Filebeat Fails to Start After Upgrade to Version 8.15.1

[TomonoriSoejima]

Issue: Filebeat Fails to Start After Upgrade to Version 8.15.1

Problem Summary:
After upgrading Elastic infrastructure from version 8.14.3 to 8.15.1, Filebeat 8.15.1 on one of the servers failed to start with the following error:

Exiting: error initializing processors: failed to unpack the replace configuration: string value is not set accessing 'processors.6.replace.fields.0.replacement' (source:'/etc/filebeat/filebeat.yml')

Error Details:
The error occurs due to the replace processor configuration in the filebeat.yml file. Specifically, the replacement field is missing a value.

Filebeat Configuration Example:
The problematic section in filebeat.yml was identified as:

- replace:
    fields:
      - field: message
        pattern: '^[<]+[0-9]+[>]+'
        replacement: ''    # This line is causing the issue
    fail_on_error: false
    ignore_missing: true

Solution Provided by Support Engineer:
The missing replacement field must contain a valid value. The support engineer tested the following fixes, both of which resolved the issue:

1. Setting the replacement to a test value:

   replacement: "test"

2. Using an empty space as the replacement value:

   replacement: " "

Via git log v8.14.3..v8.15.1 libbeat/cmd/instance/beat.go, I found this change.
Can you please check if this is expected behavior or not?
Right now, you can not replace a string to empty value.

[libbeat] Stop publisher properly (#40572) (#40617)

* Stop publisher properly
* Just call beater.Stop from manager
* Delete duplicated lines
* Make call to stopBeat idempotent
* Add context at request creation to not break tracing
* Remove unused lint
* Add default WaitClose timeout
* Adjust wait on close time
* Add delay to account for the stop of the publisher
* Fix lint issues
(cherry picked from commit 480826919329d700a9c70a7f30ea4941b2022100)

[botelastic]

This issue doesn't have a Team:<team> label.

[zez3]

Got the same issue here

failed to unpack the replace configuration: string value is not set accessing 'processors.14.replace.fields.0.replacement'

[zez3]

@jamiehynds @nimarezainia @leehinman
When this happens in production we lose not only messages but more.
This no longer a beta processor !
Can someone please triage/prioritize this and assign a team so that it gets fixed in the upcoming release.
Thanks

[efd6]

See #40751.

[nimarezainia]

@efd6 ok if we close this now? (thank you)

[efd6]

That's good for me. Thanks.