Update user agent (#45251)

distinguish between all beat modes:

* Standalone indicates that the beat is not running under agent.
* Unmanaged indicates that the beat is running under agent but not managed by Fleet.
* Managed indicates that the beat is running under agent and managed by Fleet.

privilege mode information is only exposed under agent

(cherry picked from commit 2a99bfa)

# Conflicts:
#	NOTICE.txt
#	go.mod
#	go.sum

Author: graphaelli

CHANGELOG.next.asciidoc

@@ -12,6 +12,15 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 
 - Fix FQDN being lowercased when used as `host.hostname` {issue}39993[39993]
 - Beats won't log start up information when running under the Elastic Agent {40390}40390[40390]
+- Drop support for Debian 10 and upgrade statically linked glibc from 2.28 to 2.31 {pull}41402[41402]
+- Fix metrics not being ingested, due to "Limit of total fields [10000] has been exceeded while adding new fields [...]". The total fields limit has been increased to 12500. No significant performance impact on Elasticsearch is anticipated. {pull}41640[41640]
+- Set default kafka version to 2.1.0 in kafka output and filebeat. {pull}41662[41662]
+- Replace default Ubuntu-based images with UBI-minimal-based ones {pull}42150[42150]
+- Fix templates and docs to use correct `--` version of command line arguments. {issue}42038[42038] {pull}42060[42060]
+- removed support for a single `-` to precede multi-letter command line arguments.  Use `--` instead. {issue}42117[42117] {pull}42209[42209]
+- The Beats logger and file output rotate files when necessary. The beat now forces a file rotation when unexpectedly writing to a file through a symbolic link.
+- Allow faccessat(2) in seccomp. {pull}43322[43322]
+- Update user agent used by beats http clients {pull}45251[45251]
 
 *Auditbeat*
 

NOTICE.txt

@@ -12317,11 +12317,19 @@ SOFTWARE
 
 --------------------------------------------------------------------------------
 Dependency : github.com/elastic/elastic-agent-libs
+<<<<<<< HEAD
 Version: v0.20.0
 Licence type (autodetected): Apache-2.0
 --------------------------------------------------------------------------------
 
 Contents of probable licence file $GOMODCACHE/github.com/elastic/elastic-agent-libs@v0.20.0/LICENSE:
+=======
+Version: v0.21.2
+Licence type (autodetected): Apache-2.0
+--------------------------------------------------------------------------------
+
+Contents of probable licence file $GOMODCACHE/github.com/elastic/elastic-agent-libs@v0.21.2/LICENSE:
+>>>>>>> 2a99bfaa5 (Update user agent (#45251))
 
                                  Apache License
                            Version 2.0, January 2004

go.mod

@@ -174,9 +174,15 @@ require (
 	github.com/aws/smithy-go v1.22.1
 	github.com/dgraph-io/badger/v4 v4.6.0
 	github.com/elastic/bayeux v1.0.5
+<<<<<<< HEAD
 	github.com/elastic/ebpfevents v0.6.0
 	github.com/elastic/elastic-agent-autodiscover v0.9.0
 	github.com/elastic/elastic-agent-libs v0.20.0
+=======
+	github.com/elastic/ebpfevents v0.7.0
+	github.com/elastic/elastic-agent-autodiscover v0.9.2
+	github.com/elastic/elastic-agent-libs v0.21.2
+>>>>>>> 2a99bfaa5 (Update user agent (#45251))
 	github.com/elastic/elastic-agent-system-metrics v0.11.11
 	github.com/elastic/go-elasticsearch/v8 v8.17.1
 	github.com/elastic/go-quark v0.3.0

go.sum

@@ -348,8 +348,13 @@ github.com/elastic/elastic-agent-autodiscover v0.9.0 h1:+iWIKh0u3e8I+CJa3FfWe9h0
 github.com/elastic/elastic-agent-autodiscover v0.9.0/go.mod h1:5iUxLHhVdaGSWYTveSwfJEY4RqPXTG13LPiFoxcpFd4=
 github.com/elastic/elastic-agent-client/v7 v7.15.0 h1:nDB7v8TBoNuD6IIzC3z7Q0y+7bMgXoT2DsHfolO2CHE=
 github.com/elastic/elastic-agent-client/v7 v7.15.0/go.mod h1:6h+f9QdIr3GO2ODC0Y8+aEXRwzbA5W4eV4dd/67z7nI=
+<<<<<<< HEAD
 github.com/elastic/elastic-agent-libs v0.20.0 h1:MPjenwuEr+QfMeQRV4BK817ZbiNS38SXJE7QGHDwhUs=
 github.com/elastic/elastic-agent-libs v0.20.0/go.mod h1:1HNxREH8C27kGrJCtKZh/ot8pV8joH8VREP21+FrH5s=
+=======
+github.com/elastic/elastic-agent-libs v0.21.2 h1:r4Tokxx8OvFUVw28foiZT/WHwGUM7JFdlb4TVJ25v9M=
+github.com/elastic/elastic-agent-libs v0.21.2/go.mod h1:xSeIP3NtOIT4N2pPS4EyURmS1Q8mK0lWZ8Wd1Du6q3w=
+>>>>>>> 2a99bfaa5 (Update user agent (#45251))
 github.com/elastic/elastic-agent-system-metrics v0.11.11 h1:Qjh3Zef23PfGlG91AF+9ciNLNQf/8cDJ4CalnLZtV3g=
 github.com/elastic/elastic-agent-system-metrics v0.11.11/go.mod h1:GNqmKfvOt8PwORjbS6GllNdMfkLpOWyTa7P8oQq4E5o=
 github.com/elastic/elastic-transport-go/v8 v8.6.1 h1:h2jQRqH6eLGiBSN4eZbQnJLtL4bC5b4lfVFRjw2R4e4=

libbeat/beat/beat.go

@@ -88,31 +88,47 @@ type Beat struct {
 	Registry *reload.Registry // input, & output registry for configuration manager, should be instantiated in NewBeat
 }
 
+func (beat *Beat) userAgentMode() useragent.AgentManagementMode {
+	if beat.Manager == nil {
+		return useragent.AgentManagementModeUnknown
+	}
+	if !beat.Manager.Enabled() {
+		return useragent.AgentManagementModeStandalone
+	}
+
+	info := beat.Manager.AgentInfo()
+	switch info.ManagedMode {
+	case proto.AgentManagedMode_MANAGED:
+		return useragent.AgentManagementModeManaged
+	case proto.AgentManagedMode_STANDALONE:
+		return useragent.AgentManagementModeUnmanaged
+	}
+	// this is probably not reachable
+	return useragent.AgentManagementModeUnknown
+}
+
+func (beat *Beat) userAgentUnprivilegedMode() useragent.AgentUnprivilegedMode {
+	if beat.Manager == nil || !beat.Manager.Enabled() {
+		return useragent.AgentUnprivilegedModeUnknown
+	}
+	if beat.Manager.AgentInfo().Unprivileged {
+		return useragent.AgentUnprivilegedModeUnprivileged
+	}
+	return useragent.AgentUnprivilegedModePrivileged
+}
+
 // GenerateUserAgent populates the UserAgent field on the beat.Info struct
 func (beat *Beat) GenerateUserAgent() {
-	// if we're in fleet mode, construct some additional elements for the UA comment field
-	comments := []string{}
-	if beat.Manager != nil && beat.Manager.Enabled() {
-		info := beat.Manager.AgentInfo()
-		if info.ManagedMode == proto.AgentManagedMode_MANAGED {
-			comments = append(comments, "Managed")
-		} else if info.ManagedMode == proto.AgentManagedMode_STANDALONE {
-			comments = append(comments, "Standalone")
-		}
-
-		if info.Unprivileged {
-			comments = append(comments, "Unprivileged")
-		}
+	userAgentProduct := "Libbeat"
+	if beat.Info.Beat != "" {
+		userAgentProduct = beat.Info.Beat
 	}
 
-	UserAgentProduct := beat.Info.Beat
-	if UserAgentProduct == "" {
-		UserAgentProduct = "Libbeat"
-	}
+	mode := beat.userAgentMode()
+	unprivileged := beat.userAgentUnprivilegedMode()
 
-	finalUserAgent := useragent.UserAgent(UserAgentProduct, version.GetDefaultVersion(),
-		version.Commit(), version.BuildTime().String(), comments...)
-	beat.Info.UserAgent = finalUserAgent
+	beat.Info.UserAgent = useragent.UserAgentWithBeatTelemetry(userAgentProduct, version.GetDefaultVersion(),
+		mode, unprivileged)
 }
 
 // BeatConfig struct contains the basic configuration of every beat

libbeat/beat/beat_test.go

@@ -73,24 +73,30 @@ func TestUserAgentString(t *testing.T) {
 			name: "unmanaged-privileged",
 			beat: &Beat{Info: Info{Beat: "testbeat"},
 				Manager: testManager{isEnabled: true, isUnpriv: false, mgmtMode: proto.AgentManagedMode_STANDALONE}},
-			expectedComments: []string{"Standalone"},
+			expectedComments: []string{"Unmanaged"},
 		},
 		{
 			name: "unmanaged-unprivileged",
 			beat: &Beat{Info: Info{Beat: "testbeat"},
 				Manager: testManager{isEnabled: true, isUnpriv: true, mgmtMode: proto.AgentManagedMode_STANDALONE}},
-			expectedComments: []string{"Standalone", "Unprivileged"},
+			expectedComments: []string{"Unmanaged", "Unprivileged"},
 		},
 		{
 			name: "management-disabled",
 			beat: &Beat{Info: Info{Beat: "testbeat"},
 				Manager: testManager{isEnabled: false}},
+			expectedComments: []string{"Standalone"},
+		},
+		{
+			name: "no-management",
+			beat: &Beat{Info: Info{Beat: "testbeat"},
+				Manager: nil},
 			expectedComments: []string{},
 		},
 	}
 
 	// User-Agent will take the form of
-	// Elastic-testbeat/8.15.0 (linux; amd64; unknown; 0001-01-01 00:00:00 +0000 UTC; Standalone; Unprivileged)
+	// Elastic-testbeat/9.2.0 (linux; arm64; Managed; Unprivileged)
 	// the RFC (https://www.rfc-editor.org/rfc/rfc9110#name-user-agent) says the comment field can basically be anything,
 	// but we put metadata in it, delimited by '; '
 	uaReg := regexp.MustCompile(`Elastic-testbeat/([\d.]+) \(([\w-:+; ]+)\)`)