Beats version 8.12.1edit

View commits

Known Issuesedit

Affecting all Beats

Performance regression in AWS S3 inputs using SQS notification.

In 8.12 the default memory queue flush interval was raised from 1 second to 10 seconds. In many configurations this improves performance because it allows the output to batch more events per round trip, which improves efficiency. However, the SQS input has an extra bottleneck that interacts badly with the new value. For more details see 37754.

If you are using the Elasticsearch output, and your output configuration uses a performance preset, switch it to preset: latency. If you use no preset or use preset: custom, then set queue.mem.flush.timeout: 1s in your queue or output configuration.

Breaking changesedit

Affecting all Beats

  • add_cloud_metadata processor: huawei provider is now treated as openstack. Huawei cloud runs on OpenStack platform, and when viewed from a metadata API standpoint, it is impossible to differentiate it from OpenStack. If you know that your deployments run on Huawei Cloud exclusively, and you wish to have cloud.provider value as huawei, you can achieve this by overwriting the value using an add_fields processor. 35184


Affecting all Beats

  • aws: Add credential caching for AssumeRole session tokens. 37787
  • Lower logging level to debug when attempting to configure beats with unknown fields from autodiscovered events/environments. 37816[37816]


  • Fix nil pointer dereference in the httpjson input. 37591
  • Fix TCP/UDP metric queue length parsing base. 37714
  • Fix m365_defender cursor value and query building. 37116
  • Update dependency. 37799


  • Fix setuid root when running under cgroups v2. 37794


  • Fix Azure Resource Metrics missing metrics (min and max aggregations) after upgrade to 8.11.3. 37642 37643



  • Relax TCP/UDP metric polling expectations to improve metric collection. 37714