Beats version 8.9.1edit

View commits



  • auditd: Expanded the bitmask applied to ECS file.mode so that the SUID, SGID, and sticky bits can be represented. 36294


  • Fix panic when SQS input metrics getter is invoked. 36101 36077
  • Make CEL input’s now global variable static for evaluation lifetime. 36107
  • Fix handling of TCP/UDP address resolution during metric initialization. 35064 36287
  • Fix handling of Juniper SRX structured data when there is no leading Junos element. 36270 36308
  • Remove erroneous error log in GCPPubSub input. 36296
  • Fix Filebeat Cisco module with missing escape character. 36325 36326


  • Enable heartbeat-wide publish timeout setting with run_once. 35721
  • Added default timezone UTC to heartbeat docker images to fix synthetics journeys navigation errors. 36193


  • Fix handling of Npcap installation options from Fleet. 35541 35935


  • Fix powershell details regexp to prevent excessive backtracking when processing command invocations. 36178


Affecting all Beats

  • Upgrade Go to 1.19.12 36246
  • Add warning message to SysV init scripts for RPM-based systems that lack /etc/rc.d/init.d/functions. 35708 36188


  • Add support for endpoint resolver in AWS config 36208