Manually backport filebeat agent spec file fix.

x-pack/elastic-agent/CHANGELOG.next.asciidoc

@@ -160,3 +160,4 @@
 - Install command will skip install/uninstall steps when installation via package is detected on Linux distros. {pull}30289[30289]
 - Add support for enabling the metrics buffer endpoint in the elastic-agent and beats it runs. diagnostics collect command will gather metrics-buffer data if enabled. {pull}30471[30471]
 - Elastic Agent now propagates ID for Filebeat input. {pull}30386[30386]
+- Fix incorrectly creating a filebeat redis input when a policy contains a packetbeat redis input. {issue}[427] {pull}[700]

x-pack/elastic-agent/pkg/agent/program/testdata/single_config-packetbeat.yml

@@ -23,6 +23,13 @@ inputs:
     data_stream:
       dataset: packet.icmp
       type: logs
+  - id: packet-network_traffic.redis-387bdc6a-0acb-4ef2-9552-c21e524a2d21
+    type: redis
+    data_stream:
+      dataset: network_traffic.redis
+      type: logs
+    ports:
+      - 6379
 output:
   elasticsearch:
     hosts:

x-pack/elastic-agent/pkg/agent/program/testdata/single_config.yml

@@ -104,6 +104,13 @@ inputs:
       data_stream:
         dataset: packet.icmp
         type: logs
+    - id: packet-network_traffic.redis-387bdc6a-0acb-4ef2-9552-c21e524a2d21
+      type: redis
+      data_stream:
+        dataset: network_traffic.redis
+        type: logs
+      ports:
+        - 6379
 - id: endpoint-id
   type: endpoint
   name: endpoint-1

x-pack/elastic-agent/spec/filebeat.yml

@@ -18,6 +18,44 @@ rules:
     on_conflict: insert_after
     type: logs
 
+# Input filtering needs to happen before any other input transformations.
+# See https://github.com/elastic/elastic-agent/issues/427.
+- filter_values:
+    selector: inputs
+    key: type
+    values:
+    - aws-cloudwatch
+    - aws-s3
+    - azure-eventhub
+    - cloudfoundry
+    - container
+    - docker
+    - event/file
+    - event/stdin
+    - event/tcp
+    - event/udp
+    - filestream
+    - gcp-pubsub
+    - http_endpoint
+    - httpjson
+    - journald
+    - kafka
+    - log
+    - log/docker
+    - log/redis_slowlog
+    - log/syslog
+    - logfile
+    - mqtt
+    - netflow
+    - o365audit
+    - redis
+    - stdin
+    - syslog
+    - tcp
+    - udp
+    - unix
+    - winlog
+
 - map:
     path: inputs
     rules:
@@ -62,34 +100,6 @@ rules:
     - remove_key:
         key: data_stream.dataset
 
-- filter_values:
-    selector: inputs
-    key: type
-    values:
-    - aws-cloudwatch
-    - aws-s3
-    - azure-eventhub
-    - cloudfoundry
-    - container
-    - docker
-    - gcp-pubsub
-    - http_endpoint
-    - httpjson
-    - journald
-    - kafka
-    - log
-    - mqtt
-    - netflow
-    - o365audit
-    - redis
-    - stdin
-    - syslog
-    - tcp
-    - udp
-    - unix
-    - winlog
-    - filestream
-
 - filter_values:
     selector: inputs
     key: enabled