IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
Elastic Docs ›Beats Platform Reference [8.6] ›Release notes
« Beats version 8.4.2 Beats version 8.4.0 »

Beats version 8.4.1edit

View commits

Known Issueedit

Filebeat

Filebeat agents configured to read from AWS inputs may return an error similar to the following:

sqs ReceiveMessage failed: operation error SQS: ReceiveMessage, https response
error StatusCode: 403, RequestID: cb57783a-505f-5099-9160-23b8eea8ddbb,
api error SignatureDoesNotMatch: Credential should be scoped to a valid region.

This error was introduced by a breaking change in the AWS library.

This issue also affects FIPS-enabled endpoints. If you rely on FIPS, do not upgrade until version 8.4.2 of the Elastic Stack is available. The workaround documented here will not resolve this problem.

Suggested resolution: In the Filebeat configuration, if an AWS input or module configuration sets endpoint to a non empty string, set it to an empty string instead. Also make sure the default AWS region is set in an environment variable, credentials or instance profile, or in the default_region setting in the configuration. For example:

filebeat.inputs:
- type: aws-s3
...
  endpoint: "" 
  default_region: us-east-1

You can set this value to an empty string or remove the configuration setting.

Or for modules:

s3access:
    enabled: false
...
    var.endpoint: "" 
    var.default_region: us-east-1

You can set this value to an empty string or remove the configuration setting

Bugfixesedit

Auditbeat

  • Fixes a bug with the auditd module where data is corrupted because it was not copied before the byte slice was reused. 32818 32823

Filebeat

  • Update cloud.region parsing in cloudtrail fileset. 32763
  • Fix file.path field in cloudtrail fileset to use json.digestS3Object. 32759
  • Fix not parsing as json when json and ndjson content types have charset information in aws-s3 input 32767

Addededit

Filebeat

  • httpjson input: Add toJSON helper function to template context. 32472
« Beats version 8.4.2 Beats version 8.4.0 »