License Concerns About Winlogbeat

Elastic Stack Beats
1

We have some concerns regarding the licensing of the elastic/beats project.

From what we understand, winlogbeat is licensed under Apache-2.0. However, one of its dependencies, github.com/elastic/elastic-agent-client/v7/pkg/client, is under the Elastic License, which seems to have stricter terms.

Would it cause any licensing issues if we modified winlogbeat and distributed it in binary form, whether for commercial or non-commercial purposes?

The output of running go mod why in the winlogbeat folder:

$ go mod why -m "github.com/elastic/elastic-agent-client/v7"
# github.com/elastic/elastic-agent-client/v7
github.com/elastic/beats/v7/libbeat/management
github.com/elastic/elastic-agent-client/v7/pkg/client
2

Hello @chhu0830

From a technical perspective:

the whole beats repo is a single go module, so the in the go.mod the dependencies are for all beats, including the x-pack, which is under another license.

From the go mod why and looking at the repo, the github.com/elastic/elastic-agent-client is used on the x-pack for the beats running under agent.

If you build the sso version of winlogbeat, it should not contain github.com/elastic/elastic-agent-client.

Disclaimer: I'm no lawyer, so I cannot give any legal advice or advice about the details of the licensing.

3

If I download the latest 8.16.1 winlogbeat.exe which is OSS and inspect the set of linked dependencies, I observe elastic-agent-client being included.

❯ go version -m ./winlogbeat.exe | rg elastic-agent
        dep     github.com/elastic/elastic-agent-autodiscover   v0.9.0  h1:+iWIKh0u3e8I+CJa3FfWe9h0JojNasPgYIA47gpuuns=
        dep     github.com/elastic/elastic-agent-client/v7      v7.15.0 h1:nDB7v8TBoNuD6IIzC3z7Q0y+7bMgXoT2DsHfolO2CHE=
        dep     github.com/elastic/elastic-agent-libs   v0.12.1 h1:5jkxMx15Bna8cq7/Sz/XUIVUXfNWiJ80iSk4ICQ7KJ0=
        dep     github.com/elastic/elastic-agent-system-metrics v0.11.4 h1:Z/8CML5RKvGpi6/QUFok1K3EriBAv2kUAXnsk8hCifk=

We will need to investigate why this is being linked into the binary. There is no intent to change the license of the OSS winlogbeat release. This is functionally a bug.

It should also be the case that the elastic-agent-client code is not executed unless the management.enabled flag is set to true in the configuration, which indicates to the Beat that it is managed by Elastic Agent. The functionality of Winlogbeat is provided in Elastic Agent via the Filebeat winlog input, winlogbeat is not even included as part of Elastic Agent, so it is odd that this code is included at all.

This must be getting pulled in through some transitive dependency chain inside Beats. We will investigate and see what is going on.

4

Go seems to link all dependencies within a package, even if some aren't required by the main module.

One of the import paths leading to elastic-agent-client is as follows

github.com/elastic/beats/v7/winlogbeat/cmd (root.go:L22)
github.com/elastic/beats/v7/libbeat/cmd/instance (beat.go:L66)
github.com/elastic/beats/v7/libbeat/outputs (util.go:L23)
github.com/elastic/beats/v7/libbeat/management (management.go:L25)
github.com/elastic/elastic-agent-client/v7/pkg/client

The files listed above in parentheses don’t necessarily mean that Winlogbeat is using the functions in them. They’re simply there as evidence that Go is linking these packages into the binary.