Brewing in Beats: 1.0.0 released

The past week was memorable for the Beats team as we finally released 1.0.0.  Read blog post.


Change proc type in Topbeat

Because we were using proc as a type, but also in the field names (e.g. proc.name), this made the requests ambiguous and the result was wrong when using Elasticsearch 1.x for some of the widgets in our sample dashboards. To fix it, we have changed the proc type to process type in Topbeat.

This change breaks backward compatibility. 

Community Beats

We are excited to see two new community Beats created last week:

  1. HTTPbeatchristiangalsterer/httpbeat, used to call HTTP endpoints. Multiple endpoints can be configured which are polled in a regular interval and the result is shipped to the configured output channel.
  2. PHPFPMbeatkozlice/phpfpmbeat, which can be used to get metrics from PHP-FPM webservers. 

Give these two Beats a try and let us and the authors know what you think!

Elasticsearch Ping over https

Fix the Ping function by setting the credentials into the HEAD request sent by the Beat to Elasticsearch. The fix is here.

Set default ignore_older to 24h in Filebeat

There were some issues with Filebeat failing to reopen files after it closed them, so we decided to change the default value of the ignore_older option to 24h. This is the value that was also used by the Logstash Forwarder and it is a safer default.

Simplify the main function

For each Beat the main function looks similar, so we decided to simplify it by moving all the common parts into the run function in libbeat and call it from each Beat. With this change the main function of each Beat resumes to one line of code: Topbeat change,Filebeat change and Packetbeat change.