[8.19](backport #51864) managerEarlyStop before runReady close

[mergify]

Proposed commit message

Fix defer ordering bug in Filebeat.Run that caused a 5-second hang on every early-exit error path.

WHAT: Move defer fb.runReady.Close() from the top of Run() to just after the managerEarlyStop defer.

Go defers execute in LIFO order. Previously defer fb.runReady.Close() was set up first (line 277), which meant it ran last — after managerEarlyStop(). managerEarlyStop() calls b.Manager.Stop(), which triggers the stop callback, which calls beater.Stop() → StopWithContext(context.Background()). That function blocks up to 5 seconds waiting for runReady.ch to be closed. But runReady.ch was only closed by the later defer, creating a deadlock that always timed out.

By deferring runReady.Close() after the managerEarlyStop defer, it now runs before it in LIFO order. When managerEarlyStop() calls Stop(), runReady.ch is already closed and Stop() returns immediately.

WHY: The system test test_stopping_empty_path configures a log input with paths: [], which causes crawler.Start() to fail and Run() to exit early. On this early-exit path managerEarlyStop is non-nil and gets called in its defer, triggering the 5-second hang before the error is logged. The test's 7-second window (2s sleep + 5s wait) was being exhausted before logp.Critical("Exiting: ...") was ever written to the log file.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
• I have added an entry in ./changelog/fragments using the changelog tool.

Disruptive User Impact

None. This only affects the internal shutdown sequencing on error paths inside Run().

How to test this PR locally

go test ./filebeat/beater/... -run TestStop -v

For the full system test (requires a built filebeat binary):

cd filebeat && pytest tests/system/test_shutdown.py::Test::test_stopping_empty_path -v

Related issues

• Relates synchronize filebeat run and shutdown functions #51800

Use cases

Screenshots

Logs

---

This is an automatic backport of pull request #51864 done by [Mergify](https://mergify.com).

[mergify]

Cherry-pick of 00068f7 has failed:

On branch mergify/bp/8.19/pr-51864
Your branch is up to date with 'origin/8.19'.

You are currently cherry-picking commit 00068f796.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   filebeat/beater/filebeat.go

no changes added to commit (use "git add" and/or "git commit -a")

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

[github-actions]

🤖 GitHub comments

Just comment with:

• run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)
• /test : Run the Buildkite pipeline.

[infra-vault-gh-plugin-prod]

Pinging @elastic/elastic-agent-data-plane (Team:Elastic-Agent-Data-Plane)

[github-actions]

TL;DR

The Buildkite agentbeat pre-commit job fails because the backport contains unresolved Git merge-conflict markers in filebeat/beater/filebeat.go. Resolve the conflict and push an updated commit before rerunning CI.

Remediation

• Resolve filebeat/beater/filebeat.go:275-277 by removing the <<<<<<< HEAD, =======, and >>>>>>> 00068f796 (managerEarlyStop before runReady close (#51864)) markers while preserving the intended surrounding code.
• Re-run pre-commit run --all-files (or the Buildkite pipeline) and confirm check-merge-conflict passes.

Investigation details

Root Cause

The PR merge result includes conflict-marker lines in Filebeat.Run. The conflict is visible in the PR diff immediately before b.Manager != nil: <<<<<<< HEAD, =======, and >>>>>>> 00068f796 (managerEarlyStop before runReady close (#51864)).

Evidence

• Build: https://buildkite.com/elastic/beats/builds/49239
• Job/step: agentbeat / Run pre-commit
• Key log excerpt: filebeat/beater/filebeat.go:251: Merge conflict string '<<<<<<<' found; the hook also reports lines 253 and 254 for ======= and >>>>>>>.

Verification

• Not run locally; the failure is deterministic from the pre-commit log and requires resolving the PR branch conflict first.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.