Skip to content

Latest commit

 

History

History
192 lines (100 loc) · 5.95 KB

CHANGELOG.next.asciidoc

File metadata and controls

192 lines (100 loc) · 5.95 KB
Raw

Beats version HEAD

Breaking changes

Affecting all Beats

Auditbeat

Filebeat

Heartbeat - Browser monitors (beta) no write to the synthetics-* index prefix. 32064 - Setting a custom index for a given monitor is now deprecated. Streams are preferred. 32064

Metricbeat

Packetbeat

Winlogbeat

Functionbeat

Bugfixes

Affecting all Beats

  • Fix namespacing for agent self-monitoring, CPU no longer reports as zero. 32336

  • Expand fields in decode_json_fields if target is set. 31712 32010

  • Fix race condition when stopping runners 32433

  • Fix concurrent map writes when system/process code called from reporter code 32491

Auditbeat

  • auditd module: Fix parsing of audit rules where arguments are quoted (like file paths containing spaces). 32421

  • auditd module: Fix minimum AuditStatus length so that library can support kernels from 2.6.32. 32421

  • system/socket: Reduce memory usage of the dataset. 32191 32192

Filebeat

  • Fix counter for number of events published in httpjson input. 31993

  • Fix handling of Checkpoint event for R81. 32380 32458

Heartbeat

  • Send targetted error message for unexpected synthetics exits. 31936

  • Reduced memory usage slightly for browser monitors. 32317

  • Automatically kill zombie-ish node processes. 32393

  • Added timeout for browser monitors. 32434

Metricbeat

  • update kubernetes apiserver metricset to not collect deprecated metrics and fix dashboard 31973

  • Check for nil metadata in GCP. 32281

  • update kubernetes controllermanager metricset to not collect deprecated metrics and fix dashboard 32037

  • Fix to ARN parsing for Cloudwatch resource names with leading slashes 32358

Packetbeat

Winlogbeat

  • Powershell: Fix processing of parameter details. 31833

  • Security: Fix processing of sidlist, access list and access mask. 31833

  • Fix fatal invalid memory write on Windows 11. 32469 32519

  • Fix handling of event formatting when no metadata is available on Windows 11. 32468 32519

Functionbeat

Elastic Logging Plugin

Added

Affecting all Beats

  • Improve performance of disk queue by coalescing writes. 31935

Auditbeat

  • Add immutable option to the auditd module. 8352 32381

Filebeat

  • Add text/csv decoder to httpjson input 28564

  • Update aws-s3 input to connect to non AWS S3 buckets 28222 28234

  • Add support for '/var/log/pods/' path for add_kubernetes_metadata processor with resource_type: pod. 28868

  • Add documentation for add_kubernetes_metadata processors log_path matcher. 28868

  • Add support for parsers on journald input 29070

  • Add support in httpjson input for oAuth2ProviderDefault of password grant_type. 29087

  • threatintel module: Add new Recorded Future integration. 30030

  • Add auth.oauth2.google.jwt_json option to httpjson input. 31750

  • Add authentication fields to RabbitMQ module documents. 31159 31680

  • Add template helper function for decoding hexadecimal strings. 31886

  • Add new parser called include_message to filter based on message contents. 31794 32094

  • Extend list of mapped record types in o365 Audit module. 32217

  • Add references for CRI-O configuration in input-container and in our kubernetes manifests 32149 32151

  • httpjson input: Add replaceAll helper function to template context. 32365

  • Optimize grok patterns in system.auth module pipeline. 32360

  • Checkpoint module: add authentication operation outcome enrichment. 32230 32431

  • add documentation for decode_xml_wineventlog processor field mappings. 32456

Auditbeat

Filebeat

Heartbeat

Metricbeat

  • Enhance Oracle Module: Change tablespace metricset collection period 30948 #31259

  • Add orchestrator cluster ECS fields in kubernetes events 31341

  • Enhance Oracle Module: Refactor module to properly use host parsers instead of doing its own parsing of hosts 31611 #31692

  • Enhance Oracle Module: Connection string for Oracle does not handle special characters properly 24609 #31368

  • Enhance Oracle Module: New sysmetric metricset 30946 #31462

  • Upgrade Mongodb library in Beats to v5 31185

    • Differentiate between actual idle CPU states and an uninterruptible disk sleep. system-metrics#32

  • AWS Fargate: Added support for DesiredStatus and KnownStatus 32077 #32342

  • Enable Generic SQL merge metrics to a single event for sql_queries using new flag 32394

  • Add distribution type metrics for GCP 32170

Packetbeat

  • Add support for specifying default route interface sniffing. 31905 31950

  • Add support for TCP transport to the SIP protocol. 28166 32346

Functionbeat

Winlogbeat

Elastic Log Driver

Deprecated

Affecting all Beats

Filebeat

Heartbeat

Metricbeat

Packetbeat

Winlogbeat

Functionbeat

Known Issue