[8.19](backport #47730) x-pack/filebeat/input/cel: log unpublished event count and exit publish loop on context cancellation (#47907)

* x-pack/filebeat/input/cel: log unpublished event count and exit publish loop on context cancellation (#47730)

(cherry picked from commit ab3d2c3)

* remove changelog fragment
* add changelog entry

---------

Co-authored-by: Dan Kortschak <dan.kortschak@elastic.co>

Author: mergify[bot]

CHANGELOG.next.asciidoc

@@ -266,6 +266,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Refactor & cleanup with updates to default values and documentation. {pull}41834[41834]
 - Enhanced HTTPJSON input error logging with structured error metadata conforming to Elastic Common Schema (ECS) conventions. {pull}45653[45653]19
 - Add support for DPoP authentication for the CEL and HTTP JSON inputs. {pull}47441[47441]
+- Log unpublished event count and exit publish loop on input context cancellation. {issue}47717[47717] {pull}47730[47730]
 
 *Auditbeat*
 

x-pack/filebeat/input/cel/input.go

@@ -512,6 +512,7 @@ func (i input) run(env v2.Context, src *source, cursor map[string]interface{}, p
 
 			start = time.Now()
 			var hadPublicationError bool
+		loop:
 			for i, e := range events {
 				event, ok := e.(map[string]interface{})
 				if !ok {
@@ -539,6 +540,25 @@ func (i input) run(env v2.Context, src *source, cursor map[string]interface{}, p
 						pubCursor = cursor
 					}
 				}
+				// This is checked prior to the publish attempt since the
+				// cursor.Publisher interface does not document the behaviour
+				// related to context cancellation and the context is not
+				// explicitly passed in, so favour this explicit clarity.
+				switch err := ctx.Err(); {
+				case err == nil:
+				case errors.Is(err, context.Canceled), errors.Is(err, context.DeadlineExceeded):
+					log.Infow("context cancelled with unpublished events", "unpublished", len(events)-i)
+					// Don't update status, since we are about to pass
+					// through the Running state and then fall through
+					// to the input exit with a change to Stopped.
+					break loop
+				default:
+					// This should never happen.
+					log.Warnw("failed with unpublished events", "error", err, "unpublished", len(events)-i)
+					health.UpdateStatus(status.Degraded, "error publishing events: "+err.Error())
+					isDegraded = true
+					break loop
+				}
 				err = pub.Publish(beat.Event{
 					Timestamp: time.Now(),
 					Fields:    event,