Brewing in Beats: Introduce processors

Welcome to Brewing in Beats! With this series, we're keeping you up to date with all that's new in Beats, from the details of work in progress pull requests to releases and learning resources.

Metricbeat: Use half floats

Elasticsearch added support for half floats in the 5.0.0-alpha4 release. The Beats make use of the half floats for the percentage values (a float value between 0 and 1) and for the other float values that are expected to be small.

Filebeat: Add more configuration options to help with files management

There are couple of configuration options added in Filebeat to deal with corner cases:

Topbeat 1.x: Fix high values of CPU usage

There is a bug in the Topbeat 1.2.x series that reports high values of the CPU usage on Windows. The bug fix will be available in the next release of Topbeat 1.x and is already fixed in the 5.0 alphas.

libbeat: Rename filters with processors

The filters configuration option helps you reduce the fields from the exported event. To align with the naming in the Ingest Node and Logstash, we are renaming the configuration option to processors. In addition, we are planning to extend its functionality and use it to enhance the event with additional fields. This change breaks the compatibility with the previous version of the Beats.

All Beats: Update the definition of the condition in processor

While renaming filters with processors and extending its functionality, we decided to use the when keyword to introduce the condition associated to the processor in order to differentiate its borders from the action associated with the processor.

Before

processors:
  - include_fields:
    equals:
      proc.pid: 3455
    fields: ["proc.cpu", "proc.mem"]

After

processors:
  - include_fields:
      when:
        equals:
          proc.pid: 3455
      fields: ["proc.cpu", "proc.mem"]

Metricbeat: the system module now compiles on FreeBSD

The system module of Metricbeat is using the elastic/gosigar library to gather system statistics like the CPU and memory usage, disk usage, file system usage. Thanks to @knz, the gosigar library has now support for FreeBSD.