refactor: replace stringset with stdlib funcs (#46752)

* refactor: replace stringset with stdlib funcs

stringset is only used as a temporary data structure to
remove duplicates. This can be handled by the stdlib new slices
package.

Replace stringset+toslice with slices.sort+slices.compact

* refactor: replace more stringset usage with stdlib

* Update fingerprint.go

Author: kruskall

auditbeat/module/auditd/audit_linux.go

@@ -20,16 +20,17 @@ package auditd
 import (
 	"errors"
 	"fmt"
+	"maps"
 	"os"
 	"runtime"
+	"slices"
 	"strconv"
 	"strings"
 	"sync"
 	"syscall"
 	"time"
 
 	"github.com/elastic/beats/v7/auditbeat/ab"
-	"github.com/elastic/beats/v7/libbeat/common"
 	"github.com/elastic/beats/v7/metricbeat/mb"
 	"github.com/elastic/beats/v7/metricbeat/mb/parse"
 	"github.com/elastic/elastic-agent-libs/logp"
@@ -629,13 +630,13 @@ func buildMetricbeatEvent(msgs []*auparse.AuditMessage, config Config) mb.Event
 	normalizeEventFields(auditEvent, out.RootFields)
 
 	// User set for related.user
-	var userSet common.StringSet
+	var userSet map[string]struct{}
 	if config.ResolveIDs {
-		userSet = make(common.StringSet)
+		userSet = make(map[string]struct{})
 	}
 
 	// Copy user.*/group.* fields from event
-	setECSEntity := func(key string, ent aucoalesce.ECSEntityData, root mapstr.M, set common.StringSet) {
+	setECSEntity := func(key string, ent aucoalesce.ECSEntityData, root mapstr.M, set map[string]struct{}) {
 		if ent.ID == "" && ent.Name == "" {
 			return
 		}
@@ -652,7 +653,7 @@ func buildMetricbeatEvent(msgs []*auparse.AuditMessage, config Config) mb.Event
 		if ent.Name != "" {
 			_, _ = root.Put(nameField, ent.Name)
 			if set != nil {
-				set.Add(ent.Name)
+				set[ent.Name] = struct{}{}
 			}
 		} else {
 			_ = root.Delete(nameField)
@@ -665,10 +666,9 @@ func buildMetricbeatEvent(msgs []*auparse.AuditMessage, config Config) mb.Event
 	setECSEntity("user.changes", auditEvent.ECS.User.Changes, out.RootFields, userSet)
 	setECSEntity("group", auditEvent.ECS.Group, out.RootFields, nil)
 
-	if userSet != nil {
-		if userSet.Count() != 0 {
-			_, _ = out.RootFields.Put("related.user", userSet.ToSlice())
-		}
+	if len(userSet) != 0 {
+		relatedUser := slices.Compact(slices.Sorted(maps.Keys(userSet)))
+		_, _ = out.RootFields.Put("related.user", relatedUser)
 	}
 	getStringField := func(key string, m mapstr.M) (str string) {
 		if asIf, _ := m.GetValue(key); asIf != nil {

auditbeat/module/file_integrity/action.go

@@ -19,9 +19,8 @@ package file_integrity
 
 import (
 	"math/bits"
+	"slices"
 	"strings"
-
-	"github.com/elastic/beats/v7/libbeat/common"
 )
 
 // Action is a description of the changes described by an event.
@@ -128,7 +127,9 @@ func (action Action) ECSTypes() []string {
 			list = append(list, name)
 		}
 	}
-	return common.MakeStringSet(list...).ToSlice()
+	slices.Sort(list)
+	list = slices.Compact(list)
+	return list
 }
 
 // MarshalText marshals the Action to a textual representation of itself.
@@ -211,5 +212,7 @@ func (actions ActionArray) ECSTypes() []string {
 	for _, action := range actions {
 		list = append(list, action.ECSTypes()...)
 	}
-	return common.MakeStringSet(list...).ToSlice()
+	slices.Sort(list)
+	list = slices.Compact(list)
+	return list
 }

libbeat/common/stringset.go

@@ -21,10 +21,10 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
+	"slices"
 	"time"
 
 	"github.com/elastic/beats/v7/libbeat/beat"
-	"github.com/elastic/beats/v7/libbeat/common"
 	"github.com/elastic/beats/v7/libbeat/processors"
 	jsprocessor "github.com/elastic/beats/v7/libbeat/processors/script/javascript/module/processor/registry"
 	"github.com/elastic/elastic-agent-libs/config"
@@ -56,8 +56,8 @@ func New(cfg *config.C, log *logp.Logger) (beat.Processor, error) {
 
 	// The fields array must be sorted, to guarantee that we always
 	// get the same hash for a similar set of configured keys.
-	// The call `ToSlice` always returns a sorted slice.
-	fields := common.MakeStringSet(config.Fields...).ToSlice()
+	slices.Sort(config.Fields)
+	fields := slices.Compact(config.Fields)
 
 	p := &fingerprint{
 		config: config,

libbeat/common/stringset_test.go

@@ -21,7 +21,6 @@ import (
 	"encoding/json"
 	"fmt"
 
-	"github.com/elastic/beats/v7/libbeat/common"
 	s "github.com/elastic/beats/v7/libbeat/common/schema"
 	c "github.com/elastic/beats/v7/libbeat/common/schema/mapstriface"
 	"github.com/elastic/beats/v7/metricbeat/helper/elastic"
@@ -151,17 +150,17 @@ func makeClusterToPipelinesMap(pipelines []logstash.PipelineState, overrideClust
 	}
 
 	for _, pipeline := range pipelines {
-		clusterUUIDs := common.StringSet{}
+		clusterUUIDs := make(map[string]struct{})
 		for _, vertex := range pipeline.Graph.Graph.Vertices {
 			clusterUUID := logstash.GetVertexClusterUUID(vertex, overrideClusterUUID)
 			if clusterUUID != "" {
-				clusterUUIDs.Add(clusterUUID)
+				clusterUUIDs[clusterUUID] = struct{}{}
 			}
 		}
 
 		// If no cluster UUID was found in this pipeline, assign it a blank one
 		if len(clusterUUIDs) == 0 {
-			clusterUUIDs.Add("")
+			clusterUUIDs[""] = struct{}{}
 		}
 
 		for clusterUUID := range clusterUUIDs {

libbeat/processors/fingerprint/fingerprint.go

@@ -244,17 +244,17 @@ func makeClusterToPipelinesMap(pipelines []PipelineStats, overrideClusterUUID st
 	}
 
 	for _, pipeline := range pipelines {
-		clusterUUIDs := common.StringSet{}
+		clusterUUIDs := make(map[string]struct{})
 		for _, vertex := range pipeline.Vertices {
 			clusterUUID := logstash.GetVertexClusterUUID(vertex, overrideClusterUUID)
 			if clusterUUID != "" {
-				clusterUUIDs.Add(clusterUUID)
+				clusterUUIDs[clusterUUID] = struct{}{}
 			}
 		}
 
 		// If no cluster UUID was found in this pipeline, assign it a blank one
 		if len(clusterUUIDs) == 0 {
-			clusterUUIDs.Add("")
+			clusterUUIDs[""] = struct{}{}
 		}
 
 		for clusterUUID := range clusterUUIDs {

metricbeat/module/logstash/node/data.go

@@ -25,7 +25,6 @@ import (
 
 	"github.com/elastic/beats/v7/auditbeat/ab"
 	"github.com/elastic/beats/v7/auditbeat/tracing"
-	"github.com/elastic/beats/v7/libbeat/common"
 	"github.com/elastic/beats/v7/libbeat/common/cfgwarn"
 	"github.com/elastic/beats/v7/metricbeat/mb"
 	"github.com/elastic/beats/v7/x-pack/auditbeat/module/system"
@@ -499,9 +498,10 @@ func (m *MetricSet) clockSyncLoop(interval time.Duration, done <-chan struct{})
 	}
 }
 
-func (m *MetricSet) isKernelFunctionAvailable(name string, tracingFns common.StringSet) bool {
-	if tracingFns.Count() != 0 {
-		return tracingFns.Has(name)
+func (m *MetricSet) isKernelFunctionAvailable(name string, tracingFns map[string]struct{}) bool {
+	if len(tracingFns) != 0 {
+		_, ok := tracingFns[name]
+		return ok
 	}
 	defer m.installer.UninstallInstalled()
 	checkProbe := helper.ProbeDef{

metricbeat/module/logstash/node_stats/data.go

@@ -11,7 +11,6 @@ import (
 	"unsafe"
 
 	"github.com/elastic/beats/v7/auditbeat/tracing"
-	"github.com/elastic/beats/v7/libbeat/common"
 	"github.com/elastic/elastic-agent-libs/mapstr"
 )
 
@@ -52,21 +51,19 @@ func syscallAlternatives(syscall string) []string {
 	}
 }
 
-func LoadTracingFunctions(tfs *tracing.TraceFS) (common.StringSet, error) {
+func LoadTracingFunctions(tfs *tracing.TraceFS) (map[string]struct{}, error) {
 	fnList, err := tfs.AvailableFilterFunctions()
 	if err != nil {
 		return nil, err
 	}
-	// This uses make() instead of common.MakeStringSet() because the later
-	// doesn't allow to create empty sets.
-	functions := common.StringSet(make(map[string]struct{}, len(fnList)))
+	functions := make(map[string]struct{}, len(fnList))
 	for _, fn := range fnList {
 		// Strip the module name (if any)
 		end := strings.IndexByte(fn, ' ')
 		if end == -1 {
 			end = len(fn)
 		}
-		functions.Add(fn[:end])
+		functions[fn[:end]] = struct{}{}
 	}
 	return functions, nil
 }