Beats version 7.0.0-alpha2

Check the HEAD diff

Breaking changes

Affecting all Beats

  • Update add_cloud_metadata fields to adjust to ECS. 9265
  • Automaticall cap signed integers to 63bits. 8991
  • Rename beat.timezone to event.timezone. 9458
  • Use _doc as document type. 9056
  • Removed dashboards and index patterns generation for Kibana 5. 8927
  • On systems with systemd, the Beats log is now written to journald by default rather than file. To revert this behaviour override BEAT_LOG_OPTS with an empty value. 8942.

Auditbeat

  • Remove warning for deprecated option: "filters". 9002

Filebeat

  • Allow beats to blacklist certain part of the configuration while using Central Management. 9099
  • Remove warnings for deprecated options: "spool_size", "publish_async", "idle_timeout". 9002
  • Rename many haproxy.* fields to map to ECS. 9117
  • Rename many iis.access.* fields to map to ECS. 9084
  • IIS module’s user agent string is no longer encoded (+ replaced with spaces). 9084
  • Rename many system.syslog.* fields to map to ECS. 9135
  • Rename many nginx.access.* fields to map to ECS. 9081
  • Rename many system.auth.* fields to map to ECS. 9138
  • Rename many apache2.access.* fields to map to ECS. 9245
  • Rename apache2 module to apache. 9402

Metricbeat

  • Allow beats to blacklist certain part of the configuration while using Central Management. 9099
  • Remove warning for deprecated option: "filters". 9002

Packetbeat

  • Renamed the flow event fields to follow Elastic Common Schema. 9121
  • Renamed several client and server fields. IP, port, and process metadata are now contained under the client and server namespaces. 9303

Functionbeat

  • The CLI will now log CloudFormation Stack events. 8912
  • Function concurrency is now set to 5 instead of unreserved. 8992

Bugfixes

Affecting all Beats

  • Propagate Sync error when running SafeFileRotate. 9069
  • Fix autodiscover configurations stopping when metadata is missing. 8851
  • Log events at the debug level when dropped by encoding problems. 9251
  • Refresh host metadata in add_host_metadata. 9359
  • When collecting swap metrics for beats telemetry or system metricbeat module handle cases of free swap being bigger than total swap by assuming no swap is being used. 6271 9383
  • Adding logging traces at debug level when the pipeline client receives the following events: onFilteredOut, onDroppedOnPublish. 9016
  • Ignore non index fields in default_field for Elasticsearch. 9549
  • Update Kibana index pattern attributes for objects that are disabled. 9644
  • Enforce validation for the Central Management access token. 9621
  • Update to Golang 1.11.4. 9627

Auditbeat

Filebeat

  • Correctly parse December or Dec in the Syslog input. 9349
  • Fix installation of haproxy dashboard. 9307 9313
  • Don’t generate incomplete configurations when logs collection is disabled by hints. 9305
  • Stop runners disabled by hints after previously being started. 9305
  • Fix saved objects in filebeat haproxy dashboard. 9417
  • Use log.source.address instead of log.source.ip for network input sources. 9487
  • Rename many redis.log.* fields to map to ECS. 9315
  • Rename many icinga.* fields to map to ECS. 9294
  • Rename many postgresql.log.* fields to map to ECS. 9308
  • Rename many kafka.log.* fields to map to ECS. 9297
  • Add convert_timezone option to Logstash module to convert dates to UTC. 9756 9797

Metricbeat

  • Fix issue preventing diskio metrics collection for idle disks. 9124 9125
  • Fix panic on docker healthcheck collection on dockers without healthchecks. 9171
  • Fix issue with not collecting Elasticsearch cross-cluster replication stats correctly. 9179
  • The node.name field in the elasticsearch/node metricset now correctly reports the Elasticsarch node name. Previously this field was incorrectly reporting the node ID instead. 9209

Packetbeat

  • Fix issue with process monitor associating traffic to the wrong process. 9151 9443

Added

Affecting all Beats

  • Unify dashboard exporter tools. 9097
  • Add cache.ttl to add_host_metadata. 9359
  • Add support for index lifecycle management (beta). 7963
  • Always include Pod UID as part of Pod metadata. 9517
  • Autodiscovery no longer requires that the condition field be set. If left unset all configs will be matched. 9029
  • Add geo fields to add_host_metadata processor. 9392

Filebeat

  • Added the redirect_stderr option that allows panics to be logged to log files. 8430
  • Added detect_null_bytes selector to detect null bytes from a io.reader. 9210
  • Added syslog_host variable to HAProxy module to allow syslog listener to bind to configured host. 9366
  • Added support on Traefik for Common Log Format and Combined Log Format mixed which is the default Traefik format 8015 6111 8768.
  • Add support for multi-core thread_id in postgresql module 9156 9482

Heartbeat

  • Add last monitor status to dashboard table. Further break out monitors in dashboard table by monitor.ip. 9022
  • Add central management support. 9254

Journalbeat

  • Add cursor_seek_fallback option. 9234

Metricbeat

  • Add settings to disable docker and cgroup cpu metrics per core. 9187 9194 9589
  • The elasticsearch/node metricset now reports the Elasticsearch cluster UUID. 8771
  • Add service.type field to Metricbeat. 8965
  • Support GET requests in Jolokia module. 8566 9226
  • Add freebsd support for the uptime metricset. 9413
  • Add host.os.name field to add_host_metadata processor. 8948 9405
  • Add more TCP statuses to socket_summary metricset. 9430
  • Remove experimental tag from ceph metricsets. 9708
  • Add MS SQL module to X-Pack https://github.com/elastic/beats/pull/9414[9414

Deprecated

Metricbeat

  • event.duration is now in nano and not microseconds anymore. 8941