beats icon indicating copy to clipboard operation
beats copied to clipboard

[filebeat] optimise adding file owner and group to the events' meta fields

Open AndersonQ opened this issue 2 weeks ago • 1 comments

#47878 introduced adding file owner and group to the events' meta fields. However it adds 2 syscalls to the hot path and a micro-benchmark shows it might have a non-negligible impact on the overall performance.

This issue is to optimise it, remove the syscalls from the hot path. It might be enough to get the file owner and group once per file, cache it, and use the cached values when populating the event's meta fields

AndersonQ avatar Dec 09 '25 15:12 AndersonQ

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

elasticmachine avatar Dec 09 '25 15:12 elasticmachine