Beats version 7.17.11edit

View commits

Bugfixesedit

Affecting all Beats

  • Added support for multi-line ZooKeeper logs. 2496
  • Allow clock_nanosleep in the default seccomp profiles for amd64 and 386. Newer versions of glibc (for example, 2.31) require it. 33792
  • Disable lockfile when running under elastic-agent. 33988
  • Fix lockfile logic, retry locking 34194
  • Add checks to ensure reloading of units if the configuration actually changed. 34346
  • Fix namespacing on self-monitoring 32336
  • Fix concurrent map writes when system/process code called from reporter code 32491
  • Log errors from the Elastic Agent V2 client errors channel. Avoids blocking when error occurs communicating with the Elastic Agent. 34392
  • Only log publish event messages in trace log level under elastic-agent. 34391
  • Fix issue where updating a single Elastic Agent configuration unit results in other units being turned off. 34504
  • Update elastic-agent-system-metrics to v0.4.6 to allow builds on mips platforms. 34674
  • The Elasticsearch output now splits large requests instead of dropping them when it receives a StatusRequestEntityTooLarge error. 34911
  • Fix Beats started by agent not respecting the allow_older_versions: true configuration flag. 34227 34964
  • Fix performance issues when we have a lot of inputs starting and stopping, by allowing to disable global processors under Fleet. 35000 35031
  • In cases where the matcher detects a non-string type in a match statement, report the error as a debug statement rather than a warning statement. 35119
  • add_cloud_metadata processor - add cloud.region field for GCE cloud provider
  • add_cloud_metadata processor - update Azure metadata API version to get missing cloud.account.id field
  • Make sure that Kubernetes watchers are closed when closing the Kubernetes meta processor. 35630
  • Upgraded apache arrow library used in x-pack/libbeat/reader/parquet from v11 to v12.0.1 in order to fix cross-compilation issues. 35640
  • Fix panic when the disk queue’s MaxRetryInterval configuration is specified, but RetryInterval is not. 35820

Filebeat

  • Fix EOF on single line not producing any event. 30436 33568
  • Move repeated Windows event channel not found errors in winlog input to debug level. 35314 35317
  • Fix crash when processing forwarded logs missing a message. 34705 34865
  • Fix crash when loading azurewebstorage cursor with no partially processed data. 35433
  • RFC5424 syslog timestamps with offset Z will be treated as UTC rather than using the default timezone. 35360
  • Fix syslog message parsing for fortinet.firewall to take into account quoted values. 35522
  • [system] sync system/auth dataset with system integration 1.29.0. 35581
  • Fix filestream false positive log error "filestream input with ID xyz already exists" 31767

Winlogbeat

  • Move repeated channel not found errors to debug level. 35314 35317

Addededit

Affecting all Beats

Update Go version to 1.19.10. 35751