Beats version 8.9.0edit

View commits

Bugfixesedit

Affecting all Beats

  • Do not print context cancelled error message when running under agent 36006
  • Fix recovering from invalid output configuration when running under Elastic-Agent 36016

Filebeat

  • Add support in s3 input for JSON with array of objects. 35475
  • RFC5424 syslog timestamps with offset Z will be treated as UTC rather than using the default timezone. 35360
  • Fixed a minor code error in the GCS input scheduler where a config value was being used directly instead of the source struct. 35729
  • Fix CEL input JSON marshalling of nested objects. 35763 35774
  • Fix metric collection in GCPPubSub input. 35773
  • Fix end point deregistration in http_endpoint input. 35899 35903
  • Fix duplicate ID panic in filestream metrics. 35964 35972
  • Improve error reporting and fix IPv6 handling of TCP and UDP metric collection. 35996
  • Fix handling of NUL-terminated log lines in Fortinet Firewall module. 36026 36027
  • Make redact field configuration recommended in CEL input and log warning if missing. 36008
  • Fix handling of region name configuration in awss3 input 36034

Heartbeat

  • Update gval version. 35636
  • Filter dev flags for ui monitors inside synthetics_args. 35788
  • Fix temp dir running out of space with project monitors. 35843

Metricbeat

  • Fix no error logs displayed in CloudWatch EC2, RDS and SQS metadata 34985 35035
  • Remove Beta warning from IIS application_pool metricset 35480
  • Improve documentation for ActiveMQ module 35113 35558
  • Resolve statsd module’s prematurely halting of metrics parsing upon encountering an invalid packet. 35075

Packetbeat

  • Fix double channel close panic when reloading. 35324

Winlogbeat

  • Prevent panic on closing iterators on empty channels in experimental API. 33966 35423

Addededit

Affecting all Beats

  • Add Hetzner Cloud as a provider for add_cloud_metadata. 35456
  • Upgrade version of elastic-agent-autodiscover to v0.6.1 for improved memory consumption on k8s. 35483
  • Added orchestrator.cluster.id and orchestrator.cluster.name fields to the add_cloud_metadata processor, AWS cloud provider. 35182
  • Lowercase reported hostnames per Elastic Common Schema (ECS) guidelines for the host.name field. Upgraded github.com/elastic/go-sysinfo to 1.11.0. 35652

Filebeat

  • Added support for decoding apache parquet files in awss3 input. 34662 35578
  • Add support for CRC validation in Filebeat’s HTTP endpoint input. 35204
  • Add support for CRC validation in Zoom module. 35604
  • Add execution budget to CEL input. 35409
  • Add XML decoding support to HTTPJSON. 34438 35235
  • Add delegated account support when using Google ADC in httpjson input. 35507
  • Add metrics for filestream input. 35529
  • Add support for collecting httpjson metrics. 35392
  • Add XML decoding support to CEL. 34438 35372
  • Mark CEL input as GA. 35559
  • Add metrics for gcp-pubsub input. 35614
  • Allow non-AWS endpoints for awss3 input. 35496 35520
  • Add Okta input package for entity analytics. 35611
  • Expose harvester metrics from filestream input 35835 33771
  • Add device support for Azure AD entity analytics. 35807

Libbeat - Added support for Apache Parquet file reader. 34662 35183

Metricbeat

  • Add GCP Redis metadata 33701
  • Migrate Azure Billing, Monitor, and Storage metricsets to the newer SDK. 33585
  • Add support for float64 values parsing for statsd metrics of counter type. 35099

Packetbeat

  • Added packetbeat.interfaces.fanout_group to allow a Packetbeat sniffer to join an AF_PACKET fanout group. 35451 35453

Winlogbeat

  • Set host.os.type and host.os.family to "windows" if not already set. 35435
  • Handle empty DNS answer data in QueryResults for the Sysmon Pipeline 35207