Skip to content

Latest commit

 

History

History
209 lines (147 loc) · 10.1 KB

CHANGELOG.next.asciidoc

File metadata and controls

209 lines (147 loc) · 10.1 KB
Raw

Beats version HEAD

Breaking changes

Affecting all Beats

  • Update to Golang 1.12.1. 11330

  • Update to Golang 1.12.4. 11782

Auditbeat

  • Auditd module: Normalized value of event.category field from user-login to authentication. 11432

  • Auditd module: Unset auditd.session and user.audit.id fields are removed from audit events. 11431 11815

  • Socket dataset: Exclude localhost by default 11993

Filebeat

  • Add read_buffer configuration option. 11739

Heartbeat

  • Removed the add_host_metadata and add_cloud_metadata processors from the default config. These don’t fit well with ECS for Heartbeat and were rarely used.

Journalbeat

Metricbeat

  • Add new option OpMultiplyBuckets to scale histogram buckets to avoid decimal points in final events 10994

  • system/raid metricset now uses /sys/block instead of /proc/mdstat for data. 11613

  • kubernetes.container.cpu.limit.cores and kubernetes.container.cpu.requests.cores are now floats. 11975

Packetbeat

  • Add support for mongodb opcode 2013 (OP_MSG). 6191 8594

  • NFSv4: Always use opname ILLEGAL when failed to match request to a valid nfs operation. 11503

Winlogbeat

Functionbeat

Bugfixes

Affecting all Beats

  • Ensure all beat commands respect configured settings. 10721

  • Add missing fields and test cases for libbeat add_kubernetes_metadata processor. 11133, 11134

  • decode_json_field: process objects and arrays only 11312

  • decode_json_field: do not process arrays when flag not set. 11318

  • Report faulting file when config reload fails. 11304

  • Fix a typo in libbeat/outputs/transport/client.go by updating c.conn.LocalAddr() to c.conn.RemoteAddr(). 11242

  • Management configuration backup file will now have a timestamps in their name. 11034

  • [CM] Parse enrollment_token response correctly 11648

  • Not hiding error in case of http failure using elastic fetcher 11604

  • Fix matching of string arrays in contains condition. 11691

  • Replace wmi queries with win32 api calls as they were consuming CPU resources 3249 and 11840

  • Fix a race condition with the Kafka pipeline client, it is possible that Close() get called before Connect() . 11945

  • Fix of docker json parser for missing "log" jsonkey in docker container’s log 11464

  • Fix @timestamp being duplicated in events if @timestamp is set in a processor (or by any code utilizing PutValue() on a beat.Event).

  • Fix install-service.ps1’s ability to set Windows service’s delay start configuration. 13173

  • Fix mapping for kubernetes.labels and kubernetes.annotations in add_kubernetes_metadata. 12638 13226

  • Fix decode_base64_field processor. 13092 13144

Auditbeat

Filebeat

  • Add support for Cisco syslog format used by their switch. 10760

  • Cover empty request data, url and version in Apache2 modulehttps://github.com/elastic/pull/10730[10730]

  • Fix registry entries not being cleaned due to race conditions. 10747

  • Improve detection of file deletion on Windows. 10747

  • Add missing Kubernetes metadata fields to Filebeat CoreDNS module, and fix a documentation error. 11591

  • Reduce memory usage if long lines are truncated to fit max_bytes limit. The line buffer is copied into a smaller buffer now. This allows the runtime to release unused memory earlier. 11524

  • Fix timezone parsing of system module ingest pipelines. 13308

  • Change iis url.path grok pattern from URIPATH to NOTSPACE. 12710 13225

  • Add timezone information to apache error fileset. 12772 13304

  • Fix incorrect field references in envoyproxy dashboard 13420 13421

Heartbeat

  • Fix NPEs / resource leaks when executing config checks. 11165

Journalbeat

  • Use backoff when no new events are found. 11861

Metricbeat

  • Change diskio metrics retrieval method (only for Windows) from wmi query to DeviceIOControl function using the IOCTL_DISK_PERFORMANCE control code 11635

  • Call GetMetricData api per region instead of per instance. 11820 11882

  • Update documentation with cloudwatch:ListMetrics permission. 11987

  • Fix logstash/node_stats metricset to also collect logstash_stats.events.duration_in_millis field when xpack.enabled: true is set. 13082

  • Fix logstash/node metricset to also collect logstash_state.pipeline.representation.{type,version,hash} fields when xpack.enabled: true is set. 13133

  • Check if fields in DBInstance is nil in rds metricset. 13294 13037

Packetbeat

  • Prevent duplicate packet loss error messages in HTTP events. 10709

  • Improved debug logging efficiency in PGQSL module. 12150

  • Limit memory usage of Redis replication sessions. 12657

Winlogbeat

Functionbeat

  • Fix function name reference for Kinesis streams in CloudFormation templates 11646

Added

Affecting all Beats

  • Decouple Debug logging from fail_on_error logic for rename, copy, truncate processors 12451

  • Add an option to append to existing logs rather than always rotate on start. 11953

  • Add network condition to processors for matching IP addresses against CIDRs. 10743

  • Add if/then/else support to processors. 10744

  • Add community_id processor for computing network flow hashes. 10745

  • Add output test to kafka output 10834

  • Gracefully shut down on SIGHUP 10704

  • New processor: copy_fields. 11303

  • Add error.message to events when fail_on_error is set in rename and copy_fields processors. 11303

  • New processor: truncate_fields. 11297

  • Allow a beat to ship monitoring data directly to an Elasticsearch monitoring cluster. 9260

  • Updated go-seccomp-bpf library to v1.1.0 which updates syscall lists for Linux v5.0. NNNN

  • Add add_observer_metadata processor. 11394

  • Add decode_csv_fields processor. 11753

  • Add support for reading the network.iana_number field by default to the community_id processor. 12701

Auditbeat

  • Auditd module: Add event.outcome and event.type for ECS. 11432

Filebeat

  • Add more info to message logged when a duplicated symlink file is found 10845

  • Add option to configure docker input with paths 10687

  • Add Netflow module to enrich flow events with geoip data. 10877

  • Set event.category: network_traffic for Suricata. 10882

  • Change Suricata module pipeline to handle destination.domain being set if a reverse DNS processor is used. 10510

  • Add the network.community_id flow identifier to field to the IPTables, Suricata, and Zeek modules. 11005

  • New Filebeat coredns module to ingest coredns logs. It supports both native coredns deployment and coredns deployment in kubernetes. 11200

  • New module for Cisco ASA logs. 9200 11171

  • Added support for Cisco ASA fields to the netflow input. 11201

  • Configurable line terminator. 11015

  • Add Filebeat envoyproxy module. 11700

  • Add apache2(httpd) log path (/var/log/httpd) to make apache2 module work out of the box on Redhat-family OSes. 11887 11888

  • Add support to new MongoDB additional diagnostic information 11952

  • container and docker inputs now support reading of labels and env vars written by docker JSON file logging driver. 8358

  • Use correct OS path separator in add_kubernetes_metadata to support Windows nodes. 9205

Heartbeat

  • Enable add_observer_metadata processor in default config. 11394

Journalbeat

Metricbeat

  • Add AWS SQS metricset. 10684 10053

  • Add AWS s3_request metricset. 10949 10055

  • Add s3_daily_storage metricset. 10940 10055

  • Add coredns metricbeat module. 10585

  • Add SSL support for Metricbeat HTTP server. 11482 11457

  • The elasticsearch.index metricset (with xpack.enabled: true) now collects refresh.external_total_time_in_millis fields from Elasticsearch. 11616

  • Allow module configurations to have variants 9118

  • Add timeseries.instance field calculation. 10293

  • Added new disk states and raid level to the system/raid metricset. 11613

  • Added path_name and start_name to service metricset on windows module 8364 11877

  • Add check on object name in the counter path if the instance name is missing 6528 11878

  • Add AWS cloudwatch metricset. 11798 11734

  • Add regions in aws module config to specify target regions for querying cloudwatch metrics. 11932 11956

  • Make the beat module defensive about determine ES cluster UUID when xpack.enabled: true is set. 13020

Packetbeat

Functionbeat

  • New options to configure roles and VPC. 11779

Winlogbeat

  • Add support for reading from .evtx files. 4450

Deprecated

Affecting all Beats

Filebeat

Heartbeat

Journalbeat

Metricbeat

Packetbeat

Winlogbeat

Functionbeat

Known Issue

Journalbeat