beats icon indicating copy to clipboard operation
beats copied to clipboard

[filebeat] Add file owner and group to the events' meta fields for Windows

Open AndersonQ opened this issue 2 weeks ago • 1 comments

#47331 added file owner and group to the events' meta fields, but it does not support windows. This issue is to implement it for windows.

The current linux implementation has 2 syscalls in the hot path, what we also intend to optimise. Therefore an windows solution should already consider this, avoid expensive calls in the hot path. Most likely it's enough to get the file owner and group once per file and keep it cached.

AndersonQ avatar Dec 09 '25 14:12 AndersonQ

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

elasticmachine avatar Dec 09 '25 14:12 elasticmachine