From f0dcca8cfe4530535561068d20475a458ff2efaf Mon Sep 17 00:00:00 2001
From: Olga Naidjonoka <olga_naidjonoka@epam.com>
Date: Mon, 4 Dec 2023 15:36:12 +0200
Subject: [PATCH 01/21] wip: getting GH message

---
 .buildkite/filebeat/arm-tests.sh | 83 ++++++++++++++++++++++++++++++++
 .buildkite/filebeat/common.sh    | 14 ++++++
 .buildkite/pipeline.yml          | 15 ++++++
 3 files changed, 112 insertions(+)
 create mode 100644 .buildkite/filebeat/arm-tests.sh
 create mode 100644 .buildkite/filebeat/common.sh

diff --git a/.buildkite/filebeat/arm-tests.sh b/.buildkite/filebeat/arm-tests.sh
new file mode 100644
index 00000000000..660e91de668
--- /dev/null
+++ b/.buildkite/filebeat/arm-tests.sh
@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+WORKSPACE="$(pwd)"
+BIN="${WORKSPACE}/bin"
+
+add_bin_path() {
+    echo "Adding PATH to the environment variables..."
+    create_bin
+    export PATH="${PATH}:${BIN}"
+}
+
+with_go() {
+    local go_version="${1}"
+    echo "Setting up the Go environment..."
+    create_bin
+    check_platform_architecture
+    retry 5 curl -sL -o ${BIN}/gvm "https://github.com/andrewkroh/gvm/releases/download/${SETUP_GVM_VERSION}/gvm-${PLATFORM_TYPE}-${arch_type}"
+    export PATH="${PATH}:${BIN}"
+    chmod +x ${BIN}/gvm
+    eval "$(gvm "$go_version")"
+    go version
+    which go
+    export PATH="${PATH}:$(go env GOPATH):$(go env GOPATH)/bin"
+}
+
+with_mage() {
+    local install_packages=(
+            "github.com/magefile/mage"
+            "github.com/elastic/go-licenser"
+            "golang.org/x/tools/cmd/goimports"
+            "github.com/jstemmer/go-junit-report"
+            "gotest.tools/gotestsum"
+    )
+    create_bin
+    for pkg in "${install_packages[@]}"; do
+        go install "${pkg}@latest"
+    done
+}
+
+create_bin() {
+    if [[ ! -d "${BIN}" ]]; then
+    mkdir -p ${BIN}
+    fi
+}
+
+check_platform_architecture() {
+# for downloading the GVM and Terraform packages
+  case "${HW_TYPE}" in
+   "x86_64")
+        arch_type="amd64"
+        ;;
+    "aarch64")
+        arch_type="arm64"
+        ;;
+    "arm64")
+        arch_type="arm64"
+        ;;
+    *)
+    echo "The current platform/OS type is unsupported yet"
+    ;;
+  esac
+}
+
+retry() {
+    local retries=$1
+    shift
+    local count=0
+    until "$@"; do
+        exit=$?
+        wait=$((2 ** count))
+        count=$((count + 1))
+        if [ $count -lt "$retries" ]; then
+            >&2 echo "Retry $count/$retries exited $exit, retrying in $wait seconds..."
+            sleep $wait
+        else
+            >&2 echo "Retry $count/$retries exited $exit, no more retries left."
+            return $exit
+        fi
+    done
+    return 0
+}
diff --git a/.buildkite/filebeat/common.sh b/.buildkite/filebeat/common.sh
new file mode 100644
index 00000000000..0ac9279d8cd
--- /dev/null
+++ b/.buildkite/filebeat/common.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+are_files_changed() {
+  changeset=$1
+
+  if git diff --name-only HEAD@{1} HEAD | grep -qE "$changeset"; then
+    return 0;
+  else
+    echo "WARN! No files changed in $changeset"
+    return 1;
+  fi
+}
diff --git a/.buildkite/pipeline.yml b/.buildkite/pipeline.yml
index 34321b61161..c4984ba52ce 100644
--- a/.buildkite/pipeline.yml
+++ b/.buildkite/pipeline.yml
@@ -3,3 +3,18 @@
 steps:
   - label: "Example test"
     command: echo "Hello!"
+# ToDo: setup execution from UI when specific pipelines are finished
+#  - input: "Build parameters"
+#    if: build.source == "ui"
+#    fields:
+#      - select: "Select build parameters"
+#        key: "PIPELINE_SLUG"
+#        required: false
+#        options:
+#          - label: "Filebeat"
+#            value: "filebeat"
+#          - label: "Metricbeat"
+#            value: "metricbeat"
+#        hint: "Select what should be built"
+#  - wait
+#  - trigger: "${PIPELINE_SLUG}"

From 611093c1ec0d57a80303e2294e663a24b8ff941e Mon Sep 17 00:00:00 2001
From: Olga Naidjonoka <olga_naidjonoka@epam.com>
Date: Thu, 7 Dec 2023 11:35:07 +0200
Subject: [PATCH 02/21] added test scripts

---
 .buildkite/filebeat/common.sh                 | 14 --------------
 .buildkite/filebeat/scripts/arm-tests.sh      |  3 +++
 .../{arm-tests.sh => scripts/common.sh}       |  8 +++++++-
 .../filebeat/scripts/integration-tests.sh     | 19 +++++++++++++++++++
 4 files changed, 29 insertions(+), 15 deletions(-)
 delete mode 100644 .buildkite/filebeat/common.sh
 create mode 100644 .buildkite/filebeat/scripts/arm-tests.sh
 rename .buildkite/filebeat/{arm-tests.sh => scripts/common.sh} (90%)
 create mode 100755 .buildkite/filebeat/scripts/integration-tests.sh

diff --git a/.buildkite/filebeat/common.sh b/.buildkite/filebeat/common.sh
deleted file mode 100644
index 0ac9279d8cd..00000000000
--- a/.buildkite/filebeat/common.sh
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-are_files_changed() {
-  changeset=$1
-
-  if git diff --name-only HEAD@{1} HEAD | grep -qE "$changeset"; then
-    return 0;
-  else
-    echo "WARN! No files changed in $changeset"
-    return 1;
-  fi
-}
diff --git a/.buildkite/filebeat/scripts/arm-tests.sh b/.buildkite/filebeat/scripts/arm-tests.sh
new file mode 100644
index 00000000000..5b2371c6ed4
--- /dev/null
+++ b/.buildkite/filebeat/scripts/arm-tests.sh
@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
diff --git a/.buildkite/filebeat/arm-tests.sh b/.buildkite/filebeat/scripts/common.sh
similarity index 90%
rename from .buildkite/filebeat/arm-tests.sh
rename to .buildkite/filebeat/scripts/common.sh
index 660e91de668..4d2fd3aba6f 100644
--- a/.buildkite/filebeat/arm-tests.sh
+++ b/.buildkite/filebeat/scripts/common.sh
@@ -4,6 +4,12 @@ set -euo pipefail
 
 WORKSPACE="$(pwd)"
 BIN="${WORKSPACE}/bin"
+HW_TYPE="$(uname -m)"
+PLATFORM_TYPE="$(uname)"
+
+if [[ -z "${GOLANG_VERSION-""}" ]]; then
+    export GOLANG_VERSION=$(cat "${WORKSPACE}/.go-version")
+fi
 
 add_bin_path() {
     echo "Adding PATH to the environment variables..."
@@ -12,7 +18,7 @@ add_bin_path() {
 }
 
 with_go() {
-    local go_version="${1}"
+    local go_version="${GOLANG_VERSION}"
     echo "Setting up the Go environment..."
     create_bin
     check_platform_architecture
diff --git a/.buildkite/filebeat/scripts/integration-tests.sh b/.buildkite/filebeat/scripts/integration-tests.sh
new file mode 100755
index 00000000000..5060a18047f
--- /dev/null
+++ b/.buildkite/filebeat/scripts/integration-tests.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/filebeat/scripts/common.sh
+
+# ToDo - remove after Beats agent is created"
+echo ":: Setup Env ::"
+add_bin_path
+with_go
+with_mage
+# ToDo - end
+
+echo ":: Execute Integration Tests ::"
+sudo chmod -R go-w filebeat/
+
+cd filebeat
+umask 0022
+mage goIntegTest

From acfc74d6a0dce2aa9d31589c4702f2a1c7985836 Mon Sep 17 00:00:00 2001
From: Olga Naidjonoka <olga_naidjonoka@epam.com>
Date: Wed, 13 Dec 2023 04:59:27 +0200
Subject: [PATCH 03/21] added windows tests

---
 .buildkite/filebeat/scripts/common.sh     |  8 ++++----
 .buildkite/filebeat/scripts/pre-common.sh | 10 ++++++++++
 filebeat/Jenkinsfile.yml                  |  2 +-
 3 files changed, 15 insertions(+), 5 deletions(-)
 create mode 100644 .buildkite/filebeat/scripts/pre-common.sh

diff --git a/.buildkite/filebeat/scripts/common.sh b/.buildkite/filebeat/scripts/common.sh
index 4d2fd3aba6f..39c445b6acc 100644
--- a/.buildkite/filebeat/scripts/common.sh
+++ b/.buildkite/filebeat/scripts/common.sh
@@ -2,14 +2,14 @@
 
 set -euo pipefail
 
-WORKSPACE="$(pwd)"
+#WORKSPACE="$(pwd)"
 BIN="${WORKSPACE}/bin"
 HW_TYPE="$(uname -m)"
 PLATFORM_TYPE="$(uname)"
 
-if [[ -z "${GOLANG_VERSION-""}" ]]; then
-    export GOLANG_VERSION=$(cat "${WORKSPACE}/.go-version")
-fi
+#if [[ -z "${GOLANG_VERSION-""}" ]]; then
+#    export GOLANG_VERSION=$(cat "${WORKSPACE}/.go-version")
+#fi
 
 add_bin_path() {
     echo "Adding PATH to the environment variables..."
diff --git a/.buildkite/filebeat/scripts/pre-common.sh b/.buildkite/filebeat/scripts/pre-common.sh
new file mode 100644
index 00000000000..12c69b771bc
--- /dev/null
+++ b/.buildkite/filebeat/scripts/pre-common.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+
+prepare_win() {
+  local os
+  os="$(uname)"
+  if [[ $os = MINGW* ]]; then
+    choco install mingw -y
+    choco install python --version=3.11.0 -y
+  fi
+}
diff --git a/filebeat/Jenkinsfile.yml b/filebeat/Jenkinsfile.yml
index 127d82cecfd..4588823bd3c 100644
--- a/filebeat/Jenkinsfile.yml
+++ b/filebeat/Jenkinsfile.yml
@@ -42,7 +42,7 @@ stages:
           - "macos12 && x86_64"
         when:                  ## Override the top-level when.
             comments:
-                - "/test filebeat for macos"
+                  - "/test filebeat for macos"
             labels:
                 - "macOS"
             parameters:

From 0412989164e10bb64a1ddb2cd887836f1df1751e Mon Sep 17 00:00:00 2001
From: Olga Naidjonoka <olga_naidjonoka@epam.com>
Date: Wed, 3 Jan 2024 13:13:26 +0200
Subject: [PATCH 04/21] added packaging step

---
 .buildkite/filebeat/scripts/pre-common.sh | 10 ++++++++++
 .buildkite/hooks/post-checkout            | 18 ++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/.buildkite/filebeat/scripts/pre-common.sh b/.buildkite/filebeat/scripts/pre-common.sh
index 12c69b771bc..f1a2bf5840e 100644
--- a/.buildkite/filebeat/scripts/pre-common.sh
+++ b/.buildkite/filebeat/scripts/pre-common.sh
@@ -8,3 +8,13 @@ prepare_win() {
     choco install python --version=3.11.0 -y
   fi
 }
+
+check_filebeat_changes() {
+  changeset=$1
+
+  if git diff --name-only HEAD@{1} HEAD | grep -qE "$changeset"; then
+    export FILEBEAT_CHANGESET=true
+  else
+    export FILEBEAT_CHANGESET=false
+  fi
+}
diff --git a/.buildkite/hooks/post-checkout b/.buildkite/hooks/post-checkout
index e10f15de7b6..2f376ec25b0 100644
--- a/.buildkite/hooks/post-checkout
+++ b/.buildkite/hooks/post-checkout
@@ -51,3 +51,21 @@ git --no-pager log --format=%B -n 1
 
 # Ensure buildkite groups are rendered
 echo ""
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/filebeat/scripts/pre-common.sh
+
+if [[ "$BUILDKITE_PIPELINE_SLUG" == "filebeat" ]]; then
+  changeset="^filebeat/
+    ^go.mod
+    ^pytest.ini
+    ^dev-tools/
+    ^libbeat/
+    ^testing/
+    ^\.buildkite/filebeat/"
+
+  check_filebeat_changes "$changeset"
+  echo ":: FILEBEAT_CHANGESET=$FILEBEAT_CHANGESET ::"
+fi

From 16b007b033ebe62768d46f78018d8a88785934d7 Mon Sep 17 00:00:00 2001
From: Olga Naidjonoka <olga_naidjonoka@epam.com>
Date: Thu, 4 Jan 2024 10:14:00 +0200
Subject: [PATCH 05/21] updated packaging execution conditions

---
 .buildkite/filebeat/scripts/common.sh     | 26 ++++++++++++++++++-----
 .buildkite/filebeat/scripts/pre-common.sh | 20 -----------------
 2 files changed, 21 insertions(+), 25 deletions(-)
 delete mode 100644 .buildkite/filebeat/scripts/pre-common.sh

diff --git a/.buildkite/filebeat/scripts/common.sh b/.buildkite/filebeat/scripts/common.sh
index 39c445b6acc..943d3b98a6f 100644
--- a/.buildkite/filebeat/scripts/common.sh
+++ b/.buildkite/filebeat/scripts/common.sh
@@ -2,15 +2,11 @@
 
 set -euo pipefail
 
-#WORKSPACE="$(pwd)"
+WORKSPACE="$(pwd)"
 BIN="${WORKSPACE}/bin"
 HW_TYPE="$(uname -m)"
 PLATFORM_TYPE="$(uname)"
 
-#if [[ -z "${GOLANG_VERSION-""}" ]]; then
-#    export GOLANG_VERSION=$(cat "${WORKSPACE}/.go-version")
-#fi
-
 add_bin_path() {
     echo "Adding PATH to the environment variables..."
     create_bin
@@ -87,3 +83,23 @@ retry() {
     done
     return 0
 }
+
+are_files_changed() {
+  changeset=$1
+
+  if git diff --name-only HEAD@{1} HEAD | grep -qE "$changeset"; then
+    return 0;
+  else
+    echo "WARN! No files changed in $changeset"
+    return 1;
+  fi
+}
+
+prepare_win() {
+  local os
+  os="$(uname)"
+  if [[ $os = MINGW* ]]; then
+    choco install mingw -y
+    choco install python --version=3.11.0 -y
+  fi
+}
diff --git a/.buildkite/filebeat/scripts/pre-common.sh b/.buildkite/filebeat/scripts/pre-common.sh
deleted file mode 100644
index f1a2bf5840e..00000000000
--- a/.buildkite/filebeat/scripts/pre-common.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/usr/bin/env bash
-
-prepare_win() {
-  local os
-  os="$(uname)"
-  if [[ $os = MINGW* ]]; then
-    choco install mingw -y
-    choco install python --version=3.11.0 -y
-  fi
-}
-
-check_filebeat_changes() {
-  changeset=$1
-
-  if git diff --name-only HEAD@{1} HEAD | grep -qE "$changeset"; then
-    export FILEBEAT_CHANGESET=true
-  else
-    export FILEBEAT_CHANGESET=false
-  fi
-}

From 46bbfe1bb12f283e7aa37e02396bbd07ef789adf Mon Sep 17 00:00:00 2001
From: Olga Naidjonoka <olga_naidjonoka@epam.com>
Date: Tue, 9 Jan 2024 22:24:32 +0200
Subject: [PATCH 06/21] win-test failure: updated artifact path

---
 .buildkite/filebeat/scripts/arm-tests.sh | 3 ---
 1 file changed, 3 deletions(-)
 delete mode 100644 .buildkite/filebeat/scripts/arm-tests.sh

diff --git a/.buildkite/filebeat/scripts/arm-tests.sh b/.buildkite/filebeat/scripts/arm-tests.sh
deleted file mode 100644
index 5b2371c6ed4..00000000000
--- a/.buildkite/filebeat/scripts/arm-tests.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail

From 400687e0d54a0103046cf5c4bd70e5593886d898 Mon Sep 17 00:00:00 2001
From: Olga Naidjonoka <olga_naidjonoka@epam.com>
Date: Mon, 15 Jan 2024 11:58:12 +0200
Subject: [PATCH 07/21] pr fixes

---
 .../filebeat/scripts/integration-tests.sh     | 19 -------------------
 .buildkite/pipeline.yml                       | 15 ---------------
 filebeat/Jenkinsfile.yml                      |  2 +-
 3 files changed, 1 insertion(+), 35 deletions(-)
 delete mode 100755 .buildkite/filebeat/scripts/integration-tests.sh

diff --git a/.buildkite/filebeat/scripts/integration-tests.sh b/.buildkite/filebeat/scripts/integration-tests.sh
deleted file mode 100755
index 5060a18047f..00000000000
--- a/.buildkite/filebeat/scripts/integration-tests.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-source .buildkite/filebeat/scripts/common.sh
-
-# ToDo - remove after Beats agent is created"
-echo ":: Setup Env ::"
-add_bin_path
-with_go
-with_mage
-# ToDo - end
-
-echo ":: Execute Integration Tests ::"
-sudo chmod -R go-w filebeat/
-
-cd filebeat
-umask 0022
-mage goIntegTest
diff --git a/.buildkite/pipeline.yml b/.buildkite/pipeline.yml
index c4984ba52ce..34321b61161 100644
--- a/.buildkite/pipeline.yml
+++ b/.buildkite/pipeline.yml
@@ -3,18 +3,3 @@
 steps:
   - label: "Example test"
     command: echo "Hello!"
-# ToDo: setup execution from UI when specific pipelines are finished
-#  - input: "Build parameters"
-#    if: build.source == "ui"
-#    fields:
-#      - select: "Select build parameters"
-#        key: "PIPELINE_SLUG"
-#        required: false
-#        options:
-#          - label: "Filebeat"
-#            value: "filebeat"
-#          - label: "Metricbeat"
-#            value: "metricbeat"
-#        hint: "Select what should be built"
-#  - wait
-#  - trigger: "${PIPELINE_SLUG}"
diff --git a/filebeat/Jenkinsfile.yml b/filebeat/Jenkinsfile.yml
index 4588823bd3c..127d82cecfd 100644
--- a/filebeat/Jenkinsfile.yml
+++ b/filebeat/Jenkinsfile.yml
@@ -42,7 +42,7 @@ stages:
           - "macos12 && x86_64"
         when:                  ## Override the top-level when.
             comments:
-                  - "/test filebeat for macos"
+                - "/test filebeat for macos"
             labels:
                 - "macOS"
             parameters:

From 7a63518f6d2abc90f75c01e8ba23a85b501c5cea Mon Sep 17 00:00:00 2001
From: Olga Naidjonoka <olga_naidjonoka@epam.com>
Date: Tue, 16 Jan 2024 16:58:22 +0200
Subject: [PATCH 08/21] changed group_test.go

---
 .buildkite/hooks/pre-command | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.buildkite/hooks/pre-command b/.buildkite/hooks/pre-command
index ef38478a432..604d544d892 100644
--- a/.buildkite/hooks/pre-command
+++ b/.buildkite/hooks/pre-command
@@ -14,6 +14,10 @@ if [[ "$BUILDKITE_PIPELINE_SLUG" == "filebeat" ]]; then
   if [[ -z "${GOLANG_VERSION-""}" ]]; then
     export GOLANG_VERSION=$(cat "${WORKSPACE}/.go-version")
   fi
+
+  if [[ "$BUILDKITE_STEP_KEY" == macos* ]]; then
+    ulimit -Sn 30000
+  fi
 fi
 
 if [[ "$BUILDKITE_PIPELINE_SLUG" == "beats-metricbeat" ]]; then

From 166edd9364ad87c44949ceb02cb9352635242cc4 Mon Sep 17 00:00:00 2001
From: Olga Naidjonoka <olga_naidjonoka@epam.com>
Date: Wed, 17 Jan 2024 12:34:39 +0200
Subject: [PATCH 09/21] moved env setup to separate script

---
 .buildkite/filebeat/scripts/common.sh | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/.buildkite/filebeat/scripts/common.sh b/.buildkite/filebeat/scripts/common.sh
index 943d3b98a6f..efbb81e66aa 100644
--- a/.buildkite/filebeat/scripts/common.sh
+++ b/.buildkite/filebeat/scripts/common.sh
@@ -2,10 +2,10 @@
 
 set -euo pipefail
 
-WORKSPACE="$(pwd)"
-BIN="${WORKSPACE}/bin"
-HW_TYPE="$(uname -m)"
-PLATFORM_TYPE="$(uname)"
+#WORKSPACE="$(pwd)"
+#BIN="${WORKSPACE}/bin"
+#HW_TYPE="$(uname -m)"
+#PLATFORM_TYPE="$(uname)"
 
 add_bin_path() {
     echo "Adding PATH to the environment variables..."
@@ -85,7 +85,7 @@ retry() {
 }
 
 are_files_changed() {
-  changeset=$1
+  local changeset=$1
 
   if git diff --name-only HEAD@{1} HEAD | grep -qE "$changeset"; then
     return 0;
@@ -95,11 +95,11 @@ are_files_changed() {
   fi
 }
 
-prepare_win() {
-  local os
-  os="$(uname)"
-  if [[ $os = MINGW* ]]; then
-    choco install mingw -y
-    choco install python --version=3.11.0 -y
-  fi
-}
+#prepare_win() {
+##  local os
+##  os="$(uname)"
+#  if [[ ${PLATFORM_TYPE} = MINGW* ]]; then
+#    choco install mingw -y
+#    choco install python --version=3.11.0 -y
+#  fi
+#}

From 776e4f8d838f3ffb21dbdab985640b3cac1b857d Mon Sep 17 00:00:00 2001
From: Olga Naidjonoka <olga_naidjonoka@epam.com>
Date: Wed, 17 Jan 2024 15:48:22 +0200
Subject: [PATCH 10/21] added dynamic step for packaging

---
 .buildkite/filebeat/scripts/common.sh | 105 --------------------------
 1 file changed, 105 deletions(-)
 delete mode 100644 .buildkite/filebeat/scripts/common.sh

diff --git a/.buildkite/filebeat/scripts/common.sh b/.buildkite/filebeat/scripts/common.sh
deleted file mode 100644
index efbb81e66aa..00000000000
--- a/.buildkite/filebeat/scripts/common.sh
+++ /dev/null
@@ -1,105 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-#WORKSPACE="$(pwd)"
-#BIN="${WORKSPACE}/bin"
-#HW_TYPE="$(uname -m)"
-#PLATFORM_TYPE="$(uname)"
-
-add_bin_path() {
-    echo "Adding PATH to the environment variables..."
-    create_bin
-    export PATH="${PATH}:${BIN}"
-}
-
-with_go() {
-    local go_version="${GOLANG_VERSION}"
-    echo "Setting up the Go environment..."
-    create_bin
-    check_platform_architecture
-    retry 5 curl -sL -o ${BIN}/gvm "https://github.com/andrewkroh/gvm/releases/download/${SETUP_GVM_VERSION}/gvm-${PLATFORM_TYPE}-${arch_type}"
-    export PATH="${PATH}:${BIN}"
-    chmod +x ${BIN}/gvm
-    eval "$(gvm "$go_version")"
-    go version
-    which go
-    export PATH="${PATH}:$(go env GOPATH):$(go env GOPATH)/bin"
-}
-
-with_mage() {
-    local install_packages=(
-            "github.com/magefile/mage"
-            "github.com/elastic/go-licenser"
-            "golang.org/x/tools/cmd/goimports"
-            "github.com/jstemmer/go-junit-report"
-            "gotest.tools/gotestsum"
-    )
-    create_bin
-    for pkg in "${install_packages[@]}"; do
-        go install "${pkg}@latest"
-    done
-}
-
-create_bin() {
-    if [[ ! -d "${BIN}" ]]; then
-    mkdir -p ${BIN}
-    fi
-}
-
-check_platform_architecture() {
-# for downloading the GVM and Terraform packages
-  case "${HW_TYPE}" in
-   "x86_64")
-        arch_type="amd64"
-        ;;
-    "aarch64")
-        arch_type="arm64"
-        ;;
-    "arm64")
-        arch_type="arm64"
-        ;;
-    *)
-    echo "The current platform/OS type is unsupported yet"
-    ;;
-  esac
-}
-
-retry() {
-    local retries=$1
-    shift
-    local count=0
-    until "$@"; do
-        exit=$?
-        wait=$((2 ** count))
-        count=$((count + 1))
-        if [ $count -lt "$retries" ]; then
-            >&2 echo "Retry $count/$retries exited $exit, retrying in $wait seconds..."
-            sleep $wait
-        else
-            >&2 echo "Retry $count/$retries exited $exit, no more retries left."
-            return $exit
-        fi
-    done
-    return 0
-}
-
-are_files_changed() {
-  local changeset=$1
-
-  if git diff --name-only HEAD@{1} HEAD | grep -qE "$changeset"; then
-    return 0;
-  else
-    echo "WARN! No files changed in $changeset"
-    return 1;
-  fi
-}
-
-#prepare_win() {
-##  local os
-##  os="$(uname)"
-#  if [[ ${PLATFORM_TYPE} = MINGW* ]]; then
-#    choco install mingw -y
-#    choco install python --version=3.11.0 -y
-#  fi
-#}

From 54e59f46cc2c4e1e08267e3b2859b91bd448c0a6 Mon Sep 17 00:00:00 2001
From: Olga Naidjonoka <olga_naidjonoka@epam.com>
Date: Thu, 18 Jan 2024 15:46:07 +0200
Subject: [PATCH 11/21] added tests and scrosscompile scripts for auditbeat

---
 .buildkite/auditbeat/auditbeat-pipeline.yml   | 138 +++++++++++++++++-
 .buildkite/auditbeat/scripts/crosscompile.sh  |   8 +
 .buildkite/auditbeat/scripts/package-step.sh  |  43 ++++++
 .buildkite/auditbeat/scripts/package.sh       |  13 ++
 .../auditbeat/scripts/unit-tests-win.ps1      |  51 +++++++
 .buildkite/auditbeat/scripts/unit-tests.sh    |  12 ++
 .buildkite/env-scripts/macos-env.sh           |   8 -
 .buildkite/env-scripts/unix-env.sh            |  44 ++++++
 .../filebeat/scripts/integration-gotests.sh   |   2 +-
 .../filebeat/scripts/integration-pytests.sh   |   2 +-
 .buildkite/filebeat/scripts/package.sh        |   2 +-
 .buildkite/filebeat/scripts/unit-tests.sh     |   3 +-
 12 files changed, 311 insertions(+), 15 deletions(-)
 create mode 100755 .buildkite/auditbeat/scripts/crosscompile.sh
 create mode 100755 .buildkite/auditbeat/scripts/package-step.sh
 create mode 100755 .buildkite/auditbeat/scripts/package.sh
 create mode 100644 .buildkite/auditbeat/scripts/unit-tests-win.ps1
 create mode 100755 .buildkite/auditbeat/scripts/unit-tests.sh
 delete mode 100644 .buildkite/env-scripts/macos-env.sh
 create mode 100644 .buildkite/env-scripts/unix-env.sh

diff --git a/.buildkite/auditbeat/auditbeat-pipeline.yml b/.buildkite/auditbeat/auditbeat-pipeline.yml
index 34321b61161..57b15c358ae 100644
--- a/.buildkite/auditbeat/auditbeat-pipeline.yml
+++ b/.buildkite/auditbeat/auditbeat-pipeline.yml
@@ -1,5 +1,139 @@
 # yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
 
+env:
+  IMAGE_UBUNTU_X86_64: "family/core-ubuntu-2204"
+  IMAGE_UBUNTU_ARM_64: "core-ubuntu-2004-aarch64"
+  IMAGE_WIN_2016: "family/core-windows-2016"
+  IMAGE_WIN_2019: "family/core-windows-2019"
+  IMAGE_WIN_2022: "family/core-windows-2022"
+  IMAGE_RHEL9: "family/core-rhel-9"
+
 steps:
-  - label: "Example test"
-    command: echo "Hello!"
+  - group: "Auditbeat Mandatory Testing"
+    key: "mandatory-tests"
+    if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat" || build.env("BUILDKITE_PULL_REQUEST") != "false"
+
+    steps:
+      - label: ":ubuntu: Unit Tests"
+        command:
+          - ".buildkite/auditbeat/scripts/unit-tests.sh"
+        notify:
+          - github_commit_status:
+              context: "auditbeat: Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_UBUNTU_X86_64}"
+        artifact_paths:
+          - "auditbeat/build/*.xml"
+          - "auditbeat/build/*.json"
+
+      - label: ":rhel: Unit Tests"
+        command:
+          - ".buildkite/auditbeat/scripts/unit-tests.sh"
+        notify:
+          - github_commit_status:
+              context: "auditbeat: Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_RHEL9}"
+        artifact_paths:
+          - "auditbeat/build/*.xml"
+          - "auditbeat/build/*.json"
+
+#      - label: ":windows:-{{matrix.image}} Unit Tests"
+#        command: ".buildkite/auditbeat/scripts/unit-tests-win.ps1"
+#        notify:
+#          - github_commit_status:
+#              context: "auditbeat: Unit Tests"
+#        agents:
+#          provider: "gcp"
+#          image: "{{matrix.image}}"
+#          machine_type: "n2-standard-8"
+#          disk_size: 200
+#          disk_type: "pd-ssd"
+#        matrix:
+#          setup:
+#            image:
+#              - "${IMAGE_WIN_2016}"
+#              - "${IMAGE_WIN_2022}"
+#        artifact_paths:
+#          - "auditbeat/build/*.xml"
+#          - "auditbeat/build/*.json"
+#
+      - label: ":linux: Crosscompile"
+        command:
+          - ".buildkite/auditbeat/scripts/crosscompile.sh"
+        notify:
+          - github_commit_status:
+              context: "auditbeat: Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_UBUNTU_X86_64}"
+        artifact_paths:
+          - "auditbeat/build/*.xml"
+          - "auditbeat/build/*.json"
+
+  - group: "Extended Testing"
+    key: "extended-tests"
+    if: build.env("BUILDKITE_PULL_REQUEST") != "false" || build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat extended tests"
+
+    steps:
+      - label: ":linux: ARM64 Unit Tests"
+        key: "arm-extended"
+#        if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for arm" || build.env("GITHUB_PR_LABELS") =~ /.*arm.*/
+        command:
+          - ".buildkite/auditbeat/scripts/unit-tests.sh"
+        notify:
+          - github_commit_status:
+              context: "auditbeat/Extended: Unit Tests ARM"
+        agents:
+          provider: "aws"
+          imagePrefix: "${IMAGE_UBUNTU_ARM_64}"
+          instanceType: "t4g.large"
+        artifact_paths: "auditbeat/build/*.xml"
+
+      - label: ":mac: MacOS Unit Tests"
+        key: "macos-extended"
+#        if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for macos" || build.env("GITHUB_PR_LABELS") =~ /.*macOS.*/
+        command:
+          - ".buildkite/auditbeat/scripts/unit-tests.sh"
+        notify:
+          - github_commit_status:
+              context: "auditbeat/Extended: MacOS Unit Tests"
+        agents:
+          provider: "orka"
+          imagePrefix: "generic-13-ventura-x64"
+        artifact_paths: "auditbeat/build/*.xml"
+
+#  - group: "Windows Extended Testing"
+#    key: "extended-tests-win"
+##    if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for windows" || build.env("GITHUB_PR_LABELS") =~ /.*windows.*/
+#
+#    steps:
+#      - label: ":windows: Win 2019 Unit Tests"
+#        key: "win-extended-2019"
+#        command: ".buildkite/auditbeat/scripts/unit-tests-win.ps1"
+#        notify:
+#          - github_commit_status:
+#              context: "auditbeat/Extended: Win-2019 Unit Tests"
+#        agents:
+#          provider: "gcp"
+#          image: "${IMAGE_WIN_2019}"
+#          machine_type: "n2-standard-8"
+#          disk_size: 200
+#          disk_type: "pd-ssd"
+#        artifact_paths:
+#          - "auditbeat/build/*.xml"
+#          - "auditbeat/build/*.json"
+#
+#  - group: "Packaging"
+#    key: "packaging"
+#    if: build.env("BUILDKITE_PULL_REQUEST") != "false"
+#    depends_on:
+#      - "mandatory-tests"
+#      - "extended-tests"
+#      - "extended-tests-win"
+#
+#    steps:
+#      - label: Package pipeline
+#        commands: ".buildkite/auditbeat/scripts/package-step.sh | buildkite-agent pipeline upload"
diff --git a/.buildkite/auditbeat/scripts/crosscompile.sh b/.buildkite/auditbeat/scripts/crosscompile.sh
new file mode 100755
index 00000000000..9f6896eec5c
--- /dev/null
+++ b/.buildkite/auditbeat/scripts/crosscompile.sh
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/env-scripts/unix-env.sh
+
+echo ":: Executing Crosscompile ::"
+make -C auditbeat crosscompile
diff --git a/.buildkite/auditbeat/scripts/package-step.sh b/.buildkite/auditbeat/scripts/package-step.sh
new file mode 100755
index 00000000000..34ecc3a77f8
--- /dev/null
+++ b/.buildkite/auditbeat/scripts/package-step.sh
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+changeset="^auditbeat/
+    ^go.mod
+    ^pytest.ini
+    ^dev-tools/
+    ^libbeat/
+    ^testing/
+    ^\.buildkite/auditbeat/"
+
+if are_files_changed "$changeset"; then
+  cat <<-EOF
+    steps:
+      - label: ":ubuntu: Packaging Linux X86"
+        key: "package-linux-x86"
+        command:
+          - ".buildkite/auditbeat/scripts/package.sh"
+        notify:
+          - github_commit_status:
+              context: "auditbeat/Packaging: Linux X86"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_UBUNTU_X86_64}"
+
+      - label: ":linux: Packaging Linux ARM"
+        key: "package-linux-arm"
+        env:
+          PLATFORMS: "linux/arm64"
+          PACKAGES: "docker"
+        command:
+          - ".buildkite/auditbeat/scripts/package.sh"
+        notify:
+          - github_commit_status:
+              context: "auditbeat/Packaging: ARM"
+        agents:
+          provider: "aws"
+          imagePrefix: "${IMAGE_UBUNTU_ARM_64}"
+          instanceType: "t4g.large"
+EOF
+fi
+
diff --git a/.buildkite/auditbeat/scripts/package.sh b/.buildkite/auditbeat/scripts/package.sh
new file mode 100755
index 00000000000..868897e5471
--- /dev/null
+++ b/.buildkite/auditbeat/scripts/package.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/env-scripts/unix-env.sh
+
+echo ":: Evaluate Auditbeat Changes ::"
+
+echo ":: Start Packaging ::"
+cd auditbeat
+umask 0022
+mage package
+
diff --git a/.buildkite/auditbeat/scripts/unit-tests-win.ps1 b/.buildkite/auditbeat/scripts/unit-tests-win.ps1
new file mode 100644
index 00000000000..b3bc4ef348e
--- /dev/null
+++ b/.buildkite/auditbeat/scripts/unit-tests-win.ps1
@@ -0,0 +1,51 @@
+$ErrorActionPreference = "Stop" # set -e
+$GoVersion = $env:GOLANG_VERSION # If Choco doesn't have the version specified in .go-version file, should be changed manually
+
+# Forcing to checkout again all the files with a correct autocrlf.
+# Doing this here because we cannot set git clone options before.
+function fixCRLF() {
+    Write-Host "-- Fixing CRLF in git checkout --"
+    git config core.autocrlf false
+    git rm --quiet --cached -r .
+    git reset --quiet --hard
+}
+
+function withGolang() {
+    Write-Host "-- Install golang $GoVersion --"
+    choco install golang -y --version $GoVersion
+
+    $choco = Convert-Path "$((Get-Command choco).Path)\..\.."
+    Import-Module "$choco\helpers\chocolateyProfile.psm1"
+    refreshenv
+    go version
+    go env
+}
+
+function installGoDependencies() {
+    $installPackages = @(
+        "github.com/magefile/mage"
+        "github.com/elastic/go-licenser"
+        "golang.org/x/tools/cmd/goimports"
+        "github.com/jstemmer/go-junit-report"
+        "github.com/tebeka/go2xunit"
+    )
+    foreach ($pkg in $installPackages) {
+        go install "$pkg"
+    }
+}
+
+fixCRLF
+
+$ErrorActionPreference = "Continue" # set +e
+
+Set-Location -Path auditbeat
+New-Item -ItemType Directory -Force -Path "build"
+withGolang
+installGoDependencies
+
+mage build unitTest
+
+$EXITCODE=$LASTEXITCODE
+$ErrorActionPreference = "Stop"
+
+Exit $EXITCODE
diff --git a/.buildkite/auditbeat/scripts/unit-tests.sh b/.buildkite/auditbeat/scripts/unit-tests.sh
new file mode 100755
index 00000000000..d63365d6dc4
--- /dev/null
+++ b/.buildkite/auditbeat/scripts/unit-tests.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/env-scripts/unix-env.sh
+
+echo ":: Running Unit Tests ::"
+sudo chmod -R go-w auditbeat/
+
+cd auditbeat
+umask 0022
+mage build unitTest
diff --git a/.buildkite/env-scripts/macos-env.sh b/.buildkite/env-scripts/macos-env.sh
deleted file mode 100644
index ac1486b64fd..00000000000
--- a/.buildkite/env-scripts/macos-env.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-
-if [[ $PLATFORM_TYPE == Darwin* ]]; then
-  echo ":: Setting larger ulimit on MacOS ::"
-  # To bypass file descriptor errors like "Too many open files error" on MacOS
-  ulimit -Sn 50000
-  echo ":: ULIMIT :: $(ulimit -n)"
-fi
diff --git a/.buildkite/env-scripts/unix-env.sh b/.buildkite/env-scripts/unix-env.sh
new file mode 100644
index 00000000000..606eea83378
--- /dev/null
+++ b/.buildkite/env-scripts/unix-env.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/env-scripts/util.sh
+
+DEBIAN_FRONTEND="noninteractive"
+
+echo ":: PLATFORM TYPE $PLATFORM_TYPE ::"
+
+if [[ $PLATFORM_TYPE == "Linux" ]]; then
+  # Remove this code once beats specific agent is set up
+  if grep -q 'Ubuntu' /etc/*release; then
+    export DEBIAN_FRONTEND
+
+    echo ":: Ubuntu - Installing libs ::"
+    sudo apt-get update
+    sudo apt-get install -y libsystemd-dev
+    sudo apt install -y python3-pip
+    sudo apt-get install -y python3-venv
+  fi
+
+  # Remove this code once beats specific agent is set up
+  if grep -q 'Red Hat' /etc/*release; then
+    echo ":: RHL - Installing libs ::"
+    sudo yum update -y
+    sudo yum install -y systemd-devel
+    sudo yum install -y python3-pip
+    sudo yum install -y python3
+    pip3 install virtualenv
+  fi
+fi
+
+if [[ $PLATFORM_TYPE == Darwin* ]]; then
+  echo ":: Setting larger ulimit on MacOS ::"
+  # To bypass file descriptor errors like "Too many open files error" on MacOS
+  ulimit -Sn 50000
+  echo ":: ULIMIT :: $(ulimit -n)"
+fi
+
+echo ":: Setting up environment ::"
+add_bin_path
+with_go
+with_mage
diff --git a/.buildkite/filebeat/scripts/integration-gotests.sh b/.buildkite/filebeat/scripts/integration-gotests.sh
index a3eabf70c0d..6a48af79af7 100755
--- a/.buildkite/filebeat/scripts/integration-gotests.sh
+++ b/.buildkite/filebeat/scripts/integration-gotests.sh
@@ -2,7 +2,7 @@
 
 set -euo pipefail
 
-source .buildkite/env-scripts/linux-env.sh
+source .buildkite/env-scripts/unix-env.sh
 
 echo ":: Execute Integration Tests ::"
 sudo chmod -R go-w filebeat/
diff --git a/.buildkite/filebeat/scripts/integration-pytests.sh b/.buildkite/filebeat/scripts/integration-pytests.sh
index 5e2e403dda8..f5c9dfa615b 100755
--- a/.buildkite/filebeat/scripts/integration-pytests.sh
+++ b/.buildkite/filebeat/scripts/integration-pytests.sh
@@ -2,7 +2,7 @@
 
 set -euo pipefail
 
-source .buildkite/env-scripts/linux-env.sh
+source .buildkite/env-scripts/unix-env.sh
 
 echo ":: Execute Integration Tests ::"
 sudo chmod -R go-w filebeat/
diff --git a/.buildkite/filebeat/scripts/package.sh b/.buildkite/filebeat/scripts/package.sh
index 2ae226eb739..cdc1146e774 100755
--- a/.buildkite/filebeat/scripts/package.sh
+++ b/.buildkite/filebeat/scripts/package.sh
@@ -2,7 +2,7 @@
 
 set -euo pipefail
 
-source .buildkite/env-scripts/linux-env.sh
+source .buildkite/env-scripts/unix-env.sh
 
 echo ":: Evaluate Filebeat Changes ::"
 
diff --git a/.buildkite/filebeat/scripts/unit-tests.sh b/.buildkite/filebeat/scripts/unit-tests.sh
index cda1dd85aea..9be6867a67b 100755
--- a/.buildkite/filebeat/scripts/unit-tests.sh
+++ b/.buildkite/filebeat/scripts/unit-tests.sh
@@ -2,8 +2,7 @@
 
 set -euo pipefail
 
-source .buildkite/env-scripts/linux-env.sh
-source .buildkite/env-scripts/macos-env.sh
+source .buildkite/env-scripts/unix-env.sh
 
 echo ":: Execute Unit Tests ::"
 sudo chmod -R go-w filebeat/

From 381cefd0a8e5abb6dc32112f1c50ccb86d4e3173 Mon Sep 17 00:00:00 2001
From: Olga Naidjonoka <olga_naidjonoka@epam.com>
Date: Fri, 19 Jan 2024 21:20:20 +0200
Subject: [PATCH 12/21] fixes for crosscompile and macos steps

---
 .buildkite/auditbeat/auditbeat-pipeline.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.buildkite/auditbeat/auditbeat-pipeline.yml b/.buildkite/auditbeat/auditbeat-pipeline.yml
index 57b15c358ae..b68cccb244b 100644
--- a/.buildkite/auditbeat/auditbeat-pipeline.yml
+++ b/.buildkite/auditbeat/auditbeat-pipeline.yml
@@ -63,6 +63,8 @@ steps:
       - label: ":linux: Crosscompile"
         command:
           - ".buildkite/auditbeat/scripts/crosscompile.sh"
+        env:
+          GOX_FLAGS: "-arch amd64"
         notify:
           - github_commit_status:
               context: "auditbeat: Unit Tests"
@@ -96,6 +98,7 @@ steps:
         key: "macos-extended"
 #        if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for macos" || build.env("GITHUB_PR_LABELS") =~ /.*macOS.*/
         command:
+          - "chgrp staff /tmp"
           - ".buildkite/auditbeat/scripts/unit-tests.sh"
         notify:
           - github_commit_status:

From c0c53aec3f87e3d9dbe303f5086aef810ce4a19b Mon Sep 17 00:00:00 2001
From: Olga Naidjonoka <olga_naidjonoka@epam.com>
Date: Tue, 23 Jan 2024 09:48:37 +0200
Subject: [PATCH 13/21] added env vars for linux packaging

---
 .buildkite/auditbeat/auditbeat-pipeline.yml | 87 ++++++++++-----------
 1 file changed, 42 insertions(+), 45 deletions(-)

diff --git a/.buildkite/auditbeat/auditbeat-pipeline.yml b/.buildkite/auditbeat/auditbeat-pipeline.yml
index b68cccb244b..8b2d592dfc0 100644
--- a/.buildkite/auditbeat/auditbeat-pipeline.yml
+++ b/.buildkite/auditbeat/auditbeat-pipeline.yml
@@ -40,26 +40,26 @@ steps:
           - "auditbeat/build/*.xml"
           - "auditbeat/build/*.json"
 
-#      - label: ":windows:-{{matrix.image}} Unit Tests"
-#        command: ".buildkite/auditbeat/scripts/unit-tests-win.ps1"
-#        notify:
-#          - github_commit_status:
-#              context: "auditbeat: Unit Tests"
-#        agents:
-#          provider: "gcp"
-#          image: "{{matrix.image}}"
-#          machine_type: "n2-standard-8"
-#          disk_size: 200
-#          disk_type: "pd-ssd"
-#        matrix:
-#          setup:
-#            image:
-#              - "${IMAGE_WIN_2016}"
-#              - "${IMAGE_WIN_2022}"
-#        artifact_paths:
-#          - "auditbeat/build/*.xml"
-#          - "auditbeat/build/*.json"
-#
+      - label: ":windows:-{{matrix.image}} Unit Tests"
+        command: ".buildkite/auditbeat/scripts/unit-tests-win.ps1"
+        notify:
+          - github_commit_status:
+              context: "auditbeat: Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "{{matrix.image}}"
+          machine_type: "n2-standard-8"
+          disk_size: 200
+          disk_type: "pd-ssd"
+        matrix:
+          setup:
+            image:
+              - "${IMAGE_WIN_2016}"
+              - "${IMAGE_WIN_2022}"
+        artifact_paths:
+          - "auditbeat/build/*.xml"
+          - "auditbeat/build/*.json"
+
       - label: ":linux: Crosscompile"
         command:
           - ".buildkite/auditbeat/scripts/crosscompile.sh"
@@ -71,9 +71,6 @@ steps:
         agents:
           provider: "gcp"
           image: "${IMAGE_UBUNTU_X86_64}"
-        artifact_paths:
-          - "auditbeat/build/*.xml"
-          - "auditbeat/build/*.json"
 
   - group: "Extended Testing"
     key: "extended-tests"
@@ -82,7 +79,7 @@ steps:
     steps:
       - label: ":linux: ARM64 Unit Tests"
         key: "arm-extended"
-#        if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for arm" || build.env("GITHUB_PR_LABELS") =~ /.*arm.*/
+        if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for arm" || build.env("GITHUB_PR_LABELS") =~ /.*arm.*/
         command:
           - ".buildkite/auditbeat/scripts/unit-tests.sh"
         notify:
@@ -108,27 +105,27 @@ steps:
           imagePrefix: "generic-13-ventura-x64"
         artifact_paths: "auditbeat/build/*.xml"
 
-#  - group: "Windows Extended Testing"
-#    key: "extended-tests-win"
-##    if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for windows" || build.env("GITHUB_PR_LABELS") =~ /.*windows.*/
-#
-#    steps:
-#      - label: ":windows: Win 2019 Unit Tests"
-#        key: "win-extended-2019"
-#        command: ".buildkite/auditbeat/scripts/unit-tests-win.ps1"
-#        notify:
-#          - github_commit_status:
-#              context: "auditbeat/Extended: Win-2019 Unit Tests"
-#        agents:
-#          provider: "gcp"
-#          image: "${IMAGE_WIN_2019}"
-#          machine_type: "n2-standard-8"
-#          disk_size: 200
-#          disk_type: "pd-ssd"
-#        artifact_paths:
-#          - "auditbeat/build/*.xml"
-#          - "auditbeat/build/*.json"
-#
+  - group: "Windows Extended Testing"
+    key: "extended-tests-win"
+    if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for windows" || build.env("GITHUB_PR_LABELS") =~ /.*windows.*/
+
+    steps:
+      - label: ":windows: Win 2019 Unit Tests"
+        key: "win-extended-2019"
+        command: ".buildkite/auditbeat/scripts/unit-tests-win.ps1"
+        notify:
+          - github_commit_status:
+              context: "auditbeat/Extended: Win-2019 Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_WIN_2019}"
+          machine_type: "n2-standard-8"
+          disk_size: 200
+          disk_type: "pd-ssd"
+        artifact_paths:
+          - "auditbeat/build/*.xml"
+          - "auditbeat/build/*.json"
+
 #  - group: "Packaging"
 #    key: "packaging"
 #    if: build.env("BUILDKITE_PULL_REQUEST") != "false"

From 5af6f7e1142a3d0aeadd5a983d0bbf3095f8deaf Mon Sep 17 00:00:00 2001
From: Olga Naidjonoka <olga_naidjonoka@epam.com>
Date: Tue, 23 Jan 2024 09:49:14 +0200
Subject: [PATCH 14/21] added env vars for linux packaging

---
 .buildkite/auditbeat/auditbeat-pipeline.yml  | 24 ++++++++++----------
 .buildkite/auditbeat/scripts/package-step.sh |  2 ++
 2 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/.buildkite/auditbeat/auditbeat-pipeline.yml b/.buildkite/auditbeat/auditbeat-pipeline.yml
index 8b2d592dfc0..c954f8fb334 100644
--- a/.buildkite/auditbeat/auditbeat-pipeline.yml
+++ b/.buildkite/auditbeat/auditbeat-pipeline.yml
@@ -95,7 +95,7 @@ steps:
         key: "macos-extended"
 #        if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for macos" || build.env("GITHUB_PR_LABELS") =~ /.*macOS.*/
         command:
-          - "chgrp staff /tmp"
+#          - "chgrp staff /tmp"
           - ".buildkite/auditbeat/scripts/unit-tests.sh"
         notify:
           - github_commit_status:
@@ -126,14 +126,14 @@ steps:
           - "auditbeat/build/*.xml"
           - "auditbeat/build/*.json"
 
-#  - group: "Packaging"
-#    key: "packaging"
-#    if: build.env("BUILDKITE_PULL_REQUEST") != "false"
-#    depends_on:
-#      - "mandatory-tests"
-#      - "extended-tests"
-#      - "extended-tests-win"
-#
-#    steps:
-#      - label: Package pipeline
-#        commands: ".buildkite/auditbeat/scripts/package-step.sh | buildkite-agent pipeline upload"
+  - group: "Packaging"
+    key: "packaging"
+    if: build.env("BUILDKITE_PULL_REQUEST") != "false"
+    depends_on:
+      - "mandatory-tests"
+      - "extended-tests"
+      - "extended-tests-win"
+
+    steps:
+      - label: Package pipeline
+        commands: ".buildkite/auditbeat/scripts/package-step.sh | buildkite-agent pipeline upload"
diff --git a/.buildkite/auditbeat/scripts/package-step.sh b/.buildkite/auditbeat/scripts/package-step.sh
index 34ecc3a77f8..b9cdd24083d 100755
--- a/.buildkite/auditbeat/scripts/package-step.sh
+++ b/.buildkite/auditbeat/scripts/package-step.sh
@@ -17,6 +17,8 @@ if are_files_changed "$changeset"; then
         key: "package-linux-x86"
         command:
           - ".buildkite/auditbeat/scripts/package.sh"
+        env:
+          PLATFORMS: "linux/amd64, linux/arm64, windows/amd64, darwin/amd64, darwin/arm64"
         notify:
           - github_commit_status:
               context: "auditbeat/Packaging: Linux X86"

From a1f3278871eb96a32a2fe91fa8b20bac4f93e6e5 Mon Sep 17 00:00:00 2001
From: Olga Naidjonoka <olga_naidjonoka@epam.com>
Date: Tue, 23 Jan 2024 10:53:44 +0200
Subject: [PATCH 15/21] enabled packaging step

---
 .buildkite/auditbeat/auditbeat-pipeline.yml  | 251 +++++++++++--------
 .buildkite/auditbeat/scripts/package-step.sh |   6 +-
 .buildkite/env-scripts/unix-env.sh           |   3 +
 3 files changed, 146 insertions(+), 114 deletions(-)

diff --git a/.buildkite/auditbeat/auditbeat-pipeline.yml b/.buildkite/auditbeat/auditbeat-pipeline.yml
index c954f8fb334..7b5e3d841ab 100644
--- a/.buildkite/auditbeat/auditbeat-pipeline.yml
+++ b/.buildkite/auditbeat/auditbeat-pipeline.yml
@@ -9,131 +9,160 @@ env:
   IMAGE_RHEL9: "family/core-rhel-9"
 
 steps:
-  - group: "Auditbeat Mandatory Testing"
-    key: "mandatory-tests"
-    if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat" || build.env("BUILDKITE_PULL_REQUEST") != "false"
-
-    steps:
-      - label: ":ubuntu: Unit Tests"
-        command:
-          - ".buildkite/auditbeat/scripts/unit-tests.sh"
-        notify:
-          - github_commit_status:
-              context: "auditbeat: Unit Tests"
-        agents:
-          provider: "gcp"
-          image: "${IMAGE_UBUNTU_X86_64}"
-        artifact_paths:
-          - "auditbeat/build/*.xml"
-          - "auditbeat/build/*.json"
+#  - group: "Auditbeat Mandatory Testing"
+#    key: "mandatory-tests"
+#    if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat" || build.env("BUILDKITE_PULL_REQUEST") != "false"
+#
+#    steps:
+#      - label: ":ubuntu: Unit Tests"
+#        command:
+#          - ".buildkite/auditbeat/scripts/unit-tests.sh"
+#        notify:
+#          - github_commit_status:
+#              context: "auditbeat: Unit Tests"
+#        agents:
+#          provider: "gcp"
+#          image: "${IMAGE_UBUNTU_X86_64}"
+#        artifact_paths:
+#          - "auditbeat/build/*.xml"
+#          - "auditbeat/build/*.json"
+#
+#      - label: ":rhel: Unit Tests"
+#        command:
+#          - ".buildkite/auditbeat/scripts/unit-tests.sh"
+#        notify:
+#          - github_commit_status:
+#              context: "auditbeat: Unit Tests"
+#        agents:
+#          provider: "gcp"
+#          image: "${IMAGE_RHEL9}"
+#        artifact_paths:
+#          - "auditbeat/build/*.xml"
+#          - "auditbeat/build/*.json"
+#
+#      - label: ":windows:-{{matrix.image}} Unit Tests"
+#        command: ".buildkite/auditbeat/scripts/unit-tests-win.ps1"
+#        notify:
+#          - github_commit_status:
+#              context: "auditbeat: Unit Tests"
+#        agents:
+#          provider: "gcp"
+#          image: "{{matrix.image}}"
+#          machine_type: "n2-standard-8"
+#          disk_size: 200
+#          disk_type: "pd-ssd"
+#        matrix:
+#          setup:
+#            image:
+#              - "${IMAGE_WIN_2016}"
+#              - "${IMAGE_WIN_2022}"
+#        artifact_paths:
+#          - "auditbeat/build/*.xml"
+#          - "auditbeat/build/*.json"
+#
+#      - label: ":linux: Crosscompile"
+#        command:
+#          - ".buildkite/auditbeat/scripts/crosscompile.sh"
+#        env:
+#          GOX_FLAGS: "-arch amd64"
+#        notify:
+#          - github_commit_status:
+#              context: "auditbeat: Unit Tests"
+#        agents:
+#          provider: "gcp"
+#          image: "${IMAGE_UBUNTU_X86_64}"
+#
+#  - group: "Extended Testing"
+#    key: "extended-tests"
+#    if: build.env("BUILDKITE_PULL_REQUEST") != "false" || build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat extended tests"
+#
+#    steps:
+#      - label: ":linux: ARM64 Unit Tests"
+#        key: "arm-extended"
+#        if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for arm" || build.env("GITHUB_PR_LABELS") =~ /.*arm.*/
+#        command:
+#          - ".buildkite/auditbeat/scripts/unit-tests.sh"
+#        notify:
+#          - github_commit_status:
+#              context: "auditbeat/Extended: Unit Tests ARM"
+#        agents:
+#          provider: "aws"
+#          imagePrefix: "${IMAGE_UBUNTU_ARM_64}"
+#          instanceType: "t4g.large"
+#        artifact_paths: "auditbeat/build/*.xml"
+#
+#      - label: ":mac: MacOS Unit Tests"
+#        key: "macos-extended"
+#        if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for macos" || build.env("GITHUB_PR_LABELS") =~ /.*macOS.*/
+#        command:
+#          - ".buildkite/auditbeat/scripts/unit-tests.sh"
+#        notify:
+#          - github_commit_status:
+#              context: "auditbeat/Extended: MacOS Unit Tests"
+#        agents:
+#          provider: "orka"
+#          imagePrefix: "generic-13-ventura-x64"
+#        artifact_paths: "auditbeat/build/*.xml"
+#
+#  - group: "Windows Extended Testing"
+#    key: "extended-tests-win"
+#    if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for windows" || build.env("GITHUB_PR_LABELS") =~ /.*windows.*/
+#
+#    steps:
+#      - label: ":windows: Win 2019 Unit Tests"
+#        key: "win-extended-2019"
+#        command: ".buildkite/auditbeat/scripts/unit-tests-win.ps1"
+#        notify:
+#          - github_commit_status:
+#              context: "auditbeat/Extended: Win-2019 Unit Tests"
+#        agents:
+#          provider: "gcp"
+#          image: "${IMAGE_WIN_2019}"
+#          machine_type: "n2-standard-8"
+#          disk_size: 200
+#          disk_type: "pd-ssd"
+#        artifact_paths:
+#          - "auditbeat/build/*.xml"
+#          - "auditbeat/build/*.json"
 
-      - label: ":rhel: Unit Tests"
-        command:
-          - ".buildkite/auditbeat/scripts/unit-tests.sh"
-        notify:
-          - github_commit_status:
-              context: "auditbeat: Unit Tests"
-        agents:
-          provider: "gcp"
-          image: "${IMAGE_RHEL9}"
-        artifact_paths:
-          - "auditbeat/build/*.xml"
-          - "auditbeat/build/*.json"
+  - group: "Packaging"
+    key: "packaging"
+    if: build.env("BUILDKITE_PULL_REQUEST") != "false"
+#    depends_on:
+#      - "mandatory-tests"
+#      - "extended-tests"
+#      - "extended-tests-win"
 
-      - label: ":windows:-{{matrix.image}} Unit Tests"
-        command: ".buildkite/auditbeat/scripts/unit-tests-win.ps1"
-        notify:
-          - github_commit_status:
-              context: "auditbeat: Unit Tests"
-        agents:
-          provider: "gcp"
-          image: "{{matrix.image}}"
-          machine_type: "n2-standard-8"
-          disk_size: 200
-          disk_type: "pd-ssd"
-        matrix:
-          setup:
-            image:
-              - "${IMAGE_WIN_2016}"
-              - "${IMAGE_WIN_2022}"
-        artifact_paths:
-          - "auditbeat/build/*.xml"
-          - "auditbeat/build/*.json"
+    steps:
+#      - label: Package pipeline
+#        env:
+#          PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
+#        commands: ".buildkite/auditbeat/scripts/package-step.sh | buildkite-agent pipeline upload"
 
-      - label: ":linux: Crosscompile"
-        command:
-          - ".buildkite/auditbeat/scripts/crosscompile.sh"
+      - label: ":ubuntu: Packaging Linux X86"
+        key: "package-linux-x86"
         env:
-          GOX_FLAGS: "-arch amd64"
+          PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
+        command:
+          - ".buildkite/auditbeat/scripts/package.sh"
         notify:
           - github_commit_status:
-              context: "auditbeat: Unit Tests"
+              context: "auditbeat/Packaging: Linux X86"
         agents:
           provider: "gcp"
           image: "${IMAGE_UBUNTU_X86_64}"
 
-  - group: "Extended Testing"
-    key: "extended-tests"
-    if: build.env("BUILDKITE_PULL_REQUEST") != "false" || build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat extended tests"
-
-    steps:
-      - label: ":linux: ARM64 Unit Tests"
-        key: "arm-extended"
-        if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for arm" || build.env("GITHUB_PR_LABELS") =~ /.*arm.*/
+      - label: ":linux: Packaging Linux ARM"
+        key: "package-linux-arm"
+        env:
+          PLATFORMS: "linux/arm64"
+          PACKAGES: "docker"
         command:
-          - ".buildkite/auditbeat/scripts/unit-tests.sh"
+          - ".buildkite/auditbeat/scripts/package.sh"
         notify:
           - github_commit_status:
-              context: "auditbeat/Extended: Unit Tests ARM"
+              context: "auditbeat/Packaging: Linux ARM"
         agents:
           provider: "aws"
           imagePrefix: "${IMAGE_UBUNTU_ARM_64}"
           instanceType: "t4g.large"
-        artifact_paths: "auditbeat/build/*.xml"
-
-      - label: ":mac: MacOS Unit Tests"
-        key: "macos-extended"
-#        if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for macos" || build.env("GITHUB_PR_LABELS") =~ /.*macOS.*/
-        command:
-#          - "chgrp staff /tmp"
-          - ".buildkite/auditbeat/scripts/unit-tests.sh"
-        notify:
-          - github_commit_status:
-              context: "auditbeat/Extended: MacOS Unit Tests"
-        agents:
-          provider: "orka"
-          imagePrefix: "generic-13-ventura-x64"
-        artifact_paths: "auditbeat/build/*.xml"
-
-  - group: "Windows Extended Testing"
-    key: "extended-tests-win"
-    if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for windows" || build.env("GITHUB_PR_LABELS") =~ /.*windows.*/
-
-    steps:
-      - label: ":windows: Win 2019 Unit Tests"
-        key: "win-extended-2019"
-        command: ".buildkite/auditbeat/scripts/unit-tests-win.ps1"
-        notify:
-          - github_commit_status:
-              context: "auditbeat/Extended: Win-2019 Unit Tests"
-        agents:
-          provider: "gcp"
-          image: "${IMAGE_WIN_2019}"
-          machine_type: "n2-standard-8"
-          disk_size: 200
-          disk_type: "pd-ssd"
-        artifact_paths:
-          - "auditbeat/build/*.xml"
-          - "auditbeat/build/*.json"
-
-  - group: "Packaging"
-    key: "packaging"
-    if: build.env("BUILDKITE_PULL_REQUEST") != "false"
-    depends_on:
-      - "mandatory-tests"
-      - "extended-tests"
-      - "extended-tests-win"
-
-    steps:
-      - label: Package pipeline
-        commands: ".buildkite/auditbeat/scripts/package-step.sh | buildkite-agent pipeline upload"
diff --git a/.buildkite/auditbeat/scripts/package-step.sh b/.buildkite/auditbeat/scripts/package-step.sh
index b9cdd24083d..269b4058c40 100755
--- a/.buildkite/auditbeat/scripts/package-step.sh
+++ b/.buildkite/auditbeat/scripts/package-step.sh
@@ -2,6 +2,8 @@
 
 set -euo pipefail
 
+source .buildkite/env-scripts/util.sh
+
 changeset="^auditbeat/
     ^go.mod
     ^pytest.ini
@@ -17,8 +19,6 @@ if are_files_changed "$changeset"; then
         key: "package-linux-x86"
         command:
           - ".buildkite/auditbeat/scripts/package.sh"
-        env:
-          PLATFORMS: "linux/amd64, linux/arm64, windows/amd64, darwin/amd64, darwin/arm64"
         notify:
           - github_commit_status:
               context: "auditbeat/Packaging: Linux X86"
@@ -35,7 +35,7 @@ if are_files_changed "$changeset"; then
           - ".buildkite/auditbeat/scripts/package.sh"
         notify:
           - github_commit_status:
-              context: "auditbeat/Packaging: ARM"
+              context: "auditbeat/Packaging: Linux ARM"
         agents:
           provider: "aws"
           imagePrefix: "${IMAGE_UBUNTU_ARM_64}"
diff --git a/.buildkite/env-scripts/unix-env.sh b/.buildkite/env-scripts/unix-env.sh
index 606eea83378..d3340dd4563 100644
--- a/.buildkite/env-scripts/unix-env.sh
+++ b/.buildkite/env-scripts/unix-env.sh
@@ -6,6 +6,9 @@ source .buildkite/env-scripts/util.sh
 
 DEBIAN_FRONTEND="noninteractive"
 
+sudo mkdir -p /etc/needrestart
+echo "\$nrconf{restart} = 'a';" | sudo tee -a /etc/needrestart/needrestart.conf > /dev/null
+
 echo ":: PLATFORM TYPE $PLATFORM_TYPE ::"
 
 if [[ $PLATFORM_TYPE == "Linux" ]]; then

From 8c4cf2ca1d1594d1383244cee85a35a8c46a3fe4 Mon Sep 17 00:00:00 2001
From: Olga Naidjonoka <olga_naidjonoka@epam.com>
Date: Tue, 23 Jan 2024 17:33:10 +0200
Subject: [PATCH 16/21] added docker login

---
 .buildkite/env-scripts/env.sh  |  6 ++++++
 .buildkite/env-scripts/util.sh | 14 ++++++++++++++
 .buildkite/hooks/pre-command   |  7 +++++++
 .buildkite/hooks/pre-exit      | 14 ++++++++++++++
 4 files changed, 41 insertions(+)
 create mode 100644 .buildkite/hooks/pre-exit

diff --git a/.buildkite/env-scripts/env.sh b/.buildkite/env-scripts/env.sh
index d94d03aad53..4dfc01bafc3 100644
--- a/.buildkite/env-scripts/env.sh
+++ b/.buildkite/env-scripts/env.sh
@@ -5,9 +5,15 @@ WORKSPACE="$(pwd)"
 BIN="${WORKSPACE}/bin"
 HW_TYPE="$(uname -m)"
 PLATFORM_TYPE="$(uname)"
+REPO="beats"
+TMP_FOLDER="tmp.${REPO}"
+DOCKER_REGISTRY="docker.elastic.co"
 
 export SETUP_GVM_VERSION
 export WORKSPACE
 export BIN
 export HW_TYPE
 export PLATFORM_TYPE
+export REPO
+export TMP_FOLDER
+export DOCKER_REGISTRY
diff --git a/.buildkite/env-scripts/util.sh b/.buildkite/env-scripts/util.sh
index 157a5aff37a..7aef69cff38 100644
--- a/.buildkite/env-scripts/util.sh
+++ b/.buildkite/env-scripts/util.sh
@@ -89,3 +89,17 @@ are_files_changed() {
     return 1;
   fi
 }
+
+cleanup() {
+  echo "Deleting temporary files..."
+  rm -rf ${BIN}/${TMP_FOLDER}.*
+  echo "Done."
+}
+
+unset_secrets () {
+  for var in $(printenv | sed 's;=.*;;' | sort); do
+    if [[ "$var" == *_SECRET || "$var" == *_TOKEN ]]; then
+      unset "$var"
+    fi
+  done
+}
diff --git a/.buildkite/hooks/pre-command b/.buildkite/hooks/pre-command
index 604d544d892..acfa9a92d3b 100644
--- a/.buildkite/hooks/pre-command
+++ b/.buildkite/hooks/pre-command
@@ -2,6 +2,8 @@
 
 set -euo pipefail
 
+DOCKER_REGISTRY_SECRET_PATH="kv/ci-shared/platform-ingest/docker_registry_prod"
+
 if [[ "$BUILDKITE_PIPELINE_SLUG" == "filebeat" ]]; then
   source .buildkite/env-scripts/env.sh
   source .buildkite/env-scripts/util.sh
@@ -27,3 +29,8 @@ if [[ "$BUILDKITE_PIPELINE_SLUG" == "beats-metricbeat" ]]; then
     exit 0
   fi
 fi
+
+if [[ "$BUILDKITE_PIPELINE_SLUG" == "auditbeat" && "$BUILDKITE_STEP_KEY" == package* ]]; then
+  export DOCKER_USERNAME_SECRET=$(retry 5 vault kv get -field user "${DOCKER_REGISTRY_SECRET_PATH}")
+  export DOCKER_PASSWORD_SECRET=$(retry 5 vault kv get -field password "${DOCKER_REGISTRY_SECRET_PATH}")
+fi
diff --git a/.buildkite/hooks/pre-exit b/.buildkite/hooks/pre-exit
new file mode 100644
index 00000000000..d65d489c541
--- /dev/null
+++ b/.buildkite/hooks/pre-exit
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+source .buildkite/env-scripts/util.sh
+
+unset_secrets
+
+if [[ "$BUILDKITE_PIPELINE_SLUG" == "auditbeat" && "$BUILDKITE_STEP_KEY" == package* ]]; then
+     docker logout "${DOCKER_REGISTRY}"
+fi
+
+# Ensure that any temporal files created during any step are removed
+cleanup

From ec3f080c9b0b2586b22fc8722f5d7d73358293c8 Mon Sep 17 00:00:00 2001
From: Olga Naidjonoka <olga_naidjonoka@epam.com>
Date: Tue, 23 Jan 2024 19:57:54 +0200
Subject: [PATCH 17/21] debugging arm packaing

---
 .buildkite/auditbeat/auditbeat-pipeline.yml |  2 ++
 .buildkite/hooks/pre-exit                   | 14 --------------
 auditbeat/magefile.go                       |  4 ++++
 3 files changed, 6 insertions(+), 14 deletions(-)
 delete mode 100644 .buildkite/hooks/pre-exit

diff --git a/.buildkite/auditbeat/auditbeat-pipeline.yml b/.buildkite/auditbeat/auditbeat-pipeline.yml
index 7b5e3d841ab..902f4e2dfd4 100644
--- a/.buildkite/auditbeat/auditbeat-pipeline.yml
+++ b/.buildkite/auditbeat/auditbeat-pipeline.yml
@@ -166,3 +166,5 @@ steps:
           provider: "aws"
           imagePrefix: "${IMAGE_UBUNTU_ARM_64}"
           instanceType: "t4g.large"
+        artifact_paths:
+          - "auditbeat/build/distributions/*.tar.gz"
diff --git a/.buildkite/hooks/pre-exit b/.buildkite/hooks/pre-exit
deleted file mode 100644
index d65d489c541..00000000000
--- a/.buildkite/hooks/pre-exit
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-source .buildkite/env-scripts/util.sh
-
-unset_secrets
-
-if [[ "$BUILDKITE_PIPELINE_SLUG" == "auditbeat" && "$BUILDKITE_STEP_KEY" == package* ]]; then
-     docker logout "${DOCKER_REGISTRY}"
-fi
-
-# Ensure that any temporal files created during any step are removed
-cleanup
diff --git a/auditbeat/magefile.go b/auditbeat/magefile.go
index 1f17ed60fae..0e6e2b487d5 100644
--- a/auditbeat/magefile.go
+++ b/auditbeat/magefile.go
@@ -21,6 +21,8 @@ package main
 
 import (
 	"fmt"
+	"log"
+	"os"
 	"time"
 
 	"github.com/magefile/mage/mg"
@@ -95,6 +97,8 @@ func Package() {
 	start := time.Now()
 	defer func() { fmt.Println("package ran for", time.Since(start)) }()
 
+	log.SetOutput(os.Stdout)
+
 	devtools.UseElasticBeatOSSPackaging()
 	devtools.PackageKibanaDashboardsFromBuildDir()
 	auditbeat.CustomizePackaging(auditbeat.OSSPackaging)

From 0a781933c76dfb8b0807914d6c56c32ccf8afecd Mon Sep 17 00:00:00 2001
From: Olga Naidjonoka <olga_naidjonoka@epam.com>
Date: Wed, 24 Jan 2024 10:35:51 +0200
Subject: [PATCH 18/21] enabled synamic packaging step

---
 .buildkite/auditbeat/auditbeat-pipeline.yml   | 244 +++++++++---------
 .buildkite/auditbeat/scripts/crosscompile.sh  |   2 +-
 .buildkite/auditbeat/scripts/package-step.sh  |   7 +-
 .buildkite/auditbeat/scripts/package.sh       |   5 +-
 .buildkite/auditbeat/scripts/unit-tests.sh    |   2 +-
 .buildkite/env-scripts/linux-env.sh           |  39 ++-
 .buildkite/env-scripts/unix-env.sh            |  47 ----
 .../filebeat/scripts/integration-gotests.sh   |   2 +-
 .../filebeat/scripts/integration-pytests.sh   |   2 +-
 .buildkite/filebeat/scripts/package.sh        |   2 +-
 .buildkite/filebeat/scripts/unit-tests.sh     |   2 +-
 11 files changed, 165 insertions(+), 189 deletions(-)
 delete mode 100644 .buildkite/env-scripts/unix-env.sh

diff --git a/.buildkite/auditbeat/auditbeat-pipeline.yml b/.buildkite/auditbeat/auditbeat-pipeline.yml
index 902f4e2dfd4..d1f0143dbe0 100644
--- a/.buildkite/auditbeat/auditbeat-pipeline.yml
+++ b/.buildkite/auditbeat/auditbeat-pipeline.yml
@@ -9,135 +9,133 @@ env:
   IMAGE_RHEL9: "family/core-rhel-9"
 
 steps:
-#  - group: "Auditbeat Mandatory Testing"
-#    key: "mandatory-tests"
-#    if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat" || build.env("BUILDKITE_PULL_REQUEST") != "false"
-#
-#    steps:
-#      - label: ":ubuntu: Unit Tests"
-#        command:
-#          - ".buildkite/auditbeat/scripts/unit-tests.sh"
-#        notify:
-#          - github_commit_status:
-#              context: "auditbeat: Unit Tests"
-#        agents:
-#          provider: "gcp"
-#          image: "${IMAGE_UBUNTU_X86_64}"
-#        artifact_paths:
-#          - "auditbeat/build/*.xml"
-#          - "auditbeat/build/*.json"
-#
-#      - label: ":rhel: Unit Tests"
-#        command:
-#          - ".buildkite/auditbeat/scripts/unit-tests.sh"
-#        notify:
-#          - github_commit_status:
-#              context: "auditbeat: Unit Tests"
-#        agents:
-#          provider: "gcp"
-#          image: "${IMAGE_RHEL9}"
-#        artifact_paths:
-#          - "auditbeat/build/*.xml"
-#          - "auditbeat/build/*.json"
-#
-#      - label: ":windows:-{{matrix.image}} Unit Tests"
-#        command: ".buildkite/auditbeat/scripts/unit-tests-win.ps1"
-#        notify:
-#          - github_commit_status:
-#              context: "auditbeat: Unit Tests"
-#        agents:
-#          provider: "gcp"
-#          image: "{{matrix.image}}"
-#          machine_type: "n2-standard-8"
-#          disk_size: 200
-#          disk_type: "pd-ssd"
-#        matrix:
-#          setup:
-#            image:
-#              - "${IMAGE_WIN_2016}"
-#              - "${IMAGE_WIN_2022}"
-#        artifact_paths:
-#          - "auditbeat/build/*.xml"
-#          - "auditbeat/build/*.json"
-#
-#      - label: ":linux: Crosscompile"
-#        command:
-#          - ".buildkite/auditbeat/scripts/crosscompile.sh"
-#        env:
-#          GOX_FLAGS: "-arch amd64"
-#        notify:
-#          - github_commit_status:
-#              context: "auditbeat: Unit Tests"
-#        agents:
-#          provider: "gcp"
-#          image: "${IMAGE_UBUNTU_X86_64}"
-#
-#  - group: "Extended Testing"
-#    key: "extended-tests"
-#    if: build.env("BUILDKITE_PULL_REQUEST") != "false" || build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat extended tests"
-#
-#    steps:
-#      - label: ":linux: ARM64 Unit Tests"
-#        key: "arm-extended"
-#        if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for arm" || build.env("GITHUB_PR_LABELS") =~ /.*arm.*/
-#        command:
-#          - ".buildkite/auditbeat/scripts/unit-tests.sh"
-#        notify:
-#          - github_commit_status:
-#              context: "auditbeat/Extended: Unit Tests ARM"
-#        agents:
-#          provider: "aws"
-#          imagePrefix: "${IMAGE_UBUNTU_ARM_64}"
-#          instanceType: "t4g.large"
-#        artifact_paths: "auditbeat/build/*.xml"
-#
-#      - label: ":mac: MacOS Unit Tests"
-#        key: "macos-extended"
-#        if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for macos" || build.env("GITHUB_PR_LABELS") =~ /.*macOS.*/
-#        command:
-#          - ".buildkite/auditbeat/scripts/unit-tests.sh"
-#        notify:
-#          - github_commit_status:
-#              context: "auditbeat/Extended: MacOS Unit Tests"
-#        agents:
-#          provider: "orka"
-#          imagePrefix: "generic-13-ventura-x64"
-#        artifact_paths: "auditbeat/build/*.xml"
-#
-#  - group: "Windows Extended Testing"
-#    key: "extended-tests-win"
-#    if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for windows" || build.env("GITHUB_PR_LABELS") =~ /.*windows.*/
-#
-#    steps:
-#      - label: ":windows: Win 2019 Unit Tests"
-#        key: "win-extended-2019"
-#        command: ".buildkite/auditbeat/scripts/unit-tests-win.ps1"
-#        notify:
-#          - github_commit_status:
-#              context: "auditbeat/Extended: Win-2019 Unit Tests"
-#        agents:
-#          provider: "gcp"
-#          image: "${IMAGE_WIN_2019}"
-#          machine_type: "n2-standard-8"
-#          disk_size: 200
-#          disk_type: "pd-ssd"
-#        artifact_paths:
-#          - "auditbeat/build/*.xml"
-#          - "auditbeat/build/*.json"
+  - group: "Auditbeat Mandatory Testing"
+    key: "mandatory-tests"
+    if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat" || build.env("BUILDKITE_PULL_REQUEST") != "false"
+
+    steps:
+      - label: ":ubuntu: Unit Tests"
+        command:
+          - ".buildkite/auditbeat/scripts/unit-tests.sh"
+        notify:
+          - github_commit_status:
+              context: "auditbeat: Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_UBUNTU_X86_64}"
+        artifact_paths:
+          - "auditbeat/build/*.xml"
+          - "auditbeat/build/*.json"
+
+      - label: ":rhel: Unit Tests"
+        command:
+          - ".buildkite/auditbeat/scripts/unit-tests.sh"
+        notify:
+          - github_commit_status:
+              context: "auditbeat: Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_RHEL9}"
+        artifact_paths:
+          - "auditbeat/build/*.xml"
+          - "auditbeat/build/*.json"
+
+      - label: ":windows:-{{matrix.image}} Unit Tests"
+        command: ".buildkite/auditbeat/scripts/unit-tests-win.ps1"
+        notify:
+          - github_commit_status:
+              context: "auditbeat: Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "{{matrix.image}}"
+          machine_type: "n2-standard-8"
+          disk_size: 200
+          disk_type: "pd-ssd"
+        matrix:
+          setup:
+            image:
+              - "${IMAGE_WIN_2016}"
+              - "${IMAGE_WIN_2022}"
+        artifact_paths:
+          - "auditbeat/build/*.xml"
+          - "auditbeat/build/*.json"
+
+      - label: ":linux: Crosscompile"
+        command:
+          - ".buildkite/auditbeat/scripts/crosscompile.sh"
+        env:
+          GOX_FLAGS: "-arch amd64"
+        notify:
+          - github_commit_status:
+              context: "auditbeat: Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_UBUNTU_X86_64}"
+
+  - group: "Extended Testing"
+    key: "extended-tests"
+    if: build.env("BUILDKITE_PULL_REQUEST") != "false" || build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat extended tests"
+
+    steps:
+      - label: ":linux: ARM64 Unit Tests"
+        key: "arm-extended"
+        if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for arm" || build.env("GITHUB_PR_LABELS") =~ /.*arm.*/
+        command:
+          - ".buildkite/auditbeat/scripts/unit-tests.sh"
+        notify:
+          - github_commit_status:
+              context: "auditbeat/Extended: Unit Tests ARM"
+        agents:
+          provider: "aws"
+          imagePrefix: "${IMAGE_UBUNTU_ARM_64}"
+          instanceType: "t4g.large"
+        artifact_paths: "auditbeat/build/*.xml"
+
+      - label: ":mac: MacOS Unit Tests"
+        key: "macos-extended"
+        if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for macos" || build.env("GITHUB_PR_LABELS") =~ /.*macOS.*/
+        command:
+          - ".buildkite/auditbeat/scripts/unit-tests.sh"
+        notify:
+          - github_commit_status:
+              context: "auditbeat/Extended: MacOS Unit Tests"
+        agents:
+          provider: "orka"
+          imagePrefix: "generic-13-ventura-x64"
+        artifact_paths: "auditbeat/build/*.xml"
+
+  - group: "Windows Extended Testing"
+    key: "extended-tests-win"
+    if: build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for windows" || build.env("GITHUB_PR_LABELS") =~ /.*windows.*/
+
+    steps:
+      - label: ":windows: Win 2019 Unit Tests"
+        key: "win-extended-2019"
+        command: ".buildkite/auditbeat/scripts/unit-tests-win.ps1"
+        notify:
+          - github_commit_status:
+              context: "auditbeat/Extended: Win-2019 Unit Tests"
+        agents:
+          provider: "gcp"
+          image: "${IMAGE_WIN_2019}"
+          machine_type: "n2-standard-8"
+          disk_size: 200
+          disk_type: "pd-ssd"
+        artifact_paths:
+          - "auditbeat/build/*.xml"
+          - "auditbeat/build/*.json"
 
   - group: "Packaging"
     key: "packaging"
     if: build.env("BUILDKITE_PULL_REQUEST") != "false"
-#    depends_on:
-#      - "mandatory-tests"
-#      - "extended-tests"
-#      - "extended-tests-win"
+    depends_on:
+      - "mandatory-tests"
+      - "extended-tests"
+      - "extended-tests-win"
 
     steps:
-#      - label: Package pipeline
-#        env:
-#          PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
-#        commands: ".buildkite/auditbeat/scripts/package-step.sh | buildkite-agent pipeline upload"
+      - label: Package pipeline
+        commands: ".buildkite/auditbeat/scripts/package-step.sh | buildkite-agent pipeline upload"
 
       - label: ":ubuntu: Packaging Linux X86"
         key: "package-linux-x86"
diff --git a/.buildkite/auditbeat/scripts/crosscompile.sh b/.buildkite/auditbeat/scripts/crosscompile.sh
index 9f6896eec5c..7affd50f694 100755
--- a/.buildkite/auditbeat/scripts/crosscompile.sh
+++ b/.buildkite/auditbeat/scripts/crosscompile.sh
@@ -2,7 +2,7 @@
 
 set -euo pipefail
 
-source .buildkite/env-scripts/unix-env.sh
+source .buildkite/env-scripts/linux-env.sh
 
 echo ":: Executing Crosscompile ::"
 make -C auditbeat crosscompile
diff --git a/.buildkite/auditbeat/scripts/package-step.sh b/.buildkite/auditbeat/scripts/package-step.sh
index 269b4058c40..8b348bafa71 100755
--- a/.buildkite/auditbeat/scripts/package-step.sh
+++ b/.buildkite/auditbeat/scripts/package-step.sh
@@ -17,11 +17,13 @@ if are_files_changed "$changeset"; then
     steps:
       - label: ":ubuntu: Packaging Linux X86"
         key: "package-linux-x86"
+        env:
+          PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
         command:
           - ".buildkite/auditbeat/scripts/package.sh"
         notify:
           - github_commit_status:
-              context: "auditbeat/Packaging: Linux X86"
+              context: "Auditbeat/Packaging: Linux X86"
         agents:
           provider: "gcp"
           image: "${IMAGE_UBUNTU_X86_64}"
@@ -35,11 +37,10 @@ if are_files_changed "$changeset"; then
           - ".buildkite/auditbeat/scripts/package.sh"
         notify:
           - github_commit_status:
-              context: "auditbeat/Packaging: Linux ARM"
+              context: "Auditbeat/Packaging: ARM"
         agents:
           provider: "aws"
           imagePrefix: "${IMAGE_UBUNTU_ARM_64}"
           instanceType: "t4g.large"
 EOF
 fi
-
diff --git a/.buildkite/auditbeat/scripts/package.sh b/.buildkite/auditbeat/scripts/package.sh
index 868897e5471..58d86bfb8b4 100755
--- a/.buildkite/auditbeat/scripts/package.sh
+++ b/.buildkite/auditbeat/scripts/package.sh
@@ -2,9 +2,10 @@
 
 set -euo pipefail
 
-source .buildkite/env-scripts/unix-env.sh
+source .buildkite/env-scripts/linux-env.sh
 
-echo ":: Evaluate Auditbeat Changes ::"
+echo ":: Docker Version ::"
+docker --version
 
 echo ":: Start Packaging ::"
 cd auditbeat
diff --git a/.buildkite/auditbeat/scripts/unit-tests.sh b/.buildkite/auditbeat/scripts/unit-tests.sh
index d63365d6dc4..9065d5b5736 100755
--- a/.buildkite/auditbeat/scripts/unit-tests.sh
+++ b/.buildkite/auditbeat/scripts/unit-tests.sh
@@ -2,7 +2,7 @@
 
 set -euo pipefail
 
-source .buildkite/env-scripts/unix-env.sh
+source .buildkite/env-scripts/linux-env.sh
 
 echo ":: Running Unit Tests ::"
 sudo chmod -R go-w auditbeat/
diff --git a/.buildkite/env-scripts/linux-env.sh b/.buildkite/env-scripts/linux-env.sh
index edaf1a3100c..d3340dd4563 100644
--- a/.buildkite/env-scripts/linux-env.sh
+++ b/.buildkite/env-scripts/linux-env.sh
@@ -1,21 +1,44 @@
 #!/usr/bin/env bash
 
+set -euo pipefail
+
 source .buildkite/env-scripts/util.sh
 
 DEBIAN_FRONTEND="noninteractive"
 
-export DEBIAN_FRONTEND
-
 sudo mkdir -p /etc/needrestart
 echo "\$nrconf{restart} = 'a';" | sudo tee -a /etc/needrestart/needrestart.conf > /dev/null
 
-# Remove this code once beats specific agent is set up
+echo ":: PLATFORM TYPE $PLATFORM_TYPE ::"
+
 if [[ $PLATFORM_TYPE == "Linux" ]]; then
-  echo ":: Installing libs ::"
-  sudo apt-get update
-  sudo apt-get install -y libsystemd-dev
-  sudo apt install -y python3-pip
-  sudo apt-get install -y python3-venv
+  # Remove this code once beats specific agent is set up
+  if grep -q 'Ubuntu' /etc/*release; then
+    export DEBIAN_FRONTEND
+
+    echo ":: Ubuntu - Installing libs ::"
+    sudo apt-get update
+    sudo apt-get install -y libsystemd-dev
+    sudo apt install -y python3-pip
+    sudo apt-get install -y python3-venv
+  fi
+
+  # Remove this code once beats specific agent is set up
+  if grep -q 'Red Hat' /etc/*release; then
+    echo ":: RHL - Installing libs ::"
+    sudo yum update -y
+    sudo yum install -y systemd-devel
+    sudo yum install -y python3-pip
+    sudo yum install -y python3
+    pip3 install virtualenv
+  fi
+fi
+
+if [[ $PLATFORM_TYPE == Darwin* ]]; then
+  echo ":: Setting larger ulimit on MacOS ::"
+  # To bypass file descriptor errors like "Too many open files error" on MacOS
+  ulimit -Sn 50000
+  echo ":: ULIMIT :: $(ulimit -n)"
 fi
 
 echo ":: Setting up environment ::"
diff --git a/.buildkite/env-scripts/unix-env.sh b/.buildkite/env-scripts/unix-env.sh
deleted file mode 100644
index d3340dd4563..00000000000
--- a/.buildkite/env-scripts/unix-env.sh
+++ /dev/null
@@ -1,47 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-source .buildkite/env-scripts/util.sh
-
-DEBIAN_FRONTEND="noninteractive"
-
-sudo mkdir -p /etc/needrestart
-echo "\$nrconf{restart} = 'a';" | sudo tee -a /etc/needrestart/needrestart.conf > /dev/null
-
-echo ":: PLATFORM TYPE $PLATFORM_TYPE ::"
-
-if [[ $PLATFORM_TYPE == "Linux" ]]; then
-  # Remove this code once beats specific agent is set up
-  if grep -q 'Ubuntu' /etc/*release; then
-    export DEBIAN_FRONTEND
-
-    echo ":: Ubuntu - Installing libs ::"
-    sudo apt-get update
-    sudo apt-get install -y libsystemd-dev
-    sudo apt install -y python3-pip
-    sudo apt-get install -y python3-venv
-  fi
-
-  # Remove this code once beats specific agent is set up
-  if grep -q 'Red Hat' /etc/*release; then
-    echo ":: RHL - Installing libs ::"
-    sudo yum update -y
-    sudo yum install -y systemd-devel
-    sudo yum install -y python3-pip
-    sudo yum install -y python3
-    pip3 install virtualenv
-  fi
-fi
-
-if [[ $PLATFORM_TYPE == Darwin* ]]; then
-  echo ":: Setting larger ulimit on MacOS ::"
-  # To bypass file descriptor errors like "Too many open files error" on MacOS
-  ulimit -Sn 50000
-  echo ":: ULIMIT :: $(ulimit -n)"
-fi
-
-echo ":: Setting up environment ::"
-add_bin_path
-with_go
-with_mage
diff --git a/.buildkite/filebeat/scripts/integration-gotests.sh b/.buildkite/filebeat/scripts/integration-gotests.sh
index 6a48af79af7..a3eabf70c0d 100755
--- a/.buildkite/filebeat/scripts/integration-gotests.sh
+++ b/.buildkite/filebeat/scripts/integration-gotests.sh
@@ -2,7 +2,7 @@
 
 set -euo pipefail
 
-source .buildkite/env-scripts/unix-env.sh
+source .buildkite/env-scripts/linux-env.sh
 
 echo ":: Execute Integration Tests ::"
 sudo chmod -R go-w filebeat/
diff --git a/.buildkite/filebeat/scripts/integration-pytests.sh b/.buildkite/filebeat/scripts/integration-pytests.sh
index f5c9dfa615b..5e2e403dda8 100755
--- a/.buildkite/filebeat/scripts/integration-pytests.sh
+++ b/.buildkite/filebeat/scripts/integration-pytests.sh
@@ -2,7 +2,7 @@
 
 set -euo pipefail
 
-source .buildkite/env-scripts/unix-env.sh
+source .buildkite/env-scripts/linux-env.sh
 
 echo ":: Execute Integration Tests ::"
 sudo chmod -R go-w filebeat/
diff --git a/.buildkite/filebeat/scripts/package.sh b/.buildkite/filebeat/scripts/package.sh
index cdc1146e774..2ae226eb739 100755
--- a/.buildkite/filebeat/scripts/package.sh
+++ b/.buildkite/filebeat/scripts/package.sh
@@ -2,7 +2,7 @@
 
 set -euo pipefail
 
-source .buildkite/env-scripts/unix-env.sh
+source .buildkite/env-scripts/linux-env.sh
 
 echo ":: Evaluate Filebeat Changes ::"
 
diff --git a/.buildkite/filebeat/scripts/unit-tests.sh b/.buildkite/filebeat/scripts/unit-tests.sh
index 9be6867a67b..0372923e54a 100755
--- a/.buildkite/filebeat/scripts/unit-tests.sh
+++ b/.buildkite/filebeat/scripts/unit-tests.sh
@@ -2,7 +2,7 @@
 
 set -euo pipefail
 
-source .buildkite/env-scripts/unix-env.sh
+source .buildkite/env-scripts/linux-env.sh
 
 echo ":: Execute Unit Tests ::"
 sudo chmod -R go-w filebeat/

From dbff6a3af0d32d765098a2101e5a70240be6814f Mon Sep 17 00:00:00 2001
From: Olga Naidjonoka <olga_naidjonoka@epam.com>
Date: Mon, 29 Jan 2024 11:05:39 +0200
Subject: [PATCH 19/21] updated packaging group steps

---
 .buildkite/auditbeat/auditbeat-pipeline.yml   | 37 ++-----------------
 .buildkite/auditbeat/scripts/crosscompile.sh  |  2 +-
 .buildkite/auditbeat/scripts/package.sh       |  5 +--
 .buildkite/auditbeat/scripts/unit-tests.sh    |  2 +-
 .buildkite/env-scripts/linux-env.sh           | 12 +++---
 .buildkite/env-scripts/win-env.sh             |  4 ++
 .../filebeat/scripts/integration-gotests.sh   |  2 +-
 .../filebeat/scripts/integration-pytests.sh   |  2 +-
 .buildkite/filebeat/scripts/package.sh        |  4 +-
 .buildkite/filebeat/scripts/unit-tests.sh     |  2 +-
 .buildkite/pull-requests.json                 |  4 +-
 auditbeat/magefile.go                         |  4 --
 12 files changed, 23 insertions(+), 57 deletions(-)

diff --git a/.buildkite/auditbeat/auditbeat-pipeline.yml b/.buildkite/auditbeat/auditbeat-pipeline.yml
index d1f0143dbe0..147ca45ced1 100644
--- a/.buildkite/auditbeat/auditbeat-pipeline.yml
+++ b/.buildkite/auditbeat/auditbeat-pipeline.yml
@@ -7,6 +7,7 @@ env:
   IMAGE_WIN_2019: "family/core-windows-2019"
   IMAGE_WIN_2022: "family/core-windows-2022"
   IMAGE_RHEL9: "family/core-rhel-9"
+  IMAGE_MACOS_X86_64: "generic-13-ventura-x64"
 
 steps:
   - group: "Auditbeat Mandatory Testing"
@@ -74,7 +75,7 @@ steps:
 
   - group: "Extended Testing"
     key: "extended-tests"
-    if: build.env("BUILDKITE_PULL_REQUEST") != "false" || build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat extended tests"
+    if: build.env("BUILDKITE_PULL_REQUEST") != "false" || build.env("GITHUB_PR_TRIGGER_COMMENT") == "auditbeat for extended support"
 
     steps:
       - label: ":linux: ARM64 Unit Tests"
@@ -101,7 +102,7 @@ steps:
               context: "auditbeat/Extended: MacOS Unit Tests"
         agents:
           provider: "orka"
-          imagePrefix: "generic-13-ventura-x64"
+          imagePrefix: "${IMAGE_MACOS_X86_64}"
         artifact_paths: "auditbeat/build/*.xml"
 
   - group: "Windows Extended Testing"
@@ -130,39 +131,7 @@ steps:
     if: build.env("BUILDKITE_PULL_REQUEST") != "false"
     depends_on:
       - "mandatory-tests"
-      - "extended-tests"
-      - "extended-tests-win"
 
     steps:
       - label: Package pipeline
         commands: ".buildkite/auditbeat/scripts/package-step.sh | buildkite-agent pipeline upload"
-
-      - label: ":ubuntu: Packaging Linux X86"
-        key: "package-linux-x86"
-        env:
-          PLATFORMS: "+all linux/amd64 linux/arm64 windows/amd64 darwin/amd64 darwin/arm64"
-        command:
-          - ".buildkite/auditbeat/scripts/package.sh"
-        notify:
-          - github_commit_status:
-              context: "auditbeat/Packaging: Linux X86"
-        agents:
-          provider: "gcp"
-          image: "${IMAGE_UBUNTU_X86_64}"
-
-      - label: ":linux: Packaging Linux ARM"
-        key: "package-linux-arm"
-        env:
-          PLATFORMS: "linux/arm64"
-          PACKAGES: "docker"
-        command:
-          - ".buildkite/auditbeat/scripts/package.sh"
-        notify:
-          - github_commit_status:
-              context: "auditbeat/Packaging: Linux ARM"
-        agents:
-          provider: "aws"
-          imagePrefix: "${IMAGE_UBUNTU_ARM_64}"
-          instanceType: "t4g.large"
-        artifact_paths:
-          - "auditbeat/build/distributions/*.tar.gz"
diff --git a/.buildkite/auditbeat/scripts/crosscompile.sh b/.buildkite/auditbeat/scripts/crosscompile.sh
index 7affd50f694..866d6be4223 100755
--- a/.buildkite/auditbeat/scripts/crosscompile.sh
+++ b/.buildkite/auditbeat/scripts/crosscompile.sh
@@ -4,5 +4,5 @@ set -euo pipefail
 
 source .buildkite/env-scripts/linux-env.sh
 
-echo ":: Executing Crosscompile ::"
+echo "--- Executing Crosscompile"
 make -C auditbeat crosscompile
diff --git a/.buildkite/auditbeat/scripts/package.sh b/.buildkite/auditbeat/scripts/package.sh
index 58d86bfb8b4..71872ca15a3 100755
--- a/.buildkite/auditbeat/scripts/package.sh
+++ b/.buildkite/auditbeat/scripts/package.sh
@@ -4,10 +4,9 @@ set -euo pipefail
 
 source .buildkite/env-scripts/linux-env.sh
 
-echo ":: Docker Version ::"
-docker --version
+echo "--- Docker Version: $(docker --version)"
 
-echo ":: Start Packaging ::"
+echo "--- Start Packaging"
 cd auditbeat
 umask 0022
 mage package
diff --git a/.buildkite/auditbeat/scripts/unit-tests.sh b/.buildkite/auditbeat/scripts/unit-tests.sh
index 9065d5b5736..c1f5685c77f 100755
--- a/.buildkite/auditbeat/scripts/unit-tests.sh
+++ b/.buildkite/auditbeat/scripts/unit-tests.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 
 source .buildkite/env-scripts/linux-env.sh
 
-echo ":: Running Unit Tests ::"
+echo "--- Running Unit Tests"
 sudo chmod -R go-w auditbeat/
 
 cd auditbeat
diff --git a/.buildkite/env-scripts/linux-env.sh b/.buildkite/env-scripts/linux-env.sh
index d3340dd4563..5e6e5f7cbf0 100644
--- a/.buildkite/env-scripts/linux-env.sh
+++ b/.buildkite/env-scripts/linux-env.sh
@@ -9,14 +9,14 @@ DEBIAN_FRONTEND="noninteractive"
 sudo mkdir -p /etc/needrestart
 echo "\$nrconf{restart} = 'a';" | sudo tee -a /etc/needrestart/needrestart.conf > /dev/null
 
-echo ":: PLATFORM TYPE $PLATFORM_TYPE ::"
+echo "--- PLATFORM TYPE $PLATFORM_TYPE"
 
 if [[ $PLATFORM_TYPE == "Linux" ]]; then
   # Remove this code once beats specific agent is set up
   if grep -q 'Ubuntu' /etc/*release; then
     export DEBIAN_FRONTEND
 
-    echo ":: Ubuntu - Installing libs ::"
+    echo "--- Ubuntu - Installing libs"
     sudo apt-get update
     sudo apt-get install -y libsystemd-dev
     sudo apt install -y python3-pip
@@ -25,7 +25,7 @@ if [[ $PLATFORM_TYPE == "Linux" ]]; then
 
   # Remove this code once beats specific agent is set up
   if grep -q 'Red Hat' /etc/*release; then
-    echo ":: RHL - Installing libs ::"
+    echo "--- RHL - Installing libs"
     sudo yum update -y
     sudo yum install -y systemd-devel
     sudo yum install -y python3-pip
@@ -35,13 +35,13 @@ if [[ $PLATFORM_TYPE == "Linux" ]]; then
 fi
 
 if [[ $PLATFORM_TYPE == Darwin* ]]; then
-  echo ":: Setting larger ulimit on MacOS ::"
+  echo "--- Setting larger ulimit on MacOS"
   # To bypass file descriptor errors like "Too many open files error" on MacOS
   ulimit -Sn 50000
-  echo ":: ULIMIT :: $(ulimit -n)"
+  echo "--- ULIMIT: $(ulimit -n)"
 fi
 
-echo ":: Setting up environment ::"
+echo "--- Setting up environment"
 add_bin_path
 with_go
 with_mage
diff --git a/.buildkite/env-scripts/win-env.sh b/.buildkite/env-scripts/win-env.sh
index aa5f67ca4ce..dbedb29f516 100644
--- a/.buildkite/env-scripts/win-env.sh
+++ b/.buildkite/env-scripts/win-env.sh
@@ -1,8 +1,12 @@
 #!/usr/bin/env bash
 
 install_python_win() {
+  echo "PLATFORM TYPE: ${PLATFORM_TYPE}"
   if [[ ${PLATFORM_TYPE} = MINGW* ]]; then
+    echo "Installing Python on Win"
     choco install mingw -y
     choco install python --version=3.11.0 -y
   fi
 }
+
+install_python_win
diff --git a/.buildkite/filebeat/scripts/integration-gotests.sh b/.buildkite/filebeat/scripts/integration-gotests.sh
index a3eabf70c0d..d64ce7c98eb 100755
--- a/.buildkite/filebeat/scripts/integration-gotests.sh
+++ b/.buildkite/filebeat/scripts/integration-gotests.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 
 source .buildkite/env-scripts/linux-env.sh
 
-echo ":: Execute Integration Tests ::"
+echo "--- Executing Integration Tests"
 sudo chmod -R go-w filebeat/
 
 cd filebeat
diff --git a/.buildkite/filebeat/scripts/integration-pytests.sh b/.buildkite/filebeat/scripts/integration-pytests.sh
index 5e2e403dda8..b51e8ae18a6 100755
--- a/.buildkite/filebeat/scripts/integration-pytests.sh
+++ b/.buildkite/filebeat/scripts/integration-pytests.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 
 source .buildkite/env-scripts/linux-env.sh
 
-echo ":: Execute Integration Tests ::"
+echo "--- Executing Integration Tests"
 sudo chmod -R go-w filebeat/
 
 cd filebeat
diff --git a/.buildkite/filebeat/scripts/package.sh b/.buildkite/filebeat/scripts/package.sh
index 2ae226eb739..0bb03250348 100755
--- a/.buildkite/filebeat/scripts/package.sh
+++ b/.buildkite/filebeat/scripts/package.sh
@@ -4,9 +4,7 @@ set -euo pipefail
 
 source .buildkite/env-scripts/linux-env.sh
 
-echo ":: Evaluate Filebeat Changes ::"
-
-echo ":: Start Packaging ::"
+echo "--- Start Packaging"
 cd filebeat
 umask 0022
 mage package
diff --git a/.buildkite/filebeat/scripts/unit-tests.sh b/.buildkite/filebeat/scripts/unit-tests.sh
index 0372923e54a..08ce9d4ea1c 100755
--- a/.buildkite/filebeat/scripts/unit-tests.sh
+++ b/.buildkite/filebeat/scripts/unit-tests.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 
 source .buildkite/env-scripts/linux-env.sh
 
-echo ":: Execute Unit Tests ::"
+echo "--- Executing Unit Tests"
 sudo chmod -R go-w filebeat/
 
 umask 0022
diff --git a/.buildkite/pull-requests.json b/.buildkite/pull-requests.json
index 4607a0576d0..abe0d20f680 100644
--- a/.buildkite/pull-requests.json
+++ b/.buildkite/pull-requests.json
@@ -57,8 +57,8 @@
             "set_commit_status": true,
             "build_on_commit": true,
             "build_on_comment": true,
-            "trigger_comment_regex": "^/test auditbeat$",
-            "always_trigger_comment_regex": "^/test auditbeat$",
+            "trigger_comment_regex": "^/test auditbeat(for (arm|macos|windows|extended support))?$",
+            "always_trigger_comment_regex": "^/test auditbeat(for (arm|macos|windows|extended support))?$",
             "skip_ci_labels": [  ],
             "skip_target_branches": [ ],
             "skip_ci_on_only_changed": [ ],
diff --git a/auditbeat/magefile.go b/auditbeat/magefile.go
index 0e6e2b487d5..1f17ed60fae 100644
--- a/auditbeat/magefile.go
+++ b/auditbeat/magefile.go
@@ -21,8 +21,6 @@ package main
 
 import (
 	"fmt"
-	"log"
-	"os"
 	"time"
 
 	"github.com/magefile/mage/mg"
@@ -97,8 +95,6 @@ func Package() {
 	start := time.Now()
 	defer func() { fmt.Println("package ran for", time.Since(start)) }()
 
-	log.SetOutput(os.Stdout)
-
 	devtools.UseElasticBeatOSSPackaging()
 	devtools.PackageKibanaDashboardsFromBuildDir()
 	auditbeat.CustomizePackaging(auditbeat.OSSPackaging)

From 72d0ba6bd80451f9c4a8b2ef3508164a2fc7c84e Mon Sep 17 00:00:00 2001
From: Olga Naidjonoka <olga_naidjonoka@epam.com>
Date: Mon, 5 Feb 2024 09:51:28 +0200
Subject: [PATCH 20/21] fixed conflicts

---
 .buildkite/auditbeat/scripts/package-step.sh | 12 ++++++------
 .buildkite/env-scripts/win-env.sh            | 16 ++++++----------
 .buildkite/filebeat/filebeat-pipeline.yml    |  2 --
 .buildkite/filebeat/scripts/package-step.sh  | 12 ++++++------
 .buildkite/hooks/post-checkout               | 20 +-------------------
 .buildkite/hooks/pre-command                 | 17 +----------------
 6 files changed, 20 insertions(+), 59 deletions(-)

diff --git a/.buildkite/auditbeat/scripts/package-step.sh b/.buildkite/auditbeat/scripts/package-step.sh
index 8b348bafa71..02124058992 100755
--- a/.buildkite/auditbeat/scripts/package-step.sh
+++ b/.buildkite/auditbeat/scripts/package-step.sh
@@ -5,12 +5,12 @@ set -euo pipefail
 source .buildkite/env-scripts/util.sh
 
 changeset="^auditbeat/
-    ^go.mod
-    ^pytest.ini
-    ^dev-tools/
-    ^libbeat/
-    ^testing/
-    ^\.buildkite/auditbeat/"
+^go.mod
+^pytest.ini
+^dev-tools/
+^libbeat/
+^testing/
+^\.buildkite/auditbeat/"
 
 if are_files_changed "$changeset"; then
   cat <<-EOF
diff --git a/.buildkite/env-scripts/win-env.sh b/.buildkite/env-scripts/win-env.sh
index dbedb29f516..ccf5479b46e 100644
--- a/.buildkite/env-scripts/win-env.sh
+++ b/.buildkite/env-scripts/win-env.sh
@@ -1,12 +1,8 @@
 #!/usr/bin/env bash
 
-install_python_win() {
-  echo "PLATFORM TYPE: ${PLATFORM_TYPE}"
-  if [[ ${PLATFORM_TYPE} = MINGW* ]]; then
-    echo "Installing Python on Win"
-    choco install mingw -y
-    choco install python --version=3.11.0 -y
-  fi
-}
-
-install_python_win
+echo "--- PLATFORM TYPE: ${PLATFORM_TYPE}"
+if [[ ${PLATFORM_TYPE} = MINGW* ]]; then
+  echo "--- Installing Python on Win"
+  choco install mingw -y
+  choco install python --version=3.11.0 -y
+fi
diff --git a/.buildkite/filebeat/filebeat-pipeline.yml b/.buildkite/filebeat/filebeat-pipeline.yml
index e3d7384a71e..eda9fb93a66 100644
--- a/.buildkite/filebeat/filebeat-pipeline.yml
+++ b/.buildkite/filebeat/filebeat-pipeline.yml
@@ -134,8 +134,6 @@ steps:
     if: build.env("BUILDKITE_PULL_REQUEST") != "false"
     depends_on:
       - "mandatory-tests"
-      - "extended-tests"
-      - "extended-tests-win"
 
     steps:
       - label: Package pipeline
diff --git a/.buildkite/filebeat/scripts/package-step.sh b/.buildkite/filebeat/scripts/package-step.sh
index a4127c3cd1d..985125433ce 100755
--- a/.buildkite/filebeat/scripts/package-step.sh
+++ b/.buildkite/filebeat/scripts/package-step.sh
@@ -5,12 +5,12 @@ set -euo pipefail
 source .buildkite/env-scripts/util.sh
 
 changeset="^filebeat/
-    ^go.mod
-    ^pytest.ini
-    ^dev-tools/
-    ^libbeat/
-    ^testing/
-    ^\.buildkite/filebeat/"
+^go.mod
+^pytest.ini
+^dev-tools/
+^libbeat/
+^testing/
+^\.buildkite/filebeat/"
 
 if are_files_changed "$changeset"; then
   cat <<-EOF
diff --git a/.buildkite/hooks/post-checkout b/.buildkite/hooks/post-checkout
index 2f376ec25b0..b6cc7ad60bd 100644
--- a/.buildkite/hooks/post-checkout
+++ b/.buildkite/hooks/post-checkout
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 set -euo pipefail
 
@@ -51,21 +51,3 @@ git --no-pager log --format=%B -n 1
 
 # Ensure buildkite groups are rendered
 echo ""
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-source .buildkite/filebeat/scripts/pre-common.sh
-
-if [[ "$BUILDKITE_PIPELINE_SLUG" == "filebeat" ]]; then
-  changeset="^filebeat/
-    ^go.mod
-    ^pytest.ini
-    ^dev-tools/
-    ^libbeat/
-    ^testing/
-    ^\.buildkite/filebeat/"
-
-  check_filebeat_changes "$changeset"
-  echo ":: FILEBEAT_CHANGESET=$FILEBEAT_CHANGESET ::"
-fi
diff --git a/.buildkite/hooks/pre-command b/.buildkite/hooks/pre-command
index acfa9a92d3b..c448a710251 100644
--- a/.buildkite/hooks/pre-command
+++ b/.buildkite/hooks/pre-command
@@ -2,24 +2,14 @@
 
 set -euo pipefail
 
-DOCKER_REGISTRY_SECRET_PATH="kv/ci-shared/platform-ingest/docker_registry_prod"
-
-if [[ "$BUILDKITE_PIPELINE_SLUG" == "filebeat" ]]; then
+if [[ "$BUILDKITE_PIPELINE_SLUG" == "filebeat" || "$BUILDKITE_PIPELINE_SLUG" == "auditbeat" ]]; then
   source .buildkite/env-scripts/env.sh
   source .buildkite/env-scripts/util.sh
   source .buildkite/env-scripts/win-env.sh
 
-  if [[ ${PLATFORM_TYPE} = MINGW* ]]; then
-    install_python_win
-  fi
-
   if [[ -z "${GOLANG_VERSION-""}" ]]; then
     export GOLANG_VERSION=$(cat "${WORKSPACE}/.go-version")
   fi
-
-  if [[ "$BUILDKITE_STEP_KEY" == macos* ]]; then
-    ulimit -Sn 30000
-  fi
 fi
 
 if [[ "$BUILDKITE_PIPELINE_SLUG" == "beats-metricbeat" ]]; then
@@ -29,8 +19,3 @@ if [[ "$BUILDKITE_PIPELINE_SLUG" == "beats-metricbeat" ]]; then
     exit 0
   fi
 fi
-
-if [[ "$BUILDKITE_PIPELINE_SLUG" == "auditbeat" && "$BUILDKITE_STEP_KEY" == package* ]]; then
-  export DOCKER_USERNAME_SECRET=$(retry 5 vault kv get -field user "${DOCKER_REGISTRY_SECRET_PATH}")
-  export DOCKER_PASSWORD_SECRET=$(retry 5 vault kv get -field password "${DOCKER_REGISTRY_SECRET_PATH}")
-fi

From d86f90a4a9e7acd56287a65988bf2003f8563413 Mon Sep 17 00:00:00 2001
From: Olga Naidjonoka <olga_naidjonoka@epam.com>
Date: Tue, 6 Feb 2024 12:32:05 +0200
Subject: [PATCH 21/21] updated win test script

---
 .buildkite/auditbeat/scripts/unit-tests-win.ps1 | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.buildkite/auditbeat/scripts/unit-tests-win.ps1 b/.buildkite/auditbeat/scripts/unit-tests-win.ps1
index b3bc4ef348e..200627d518f 100644
--- a/.buildkite/auditbeat/scripts/unit-tests-win.ps1
+++ b/.buildkite/auditbeat/scripts/unit-tests-win.ps1
@@ -4,14 +4,14 @@ $GoVersion = $env:GOLANG_VERSION # If Choco doesn't have the version specified i
 # Forcing to checkout again all the files with a correct autocrlf.
 # Doing this here because we cannot set git clone options before.
 function fixCRLF() {
-    Write-Host "-- Fixing CRLF in git checkout --"
+    Write-Host "--- Fixing CRLF in git checkout --"
     git config core.autocrlf false
     git rm --quiet --cached -r .
     git reset --quiet --hard
 }
 
 function withGolang() {
-    Write-Host "-- Install golang $GoVersion --"
+    Write-Host "--- Install golang $GoVersion --"
     choco install golang -y --version $GoVersion
 
     $choco = Convert-Path "$((Get-Command choco).Path)\..\.."