Beats version 6.1.0edit

View commits

Breaking changesedit

Auditbeat

  • Changed audit.file.path to be a multi-field so that path is searchable. 5625

Metricbeat

  • Rename heap_init field to heap.init in the Elasticsearch module. 5320
  • Rename http.response.status_code field to http.response.code in the HTTP module. 5521

Bugfixesedit

Affecting all Beats

  • Remove ID() from Runner interface 5153
  • Correctly send configured Host header to the remote server. 4842
  • Change add_kubernetes_metadata to attempt detection of namespace. 5482
  • Avoid double slash when join url and path 5517
  • Fix console color output for Windows. 5611
  • Fix logstash output debug message. ]
  • Fix isolation of modules when merging local and global field settings. 5795

Filebeat

  • Add support for adding string tags 5395
  • Fix race condition when limiting the number of harvesters running in parallel 5458
  • Fix relative paths in the prospector definitions. 5443
  • Fix recursive_globe.enabled option. 5443

Metricbeat

  • Change field type of http header from nested to object 5258
  • Fix the fetching of process information when some data is missing under MacOS X. 5337
  • Change MySQL active connections visualization title to MySQL total connections. 4812
  • Fix ProcState on Linux and FreeBSD when process names contain parentheses. 5775
  • Fix incorrect Mem.Used calculation under linux. 5775
  • Fix open_file_descriptor_count and max_file_descriptor_count lost in zookeeper module 5902

Packetbeat

  • Fix http status phrase parsing not allow spaces. 5312
  • Fix http parse to allow to parse get request with space in the URI. 5495

Winlogbeat

  • Fix the registry file. It was not correctly storing event log names, and upon restart it would begin reading at the start of each event log. 5813

Addededit

Affecting all Beats

  • Support dashboard loading without Elasticseach 5653
  • Changed the hashbang used in the beat helper script from /bin/bash to /usr/bin/env bash. 5051
  • Changed beat helper script to use exec when running the beat. 5051
  • Fix reloader error message to only print on actual error 5066
  • Add support for enabling TLS renegotiation. 4386
  • Add Azure VM support for add_cloud_metadata processor 5355
  • Add output.file.permission config option. 4638
  • Refactor add_kubernetes_metadata to support autodiscovery 5434
  • Improve custom flag handling and CLI flags usage message. 5543
  • Add number_of_routing_shards config set to 30 5570
  • Set log level for kafka output. 5397
  • Move TCP UDP start up into server.Start() 4903
  • Update to Golang 1.9.2

Auditbeat

  • Add support for SHA3 hash algorithms to the file integrity module. 5345
  • Add dashboards for Linux audit framework events (overview, executions, sockets). 5516

Filebeat

  • Add PostgreSQL module with slowlog support. 4763
  • Add Kafka log module. 4885
  • Add support for /var/log/containers/ log path in add_kubernetes_metadata processor. 4981
  • Remove error log from runnerfactory as error is returned by API. 5085
  • Add experimental Docker json-file prospector . 5402
  • Add experimental Docker autodiscover functionality. 5245
  • Add option to convert the timestamps to UTC in the system module. 5647
  • Add Logstash module support for main log and the slow log, support the plain text or structured JSON format 5481

Metricbeat

  • Add graphite protocol metricbeat module. 4734
  • Add http server metricset to support push metrics via http. 4770
  • Make config object public for graphite and http server 4820
  • Add system uptime metricset. 4848
  • Add experimental queue metricset to RabbitMQ module. 4788
  • Add additional php-fpm pool status kpis for Metricbeat module 5287
  • Add etcd module. 4970
  • Add ip address of docker containers to event. 5379
  • Add ceph osd tree information to Metricbeat 5498
  • Add basic Logstash module. 5540
  • Add dashboard for Windows service metricset. 5603
  • Add experimental Docker autodiscover functionality. 5245
  • Add Windows service metricset in the windows module. 5332
  • Update gosigar to v0.6.0. 5775

Packetbeat

  • Add support for decoding the TLS envelopes. 5476