[Agent] when we enable Endpoint in Agent Policy, monitoring filebeat doesn't get sent the log path until Agent is re-started

[EricDavisX]

[Agent] when we turn on Endpoint in Agent Policy, Agent doesn't tell filebeat to monitor logs until Agent is re-started

looking with a debug build with Blake...
comes out of research during: https://github.com/elastic/security-team/issues/727

testing on Centos7 on a clean host with 8.0 Kibana cloud / stack and PR sourced Agent from
https://console.cloud.google.com/storage/browser/beats-ci-artifacts/pull-requests/pr-23574

[elasticmachine]

Pinging @elastic/agent (Team:Agent)

[EricDavisX]

@ph we think this is pretty bad for 7.11 - and we'd like to pull in @michalpristas in the AM to review...

[ph]

Agree

[michalpristas]

looking, probably have a root cause and a fix. need to test

[EricDavisX]

I helped test Michals branch - it looks great. We'll look for the backports and we can track when it goes in for 7.11, plenty of time to make next week's BC5

[EricDavisX]

Let us get this reviewed and merged asap - @blakerouse @ph
#23635 - 7.11 backport

[EricDavisX]

7.11 PR is merged - @dikshachauhan-qasource this should be available to test out fully in BC5 7.11 that is coming in a day or two. Thanks all!

[EricDavisX]

this is tested as ok in BC5 7.11 build, but I have logged an issue that was being masked:
#23720

• this is closed out and fixed tho.