Skip to content

Latest commit

 

History

History
192 lines (101 loc) · 6.03 KB

CHANGELOG.next.asciidoc

File metadata and controls

192 lines (101 loc) · 6.03 KB

Beats version HEAD

Breaking changes

Affecting all Beats

  • Fix namespacing on self-monitoring 32336

Auditbeat

Filebeat

Heartbeat - Browser monitors (beta) no write to the synthetics-* index prefix. 32064 - Setting a custom index for a given monitor is now deprecated. Streams are preferred. 32064

Metricbeat

Packetbeat

Winlogbeat

Functionbeat

Bugfixes

Affecting all Beats

  • Expand fields in decode_json_fields if target is set. 31712 32010

  • Fix OS name reported by add_host_metadata on Windows 11. 30833 32259

  • Fix race condition when reloading runners 32309

  • Fix race condition when stopping runners 32433

Auditbeat

  • auditd module: Fix parsing of audit rules where arguments are quoted (like file paths containing spaces). 32421

  • auditd module: Fix minimum AuditStatus length so that library can support kernels from 2.6.32. 32421

Filebeat

  • Fix Cisco AMP rate limit and pagination. 32030

  • Fix wrong state ID in states registry for awss3 s3 direct input. 32164

  • cisco/asa: fix handling of user names when there are Security Group Tags present. 32009 32196

  • Fix race conditions when reloading input V2 and filestream input 32309

  • Fix counter for number of events published in httpjson input. 31993

Heartbeat

  • Send targetted error message for unexpected synthetics exits. 31936

  • Reduced memory usage slightly for browser monitors. 32317

  • Automatically kill zombie-ish node processes. 32393

Metricbeat

  • update kubernetes apiserver metricset to not collect deprecated metrics and fix dashboard 31973

  • Check for nil metadata in GCP. 32281

  • update kubernetes controllermanager metricset to not collect deprecated metrics and fix dashboard 32037

  • update elasticsearch node_stats metricset to use keyword for cgroup memory instead of long 32197

  • Fix to ARN parsing for Cloudwatch resource names with leading slashes 32358

Packetbeat

Winlogbeat

  • Powershell: Fix processing of parameter details. 31833

  • Security: Fix processing of sidlist, access list and access mask. 31833

Functionbeat

Elastic Logging Plugin

Added

Affecting all Beats

  • Improve performance of disk queue by coalescing writes. 31935

Auditbeat

  • Add immutable option to the auditd module. 8352 32381

Filebeat

  • Add text/csv decoder to httpjson input 28564

  • Update aws-s3 input to connect to non AWS S3 buckets 28222 28234

  • Add support for '/var/log/pods/' path for add_kubernetes_metadata processor with resource_type: pod. 28868

  • Add documentation for add_kubernetes_metadata processors log_path matcher. 28868

  • Add support for parsers on journald input 29070

  • Add support in httpjson input for oAuth2ProviderDefault of password grant_type. 29087

  • threatintel module: Add new Recorded Future integration. 30030

  • Add auth.oauth2.google.jwt_json option to httpjson input. 31750

  • Add authentication fields to RabbitMQ module documents. 31159 31680

  • Add template helper function for decoding hexadecimal strings. 31886

  • Add new parser called include_message to filter based on message contents. 31794 32094

  • Extend list of mapped record types in o365 Audit module. 32217

  • Add references for CRI-O configuration in input-container and in our kubernetes manifests 32149 32151

  • httpjson input: Add replaceAll helper function to template context. 32365

  • Optimize grok patterns in system.auth module pipeline. 32360

  • Checkpoint module: add authentication operation outcome enrichment. 32230 32431

  • add documentation for decode_xml_wineventlog processor field mappings. 32456

Auditbeat

Filebeat

Heartbeat

Metricbeat

  • Enhance Oracle Module: Change tablespace metricset collection period 30948 #31259

  • Add orchestrator cluster ECS fields in kubernetes events 31341

  • Enhance Oracle Module: Refactor module to properly use host parsers instead of doing its own parsing of hosts 31611 #31692

  • Enhance Oracle Module: Connection string for Oracle does not handle special characters properly 24609 #31368

  • Enhance Oracle Module: New sysmetric metricset 30946 #31462

  • Upgrade Mongodb library in Beats to v5 31185

  • Azure Billing: upgrade Usage Details API to version 2019-10-01 31970

    • Differentiate between actual idle CPU states and an uninterruptible disk sleep. system-metrics#32

  • AWS Fargate: Added support for DesiredStatus and KnownStatus 32077 #32342

  • Enable Generic SQL merge metrics to a single event for sql_queries using new flag 32394

Packetbeat

  • Add support for specifying default route interface sniffing. 31905 31950

  • Add support for TCP transport to the SIP protocol. 28166 32346

Functionbeat

Winlogbeat

Elastic Log Driver

Deprecated

Affecting all Beats

Filebeat

Heartbeat

Metricbeat

Packetbeat

Winlogbeat

Functionbeat

Known Issue