Beats version 8.7.1edit

View commits


Affecting all Beats

  • Fix Beats started by agent not respecting the allow_older_versions: true configuration flag 34227 34964
  • Beats started by agent now configure one global instance of each default add_x_metadata processor instead of creating one processor per input. Fixes a significant performance degradation for the aws-s3 input. 35000 35031


  • [GCS Input] Added missing locks for safe concurrency 34914
  • Add input instance id to request trace filename for httpjson and cel inputs 35037
  • Fix panic in TCP and UDP inputs on Linux when collecting socket metrics from OS. 35064
  • Correctly collect TCP and UDP metrics for unspecified address values. 35111
  • Fix base for UDP and TCP queue metrics and UDP drops metric. 35123
  • Sanitize filenames for request tracer in httpjson and cel inputs. 35143
  • Fix handling of MySQL audit logs with strict JSON parser. 35158 35160
  • decode_cef processor: Fix ECS output by making observer.ip into an array of strings instead of string. 35140 35149
  • Fix accidental error overwrite in defer statement in entityanalytics Azure AD input. 35153 35169


  • Fix issue using projects in airgapped environments by disabling npm audit. 34936


  • Fix documentation for flows.period related to flow reporting. 35009


Affecting all Beats

  • Allow users to enable features via configuration, starting with the FQDN reporting feature. 1070 34456


  • Add note in documentation about 21 event ID clause limit 35048 35049