[9.3](backport #47956) [azure-eventhub] Support for AMQP-over-WebSocket transport in the processor v2 by mergify[bot] · Pull Request #50028 · elastic/beats

mergify · 2026-04-09T09:58:18Z

Proposed commit message

Support for AMQP-over-WebSocket transport in the azure-eventhub processor v2.

Enterprise users often need to comply with network restrictions, which means using AMQP may not be an option.

In addition to AMQP-over-WebSocket support, this change allows users to run the azure-eventhub input behind an HTTPS proxy.

Checklist

My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
I have made corresponding change to the default configuration files
I have added tests that prove my fix is effective or that my feature works. Where relevant, I have used the stresstest.sh script to run them under stress conditions and race detector to verify their stability.
I have added an entry in ./changelog/fragments using the changelog tool.

Disruptive User Impact

No disruptive user impact. The input still defaults to AMQP transport, and unless users switch to WS transport, the behavior is unchanged.

Author's Checklist

Test with an actual proxy
Update the documentation for AMQP-over-WebSocket
Update the documentation HTTPS proxy

How to test this PR locally

I used the following Filebeat config:

# x-pack/filebeat/filebeat.yml
filebeat.inputs:
- type: azure-eventhub
  enabled: true

  # Event Hub configuration
  eventhub: "${EVENTHUB_NAME}"
  connection_string: "${EVENTHUB_CONNECTION_STRING}"
  consumer_group: "${EVENTHUB_CONSUMER_GROUP}"

  # Azure Storage configuration for checkpointing
  storage_account: "${STORAGE_ACCOUNT}"
  storage_account_connection_string: "${STORAGE_ACCOUNT_CONNECTION_STRING}"

  # Optional settings
  processor_version: ${PROCESSOR_VERSION}
  migrate_checkpoint: ${MIGRATE_CHECKPOINT}
  transport: "${TRANSPORT}"

Here are a couple of vscode configuration to test the WebSocket-only and WebSocket with HTTPS proxy scenarios (make sure to replace the placeholders YOUR * GOES HERE with actual values).

WebSocket only

{
    "version": "0.2.0",
    "configurations": [
        {
            "name": "Launch Filebeat",
            "type": "go",
            "request": "launch",
            "mode": "auto",
            "program": "${workspaceFolder}/x-pack/filebeat/main.go",
            "args": [
                "-e",
                "-v",
                "-d",
                "*",
                "--strict.perms=false",
                "--path.home",
                "${workspaceFolder}/x-pack/filebeat",
                "-E",
                "cloud.id=<YOUR CLOUD ID GOES HERE>",
                "-E",
                "cloud.auth=<YOUR USERNAME GOES HERE>:<YOUR PASSWORD GOES HERE>",
                "-E",
                "gc_percent=100",
                "-E",
                "setup.ilm.enabled=false",
                "-E",
                "setup.template.enabled=false",
                "-E",
                "output.elasticsearch.allow_older_versions=true"
            ],
            "env": {
                "EVENTHUB_NAME": "logs",
                "EVENTHUB_CONNECTION_STRING": "<YOUR EVENT HUB CONNECTION STRING GOES HERE>",
                "EVENTHUB_CONSUMER_GROUP": "$Default",
                "STORAGE_ACCOUNT": "<YOUR STORAGE ACCOUNT NAME GOES HERE>",
                "STORAGE_ACCOUNT_KEY": "<YOUR STORAGE ACCOUNT KEY GOES HERE>",
                "STORAGE_ACCOUNT_CONNECTION_STRING": "<YOUR STORAGE ACCOUNT CONNECTION STRING GOES HERE>",
                "PROCESSOR_VERSION": "v2",
                "MIGRATE_CHECKPOINT": "true",
                "TRANSPORT": "websocket"
            }
        }
    ]
}

WebSocket with HTTPS proxy

{
    "version": "0.2.0",
    "configurations": [
        {
            "name": "Launch Filebeat",
            "type": "go",
            "request": "launch",
            "mode": "auto",
            "program": "${workspaceFolder}/x-pack/filebeat/main.go",
            "args": [
                "-e",
                "-v",
                "-d",
                "*",
                "--strict.perms=false",
                "--path.home",
                "${workspaceFolder}/x-pack/filebeat",
                "-E",
                "cloud.id=<YOUR CLOUD ID GOES HERE>",
                "-E",
                "cloud.auth=<YOUR USERNAME GOES HERE>:<YOUR PASSWORD GOES HERE>",
                "-E",
                "gc_percent=100",
                "-E",
                "setup.ilm.enabled=false",
                "-E",
                "setup.template.enabled=false",
                "-E",
                "output.elasticsearch.allow_older_versions=true"
            ],
            "env": {
                "EVENTHUB_NAME": "logs",
                "EVENTHUB_CONNECTION_STRING": "<YOUR EVENT HUB CONNECTION STRING GOES HERE>",
                "EVENTHUB_CONSUMER_GROUP": "$Default",
                "STORAGE_ACCOUNT": "<YOUR STORAGE ACCOUNT NAME GOES HERE>",
                "STORAGE_ACCOUNT_KEY": "<YOUR STORAGE ACCOUNT KEY GOES HERE>",
                "STORAGE_ACCOUNT_CONNECTION_STRING": "<YOUR STORAGE ACCOUNT CONNECTION STRING GOES HERE>",
                "PROCESSOR_VERSION": "v2",
                "MIGRATE_CHECKPOINT": "true",
                "TRANSPORT": "websocket",
                "HTTP_PROXY": "http://127.0.0.1:9090",
                "HTTPS_PROXY": "http://127.0.0.1:9090"
            }
        }
    ]
}

To test the proxy support, I used mitmproxy, an interactive HTTPS proxy with request inspection:

# Install
brew install mitmproxy  # macOS
# or
pip install mitmproxy

# Run the proxy
mitmproxy -p 9090

Since the Azure services require using an HTTPS proxy, you also need to set up a certificate for mitmproxy. See https://docs.mitmproxy.org/stable/concepts/certificates/ fore more details.

The mitmproxy main view:

Upgrade to AMQP-over-WebSocket:

WebSocket details:

Event hub messages received using AMQP-over-websocket through the proxy:

Related issues

Use cases

This is an automatic backport of pull request #47956 done by [Mergify](https://mergify.com).

…cessor v2 (#47956) Support for AMQP-over-WebSocket transport in the azure-eventhub processor v2. Enterprise users often need to comply with network restrictions, which means using AMQP may not be an option. In addition to AMQP-over-WebSocket support, this change allows users to run the azure-eventhub input behind an HTTPS proxy. (cherry picked from commit af5d23e) # Conflicts: # go.mod # go.sum # x-pack/filebeat/input/azureeventhub/auth.go

mergify · 2026-04-09T09:58:22Z

Cherry-pick of af5d23e has failed:

On branch mergify/bp/9.3/pr-47956
Your branch is up to date with 'origin/9.3'.

You are currently cherry-picking commit af5d23e75.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	new file:   changelog/fragments/1765280088-azure-eventhub-v2-add-support-for-amqp-over-websocket-and-https-proxy.yaml

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   go.mod
	both modified:   go.sum
	both modified:   x-pack/filebeat/input/azureeventhub/auth.go

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

github-actions · 2026-04-09T09:58:30Z

🤖 GitHub comments

Just comment with:

run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

elasticmachine · 2026-04-09T09:58:33Z

Pinging @elastic/obs-ds-hosted-services (Team:obs-ds-hosted-services)

github-actions · 2026-04-09T10:16:19Z

TL;DR

All 33 Buildkite failures are caused by unresolved merge-conflict markers introduced in this PR branch, not by independent beat-specific regressions. Resolve the conflicts in go.mod, go.sum, and x-pack/filebeat/input/azureeventhub/auth.go, then rerun CI.

Remediation

Resolve and remove conflict markers (<<<<<<<, =======, >>>>>>>) in:
- go.mod (around line 235)
- go.sum (around lines 99/102/105)
- x-pack/filebeat/input/azureeventhub/auth.go (around lines 72/74/77 and 117/118/149)
Run pre-commit run --all-files locally and ensure make -C (beat) check update succeeds (for at least one OSS beat and one x-pack beat) before re-triggering Buildkite.

Investigation details

Root Cause

This is a configuration/source-control integration issue: conflict markers remained after cherry-picking, which breaks both pre-commit and Go module parsing used by all beat pipelines.

Evidence

Build: https://buildkite.com/elastic/beats/builds/43880
Representative failing jobs:
- Filebeat: Run pre-commit
- Heartbeat: Run check/update
- x-pack/packetbeat: Run pre-commit
Key log excerpts:
- /tmp/gh-aw/buildkite-logs/filebeat-filebeat-run-pre-commit.txt:121
  - go.sum:99: Merge conflict string '<<<<<<<' found
- /tmp/gh-aw/buildkite-logs/filebeat-filebeat-run-pre-commit.txt:127
  - x-pack/filebeat/input/azureeventhub/auth.go:72: Merge conflict string '<<<<<<<' found
- /tmp/gh-aw/buildkite-logs/filebeat-filebeat-run-pre-commit.txt:139
  - go.mod:235: Merge conflict string '<<<<<<<' found
- /tmp/gh-aw/buildkite-logs/heartbeat-heartbeat-run-checkupdate.txt:107
  - ../go.mod:235: malformed module path "<<<<<<<": invalid char '<'

Verification

Not run in this workflow; diagnosis is based on deterministic parser/hook errors repeated across all failed jobs.

Follow-up

After conflict resolution, if any job still fails, those failures should then be analyzed as second-order issues (currently masked by the merge-conflict parse failure).

Note

🔒 Integrity filtering filtered 1 item

Integrity filtering activated and filtered the following item during workflow execution.
This happens when a tool call accesses a resource that does not meet the required integrity or secrecy level of the workflow.

pr:[9.3](backport #47956) [azure-eventhub] Support for AMQP-over-WebSocket transport in the processor v2 #50028 (pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".)

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

mergify bot requested a review from a team as a code owner April 9, 2026 09:58

mergify bot added the backport label Apr 9, 2026

mergify bot requested a review from a team as a code owner April 9, 2026 09:58

mergify bot added conflicts There is a conflict in the backported pull request backport labels Apr 9, 2026

mergify bot assigned zmoog Apr 9, 2026

botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Apr 9, 2026

github-actions bot added Team:obs-ds-hosted-services Label for the Observability Hosted Services team input:azure-eventhub labels Apr 9, 2026

mergify bot mentioned this pull request Apr 9, 2026

[azure-eventhub] Support for AMQP-over-WebSocket transport in the processor v2 #47956

Merged

9 tasks

botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Apr 9, 2026

zmoog closed this Apr 9, 2026

mergify bot deleted the mergify/bp/9.3/pr-47956 branch April 9, 2026 12:18

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[9.3](backport #47956) [azure-eventhub] Support for AMQP-over-WebSocket transport in the processor v2#50028

[9.3](backport #47956) [azure-eventhub] Support for AMQP-over-WebSocket transport in the processor v2#50028
mergify[bot] wants to merge 1 commit into9.3from
mergify/bp/9.3/pr-47956

mergify bot commented Apr 9, 2026

Uh oh!

mergify bot commented Apr 9, 2026

Uh oh!

github-actions bot commented Apr 9, 2026

Uh oh!

elasticmachine commented Apr 9, 2026

Uh oh!

github-actions bot commented Apr 9, 2026

Root Cause

Evidence

Verification

Follow-up

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

mergify bot commented Apr 9, 2026

Proposed commit message

Checklist

Disruptive User Impact

Author's Checklist

How to test this PR locally

Related issues

Use cases

Uh oh!

mergify bot commented Apr 9, 2026

Uh oh!

github-actions bot commented Apr 9, 2026

🤖 GitHub comments

Uh oh!

elasticmachine commented Apr 9, 2026

Uh oh!

github-actions bot commented Apr 9, 2026

TL;DR

Remediation

Root Cause

Evidence

Verification

Follow-up

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants