beats
beats copied to clipboard
[filebeat] Add file owner and group to the events' meta fields for Windows
#47331 added file owner and group to the events' meta fields, but it does not support windows. This issue is to implement it for windows.
The current linux implementation has 2 syscalls in the hot path, what we also intend to optimise. Therefore an windows solution should already consider this, avoid expensive calls in the hot path. Most likely it's enough to get the file owner and group once per file and keep it cached.
Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)