« Release notes Beats version 8.19.23 »
Elastic Docs ›Beats Platform Reference [8.19]

Beats version 8.19.24

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Beats version 8.19.24

edit

View commits

The 8.19.24 release contains fixes for potential security vulnerabilities. Check our security advisory for more details.

Security updates

edit

Filebeat

  • Update github.com/apache/thrift to v0.25.0. #53636

Heartbeat

  • Bump npm to 12.2.1 and Node.js to 22.23.4 (24.22.1 on Wolfi) in the Heartbeat Docker images to remove vulnerable undici copies. #53947

New features

edit

The 8.19.24 release adds the following new and notable features.

Filebeat

  • Ensure that the CEL input’s events from previous evaluations are removed from the CEL state before starting a new evaluation. #53817

Enhancements

edit

All

  • Update Go to 1.26.10. #53706

Filebeat

  • Add proxy_url and proxy_disable support to the azure-eventhub input, reject WebSocket transport with processor v1, and propagate checkpoint migration errors. #53534

Packetbeat

  • Update the Npcap OEM installer to 1.88. #53773
  • Update the Npcap OEM installer to 1.89. #53706

Bug fixes

edit

Auditbeat

  • Fix the file_integrity eBPF backend failing to start on Linux 6.15 and later. #53511 #46719
  • Fix a panic in the file_integrity eBPF backend when its eBPF loader fails to start. #53785
  • Fix the file_integrity kprobes backend hanging at startup when probe verification keeps failing. #53782

Filebeat

  • Resume CrowdStrike Event Streams after dropped firehose connections without exhausting retries. #53416
  • Validate the http_endpoint input’s configuration for HTTP OPTIONS requests at startup. When options_headers is set, it must not be empty, and options_response_code must be valid. A previously accepted empty options_headers: {} now fails at startup. #53417
  • Fix the azure-eventhub v1 input crashing the OTel Collector with a concurrent map iteration and map write. #53822 #53816
  • Fix TCP and UDP input receive queue and packet drop metrics always reporting 0 when listening on 0.0.0.0 on hosts with IPv6 enabled. #53972
  • Fix the system module’s auth fileset ingest pipeline failing on journald events without journald.process.name. #54033 #54013
  • Reduce the memory retained by the azure-eventhub v2 input while waiting for acknowledgments. #54014

Heartbeat

  • Fix malformed Synthetics runner log messages. #53593
  • Fix Heartbeat memory growth by releasing popped tasks from the scheduler timer queue. #53664 #53662

Metricbeat

  • Skip unsupported Azure Monitor metric namespaces when ignore_unsupported is true instead of failing collection on HTTP 400. #53643 #52999

Packetbeat

  • Reject RESP bulk-string lengths other than -1 (nil) and >=0 in the Packetbeat Redis parser. #50288 #50205
  • Fix the SIP parser populating the contact fields from the To header instead of the Contact header. #53418
  • Fix a nil map panic and missed completion for zero-body messages in the AMQP parser. #53491
  • Fix pgsql queries being paired with the wrong responses after a NULL column. #53666
  • Reject invalid negative RESP array lengths in the Redis parser. #53843
« Release notes Beats version 8.19.23 »