Beats version 8.12.0edit
Known Issuesedit
Affecting all Beats
Performance regression in AWS S3 inputs using SQS notification.
In 8.12 the default memory queue flush interval was raised from 1 second to 10 seconds. In many configurations this improves performance because it allows the output to batch more events per round trip, which improves efficiency. However, the SQS input has an extra bottleneck that interacts badly with the new value. For more details see 37754.
If you are using the Elasticsearch output, and your output configuration uses a performance preset, switch it to preset: latency. If you use no preset or use preset: custom, then set queue.mem.flush.timeout: 1s in your queue or output configuration.
If you are not using the Elasticsearch output, set queue.mem.flush.timeout: 1s in your queue or output configuration.
Breaking changesedit
Heartbeat - Decrease the ES default timeout to 10 for the load monitor state requests. - Windows MSI installers now store configuration in C:\Program Files instead of C:\ProgramData. https://github.com/elastic/elastic-stack-installers/pull/209
Osquerybeat
- Upgrade to osquery 5.10.2. 37115
Bugfixesedit
Filebeat
Addededit
Affecting all Beats
-
Allow
queueconfiguration settings to be set under the output. 35615 36788 - Raise up logging level to warning when attempting to configure Beats with unknown fields from autodiscovered events/environments.
-
Elasticsearch output now supports
idle_connection_timeout. 35615 36843 - Upgrade to Go 1.20.12. 37350
-
The Elasticsearch output can now configure performance presets with the
presetconfiguration field. 37259 -
Upgrade
elastic-agent-system-metricsto v0.9.1. See https://github.com/elastic/elastic-agent-system-metrics/releases/tag/v0.9.1. 37353 - Upgrade to elastic-agent-libs v0.7.3 and golang.org/x/crypto v0.17.0. 37544
Auditbeat
Filebeat
- Allow http_endpoint input to receive PUT and PATCH requests. 36734
- Avoid unwanted publication of Azure entity records. 36753
- Avoid unwanted publication of Okta entity records. 36770
- Add support for Digest Authentication to CEL input. 35514 36932
-
Use filestream input with
file_identity.fingerprintas default for hints autodiscover. 35984 36950 - Add network processor in addition to interface based direction resolution. 37023
- Make CEL input log current transaction ID when request tracing is turned on. 37065
- Make Azure Blob Storage input GA and update docs accordingly. 37128
- Add request trace logging to http_endpoint input. 36951 36957
- Make GCS input GA and update docs accordingly. 37127
- Suppress and log max HTTP request retry errors in CEL input. 37160
- Prevent CEL input from re-entering the eval loop when an evaluation failed. 37161
- Update CEL extensions library to v1.7.0. 37172
Auditbeat
Heartbeat - Capture and log the individual connection metrics for all the lightweight monitors.
Metricbeat
- Add metrics grouping by dimensions and time to Azure app insights. 36634
- Align on the algorithm used to transform Prometheus histograms into Elasticsearch histograms. 36647
- Enhance GCP billing with detailed tables identification, additional fields, and optimized data handling. 36902
-
Add a
/inputs/route to the HTTP monitoring endpoint that exposes metrics for each metricset instance. 36971 - Add Linux IO metrics to system/process. 37213
- Add new memory/cgroup metrics to Kibana module. 37232
Packetbeat
Winlogbeat