Release Notes

Backward Compatibility Breaks

  • Rename the timestamp field with @timestamp for a better integration with Logstash #168
  • Rename tail_on_rotate prospector config to tail_files #175


  • Omit 'fields' from event JSON when null. #126
  • Make offset and line value of type long in elasticsearch template to prevent overflow. #140
  • Fix locking files for writing behaviour. #156
  • Introduce 'document_type' config option per prospector to define document type for event stored in elasticsearch. #133
  • Add 'input_type' field to published events reporting the prospector type being used. #133
  • Fix high CPU usage when not connected to Elasticsearch or Logstash. #144
  • Fix issue that files were not crawled anymore when encoding was set to something other then plain. #182
  • Filebeat will now exit if a configuration error is detected. #198
  • Use stderr for console log output. elastic/libbeat#219
  • Handle empty event array in publisher. elastic/libbeat#207
  • Respect * debug selector in IsDebug. elastic/libbeat#226
  • On Windows, remove service related error message when running in the console. elastic/libbeat#242
  • Use http as the default scheme in the elasticsearch hosts elastic/libbeat#253
  • Respect max bulk size if bulk publisher (collector) is disabled or sync flag is set. elastic/libbeat#261
  • Always evaluate status code from Elasticsearch responses when indexing events. elastic/libbeat#192
  • Use bulk_max_size configuration option instead of bulk_size. elastic/libbeat#256
  • Fix max_retries=0 (no retries) configuration option. elastic/libbeat#266
  • Filename used for file based logging now defaults to beat name. elastic/libbeat#267


  • Introduction of backoff, backoff_factor, max_backoff, partial_line_waiting, force_close_windows_files config variables to make crawling more configurable. #146
  • Add Console output plugin. elastic/libbeat#218
  • Add timestamp to log messages elastic/libbeat#245
  • Send @metadata.beat to Logstash instead of @metadata.index to prevent possible name clashes and give user full control over index name used for Elasticsearch elastic/libbeat#231
  • Add logging messages for bulk publishing in case of error elastic/libbeat#229
  • Add option to configure number of parallel workers publishing to Elasticsearch or Logstash.
  • Set default bulk size for Elasticsearch output to 50.
  • Set default http timeout for Elasticsearch to 90s.
  • Improve publish retry if sync flag is set by retrying only up to max bulk size events instead of all events to be published.


  • All Godeps dependencies were updated to master on 2015-10-21 [#122]
  • Set default value for ignore_older config to 10 minutes. #164
  • Added the fields_under_root setting to optionally store the custom fields top level in the output dictionary. #188
  • Add more encodings by using x/text/encodings/htmlindex package to select encoding by name. #187