Logstash 6.5.0 Release Notes

  • BUGFIX: Count unused space in page files towards current PQ size #10105
  • BUGFIX: Handle equality checks on list and map types in Java execution #10074
  • BUGFIX: Handle equality comparison where one or more fields are null in Java execution #10039
  • Make cgroups more robust and provide the override similar to ES #10011
  • BUGFIX: Pipeline reloading breaks with PQ enabled #9987
  • BUGFIX: Avoid race condition when initializing event and pipeline metrics #9959
  • Support port customization in cloud id #9877
  • Support for integration plugins in plugin manager #9811
  • Promote Java execution from experimental to beta #10063

Plugins

Elastic App Search output

  • New: Added as default plugin

SNMP input

  • New: Added as default plugin

Elasticsearch filter

  • Adds [@metadata][total_hits] with total hits returned from the query #106
  • Improves error logging to fully inspect caught exceptions #105

Translate filter

  • Fix to align with docs - looked-up values are always strings. Coerce better.
  • Fix bug in dictionary/file the always applied RegexExact, manifested when dictionary keys are not regex compatible
  • Added info to dictionary_path description to explain why integers must be quoted
  • Fix bug in csv_file when LS config has CSV filter plugin specified as well as a csv dictionary.
  • Updated formatting of examples in documentation for consistent rendering
  • Add iterate_on setting to support fields that are arrays, see the docs for detailed explanation.
  • Add Rufus::Scheduler to provide asynchronous loading of dictionary.
  • Re-organise code, yields performance improvement of around 360%

Useragent filter

  • Update source mapping to latest from uap-core #53

Kafka input

  • Upgrade Kafka client to version 2.0.0
  • Docs: Correct list formatting for decorate_events
  • Docs: Add kafka default to partition_assignment_strategy

Redis input

  • Added support for renamed redis commands
  • Add channel to the event

S3 input

  • Docs: Fixed link formatting for input type
  • Skips objects that are archived to AWS Glacier with a helpful log message (previously they would log as matched, but then fail to load events) #160
  • Added watch_for_new_files option, enabling single-batch imports #159

TCP input

  • Added support for pkcs1 and pkcs8 key formats #122
  • Changed server-mode SSL to run on top of Netty #122
  • Changed travis testing infra to use logstash tarballs #122
  • Fixed certificate chain handling and validation #124
  • Added new configuration option dns_reverse_lookup_enabled to allow users to disable costly DNS reverse lookups #100

Netflow codec

  • Added Cisco ACI to list of known working Netflow v9 exporters
  • Added support for IXIA Packet Broker IPFIX
  • Fixed issue with Procera float fields
  • Fixed issue where TTL in template registry was not being respected.
  • Reduced complexity of creating, persisting, loading an retrieving template caches.
  • Added support for Netflow v9 devices with VarString fields (H3C Netstream)
  • Fixed incorrect parsing of zero-filled Netflow 9 packets from Palo Alto
  • Fixed IPFIX options template parsing for Juniper MX240 JunOS 15.1