when making
the client so that this does not happen.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Disruptive User Impact

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Use cases

Screenshots

Logs
@efd6 efd6 self-assigned this Jun 10, 2025
@efd6 efd6 added Filebeat Filebeat bugfix Team:Security-Service Integrations Security Service Integrations Team backport-8.18 Automated backport to the 8.18 branch backport-9.0 Automated backport to the 9.0 branch backport-8.19 Automated backport to the 8.19 branch labels Jun 10, 2025
@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Jun 10, 2025
@github-actions
Copy link
Contributor

github-actions bot commented Jun 10, 2025

🤖 GitHub comments

Expand to view the GitHub comments

Just comment with:

  • run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)
@efd6 efd6 force-pushed the destale_crowdstrike_falcon_hose branch from b5f823c to a50afea Compare June 10, 2025 00:53
@efd6 efd6 marked this pull request as ready for review June 10, 2025 03:55
@efd6 efd6 requested a review from a team as a code owner June 10, 2025 03:55
@elasticmachine
Copy link
Contributor

elasticmachine commented Jun 10, 2025

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
@mergify
Copy link
Contributor

mergify bot commented Jun 10, 2025

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b destale_crowdstrike_falcon_hose upstream/destale_crowdstrike_falcon_hose
git merge upstream/main
git push upstream destale_crowdstrike_falcon_hose
andrewkroh
andrewkroh approved these changes Jun 10, 2025
View reviewed changes
Copy link
Member

@andrewkroh andrewkroh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

😄
@efd6
x-pack/filebeat/input/streaming: do not timeout falcon hose requests
fe35bac 
The streaming Crowdstrike falcon follower maintains long-lived requests to the
API, but the default config has a timeout configuration of 180s which means that
requests are killed shortly into their life. Reset the value to zero when making
the client so that this does not happen.
@efd6 efd6 force-pushed the destale_crowdstrike_falcon_hose branch from a50afea to fe35bac Compare June 10, 2025 21:13
@efd6 efd6 enabled auto-merge (squash) June 10, 2025 21:13
@efd6 efd6 merged commit dfdc12e into elastic:main Jun 10, 2025
34 checks passed
mergify bot pushed a commit that referenced this pull request Jun 10, 2025
@efd6 @mergify
x-pack/filebeat/input/streaming: do not timeout falcon hose requests (#…
12147d4 
…44720)

The streaming Crowdstrike falcon follower maintains long-lived requests to the
API, but the default config has a timeout configuration of 180s which means that
requests are killed shortly into their life. Reset the value to zero when making
the client so that this does not happen.

(cherry picked from commit dfdc12e)
mergify bot pushed a commit that referenced this pull request Jun 10, 2025
@efd6 @mergify
x-pack/filebeat/input/streaming: do not timeout falcon hose requests (#…
59b1f7f 
…44720)

The streaming Crowdstrike falcon follower maintains long-lived requests to the
API, but the default config has a timeout configuration of 180s which means that
requests are killed shortly into their life. Reset the value to zero when making
the client so that this does not happen.

(cherry picked from commit dfdc12e)
mergify bot pushed a commit that referenced this pull request Jun 10, 2025
@efd6 @mergify
x-pack/filebeat/input/streaming: do not timeout falcon hose requests (#…
b358da6 
…44720)

The streaming Crowdstrike falcon follower maintains long-lived requests to the
API, but the default config has a timeout configuration of 180s which means that
requests are killed shortly into their life. Reset the value to zero when making
the client so that this does not happen.

(cherry picked from commit dfdc12e)
This was referenced Jun 10, 2025
Merged
Merged
Merged
efd6 added a commit that referenced this pull request Jun 11, 2025
@mergify @efd6
x-pack/filebeat/input/streaming: do not timeout falcon hose requests (#…
946cc3f 
…44720) (#44745)

The streaming Crowdstrike falcon follower maintains long-lived requests to the
API, but the default config has a timeout configuration of 180s which means that
requests are killed shortly into their life. Reset the value to zero when making
the client so that this does not happen.

(cherry picked from commit dfdc12e)

Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>
efd6 added a commit that referenced this pull request Jun 11, 2025
@mergify @efd6
x-pack/filebeat/input/streaming: do not timeout falcon hose requests (#…
5a1c467 
…44720) (#44747)

The streaming Crowdstrike falcon follower maintains long-lived requests to the
API, but the default config has a timeout configuration of 180s which means that
requests are killed shortly into their life. Reset the value to zero when making
the client so that this does not happen.

(cherry picked from commit dfdc12e)

Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>
efd6 added a commit that referenced this pull request Jun 11, 2025
@mergify @efd6
x-pack/filebeat/input/streaming: do not timeout falcon hose requests (#…
937eaef 
…44720) (#44746)

The streaming Crowdstrike falcon follower maintains long-lived requests to the
API, but the default config has a timeout configuration of 180s which means that
requests are killed shortly into their life. Reset the value to zero when making
the client so that this does not happen.

(cherry picked from commit dfdc12e)

Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport-8.18 Automated backport to the 8.18 branch backport-8.19 Automated backport to the 8.19 branch backport-9.0 Automated backport to the 9.0 branch bugfix Filebeat Filebeat Team:Security-Service Integrations Security Service Integrations Team

4 participants

@efd6 @elasticmachine @andrewkroh @chemamartinez