Winlogbeat failed to ship data under Discover tab.

[amolnater-qasource]

Kibana Build details:

VERSION: 9.0.0 beta1 BC1
BUILD: 83348
COMMIT: fd1f8b62137f14e93716e298e4e931b576e2ca13

Artifact Link: https://staging.elastic.co/9.0.0-beta1-0bb9ce30/downloads/beats/winlogbeat/winlogbeat-9.0.0-beta1-windows-x86_64.zip

Preconditions:

1. 9.0.0 beta BC1 Kibana cloud environment should be available.

Steps to reproduce:

1. Update cloud id and cloud auth for winlogbeat.
2. Now run: .\winlogbeat.exe setup.
3. Observe Dashboards are successfully loaded.
4. Now run: Start-Service winlogbeat.
5. Observe no data under Discover tab is displayed.

NOTE:

• 8.18.0 BC1 winlogbeat works with same credentials and data gets generated under Discover tab.

Expected Result:
Winlogbeat should send data under Discover tab on successful setup.

Logs:
winlogbeat-20250207.ndjson.zip

Screenshot:

[elasticmachine]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[amolnater-qasource]

@muskangulati-qasource Please review.

[muskangulati-qasource]

Secondary review is Done for this ticket!

[pierrehilbert]

@nfritts Could we have someone from your team to have a look here please?

[elasticmachine]

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

[marc-gr]

I opened a PR with a fix for this. The fix will be also backported to 8.18 and 8.x since it is also present there as part of the raw api

[marc-gr]

all the backports are merged

[pierrehilbert]

@amolnater-qasource could you please plan to test this again next week?

[amolnater-qasource]

Sure @pierrehilbert we'll revalidate this once 9.0.0-beta1 BC3 is available.

[Update]: BC2 was built before the PRs are merged,

[amolnater-qasource]

Hi Team,

We have revalidated this issue on latest 9.0.0-beta1 BC3 environment and found it fixed now.

• Winlogbeat is successfully able to ship data under Discover tab.

Build details:
VERSION: 9.0.0-beta1 BC3
BUILD: 83575
COMMIT: a9ae718019d3909912f81e5d388ef597929071a1
Artifact: https://staging.elastic.co/9.0.0-beta1-1d59e665/downloads/beats/winlogbeat/winlogbeat-9.0.0-beta1-windows-x86_64.zip

Screenshot:

Hence, we are closing and marking this issue as QA:Validated.

Thanks!!