x-pack/filebeat/input/entityanalytics/provider/activedirectory: fix u…

…se before init bug (#42682)

The transaction tracker was not being initialised until after the first
call to publishMarker in runFullSync, resulting in a nil pointer
deference when the the tracker Add method is called.

CHANGELOG.next.asciidoc

@@ -223,6 +223,7 @@ otherwise no tag is added. {issue}42208[42208] {pull}42403[42403]
 - Remove erroneous status reporting to Elastic-Agent from the Filestream input {pull}42435[42435]
 - Fix truncation of bodies in request tracing by limiting bodies to 10% of the maximum file size. {pull}42327[42327]
 - [Journald] Fixes handling of `journalctl` restart. A known symptom was broken multiline messages when there was a restart of journalctl while aggregating the lines. {issue}41331[41331] {pull}42595[42595]
+- Fix entityanalytics activedirectory provider full sync use before initialization bug. {pull}42682[42682]
 
 *Heartbeat*
 

x-pack/filebeat/input/entityanalytics/provider/activedirectory/activedirectory.go

@@ -257,10 +257,9 @@ func (p *adInput) runFullSync(inputCtx v2.Context, store *kvstore.Store, client
 			}
 		}
 		if len(users) != 0 {
-			var tracker *kvstore.TxTracker
 			start := time.Now()
+			tracker := kvstore.NewTxTracker(ctx)
 			p.publishMarker(start, start, inputCtx.ID, true, client, tracker)
-			tracker = kvstore.NewTxTracker(ctx)
 			for _, u := range users {
 				p.publishUser(u, state, inputCtx.ID, client, tracker)
 			}