[filebeat] kafka input panics if expand_event_list_from_field points to field that isn't an array

[leehinman]

If the kafka input has:

filebeat.inputs:
- type: kafka
  expand_event_list_from_field: records

And the records field is not an array (say a string). The code at

beats/filebeat/input/kafka/input.go

Line 422 in 58db08f

return []string{}

returns an empty slice. But later on this code tries to compose messages from this slice and it attempts to index into the 0 length slice here. That leads to a panic.

[jlind23]

@leehinman according to Beats CODEOWNERS file, this input belongs to @elastic/obs-infraobs-integrations, forwarding this to them.

[faec]

Updating team assignment -- the Kafka module is owned by Integrations, but according to CODEOWNERS (and unless I missed the change) the input itself is still owned by Agent's data plane.

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!