x-pack/filebeat/input/entityanalytics/provider/activedirectory: fix u…

…se before init bug (#42682) (#42701) The transaction tracker was not being initialised until after the first call to publishMarker in runFullSync, resulting in a nil pointer deference when the the tracker Add method is called. (cherry picked from commit 1473ae9) Co-authored-by: Dan Kortschak <[email protected]>
elastic · Feb 13, 2025 · 1f13d81 · 1f13d81
1 parent 476987f
commit 1f13d81
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -130,6 +130,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Ensure netflow custom field configuration is applied. {issue}40735[40735] {pull}40730[40730]
 - Fix a bug in Salesforce input to only handle responses with 200 status code {pull}41015[41015]
 - [Journald] Fixes handling of `journalctl` restart. A known symptom was broken multiline messages when there was a restart of journalctl while aggregating the lines. {issue}41331[41331] {pull}42595[42595]
+- Fix entityanalytics activedirectory provider full sync use before initialization bug. {pull}42682[42682]
 
 *Heartbeat*
 

diff --git a/x-pack/filebeat/input/entityanalytics/provider/activedirectory/activedirectory.go b/x-pack/filebeat/input/entityanalytics/provider/activedirectory/activedirectory.go
@@ -257,10 +257,9 @@ func (p *adInput) runFullSync(inputCtx v2.Context, store *kvstore.Store, client
 			}
 		}
 		if len(users) != 0 {
-			var tracker *kvstore.TxTracker
 			start := time.Now()
+			tracker := kvstore.NewTxTracker(ctx)
 			p.publishMarker(start, start, inputCtx.ID, true, client, tracker)
-			tracker = kvstore.NewTxTracker(ctx)
 			for _, u := range users {
 				p.publishUser(u, state, inputCtx.ID, client, tracker)
 			}