[Winlogbeat] Output/Kafka Can’t use topics with uppercase letters anymore

[theodiefenthal]

Hi there,

I just wanted to upgrade my winlogbeat from 7.2.0 to 7.7.0 but had to realize that the kafka output is broken.

In newer versions, the config option topic from output.kafka goes through a constSelectorExpr and is lowercased before being passed to the kafka client. This means that I can't write to a topic of mine anymore as it contains an uppercase letter.

This limits the number of topics that can be written to unnecessarily. As I don't see a reference to that in the CHANELOG, I'd guess that this was introduced accidentally and can thus be qualified as a.

See also https://discuss.elastic.co/t/bug-output-kafka-cant-use-topics-with-uppercase-letters-anymore/233194 for a discussion thread about it.

[elasticmachine]

Pinging @elastic/integrations-services (Team:Services)

[theodiefenthal]

Just tested 7.6.2 and that's still working. So the break was introduced with 7.7.0

[xeraa]

Confirmed by another user: https://twitter.com/SwiftOnSecurity/status/1266107095369355270

[urso]

The error has been introduced in #16081, which ensures that index names are always lower cased. Unfortunately the Kafka topic configuration reuses the Selector code, and the error went unnoticed.