This list summarizes the most important breaking changes in Beats. For the complete list, go to Beats breaking changes.

Beats logs are now ECS-compliantedit

All Elastic Beats now write ECS-compliant logs in JSON format, and the config options for enabling ECS/JSON are removed. The new log name format is {beatname}-{date}(-n)?.ndjson. For example (from oldest to newest): filebeat-20200101.ndjson, filebeat-20200101-1.ndjson, filebeat-20200101-2.ndjson, and so on.

With this change, we now provide a uniform logging scheme across Elastic products, which makes it easier to develop ECS-aware visualizations for behaviors like correlating metrics or events across products.

If you have any monitoring configurations that expect the old log format, you must update them to use the new log format.

Beats now store events in data streams instead of indicesedit

All Beats shippers now store events in data streams in Elasticsearch instead of indices regardless of the Elasticsearch version. This change affects the underlying data storage method used in Elasticsearch; it does not change the naming convention. The name of the data stream follows the format {beatname}-{version}, and the index pattern is {beatname}-{version}. Do not confuse this change with the naming convention we use in Elastic integrations.

As part of this change, some index lifecycle managment (ILM) options (rollover_alias and pattern) are removed because data streams do not require index aliases. Also the setup.template.type option is removed because it no longer makes sense.

If you are loading JSON index templates by specifying a file in setup.template.json.path, make sure you move from the legacy format to composable index templates.

For more information, refer to the Elasticsearch documentation about data streams.

Homebrew formulae no longer available for Beatsedit

Starting with version 8.0.0, Elastic no longer publishes Homebrew formulae for Beats. You must use a different installation method. See the Beats download pages for available installation methods.

Removal of older platforms from Beats support matrixedit

Starting with version 8.0.0, the following operating systems are no longer supported by Beats due to lack of vendor support for the operating system. In order to have the best product experience, you are encouraged to move to a vendor-supported version of the operating system.

Filebeat filesets are disabled by defaultedit

Prior to version 8.0.0, modules had some filesets that were enabled by default. This meant that in some cases you could enable a module from the command line and run it without modifying the configuration in the modules.d directory. However this caused problems for some users.

Starting in version 8.0.0, filesets are disabled by default. You must explicitly enable the filesets you want Filebeat to use.