Skip to content

Latest commit

 

History

History
218 lines (110 loc) · 6.69 KB

CHANGELOG.next.asciidoc

File metadata and controls

218 lines (110 loc) · 6.69 KB
Raw

Beats version HEAD

Breaking changes

Affecting all Beats

  • Upgrade to Go 1.18. Certificates signed with SHA-1 are now rejected. See the Go 1.18 release notes for details. 32493

    • Fix namespacing on self-monitoring 32336

    • Fix formatting of hardware addresses populated by the add-host-metadata processor. 32264 32265

Auditbeat

Filebeat - [Httpjson]- Fix for pagination at root level not working when used with chaining. - Import dashboard from Fortinet Fortigate firewall integration. 19810 33003

Heartbeat - Deprecate zip_url and local monitor options. 33123

Metricbeat

Packetbeat

Winlogbeat

Functionbeat

Bugfixes

Affecting all Beats

  • Fix namespacing for agent self-monitoring, CPU no longer reports as zero. 32336

  • Fix namespacing on self-monitoring 32336

  • Expand fields in decode_json_fields if target is set. 31712 32010

  • Fix race condition when stopping runners 32433

  • Fix concurrent map writes when system/process code called from reporter code 32491

  • Fix in AWS related services initialisation relying on custom endpoint resolver. 32888 32921

Auditbeat

  • auditd module: Fix parsing of audit rules where arguments are quoted (like file paths containing spaces). 32421

  • auditd module: Fix minimum AuditStatus length so that library can support kernels from 2.6.32. 32421

  • system/socket: Reduce memory usage of the dataset. 32191 32192

  • Fix rendering of MAC addresses to conform to ECS. 32621 32622

  • Fixes a bug with the auditd module where data is corrupted because it was not copied before the byte slice was reused. 32818 32823

Filebeat

  • Fix counter for number of events published in httpjson input. 31993

  • Fix handling of Checkpoint event for R81. 32380 32458

  • Fix a hang on apt-get update stage in packaging. 32580

  • gcp-pubsub input: Restart Pub/Sub client on all errors. 32550 32712

  • Fix not parsing as json when json and ndjson content types have charset information in aws-s3 input 32767

  • Update cloud.region parsing in cloudtrail fileset. 32763

  • Fix file.path field in cloudtrail fileset to use json.digestS3Object. 32759

  • Fix rendering of MAC addresses to conform to ECS. 32621 32622

  • Import dashboards from CEF integration. 32766

  • Fix how to handle IPv6 addresses in the fileset nginx/ingress_controller for Filebeat. 32989

  • Fix handling of Cisco 302020 messages in ASA and FTD modules. 33089

  • Fix requestID parsing in AWS cloudtrail fileset. 33143

  • Fix input metrics not being unregistered when an input closes. This led to panics when configuration was reloaded for the aws-s3, aws-cloudwatch, and lumberjack inputs. 33259

Auditbeat

Filebeat

  • Add handling of AAA operations for Cisco ASA module. 32257 32789

  • Fix gc.log always shipped even if gc fileset is disabled 30995

  • Fix handling of empty array in httpjson input. 32001

Heartbeat - Fix bug affecting let’s encrypt and other users of cross-signed certs, where cert expiration was incorrectly calculated. 33215 - Fix broken disable feature for kibana configured monitors. 33293

Metricbeat

  • Fix GCP storage field naming 32806

  • in module/windows/perfmon, changed collection method of the second counter value required to create a displayable value 32305

  • Fix and improve AWS metric period calculation to avoid zero-length intervals 32724

  • Add missing cluster metadata to k8s module metricsets 32979 33032

  • Change max query size for GetMetricData API to 500 and add RecentlyActive for ListMetrics API call 33105

  • Add GCP CloudSQL region filter 32943

  • Fix logstash cgroup mappings 33131

  • Remove unused elasticsearch.node_stats.indices.bulk.avg_time.bytes mapping 33263

Packetbeat

  • Fix formatting of debug logs. 32698

  • Fix rendering of MAC addresses to conform to ECS. 32621 32622

Winlogbeat

  • Powershell: Fix processing of parameter details. 31833

  • Security: Fix processing of sidlist, access list and access mask. 31833

  • Fix fatal invalid memory write on Windows 11. 32469 32519

  • Fix handling of event formatting when no metadata is available on Windows 11. 32468 32519

  • Reduce severity of message salvage failure logging. 32697

Functionbeat

Elastic Logging Plugin

Added

Affecting all Beats

  • Beats will now attempt to recover if a lockfile has not been removed 33169

Auditbeat

Filebeat

  • httpjson input: Add toJSON helper function to template context. 32472

  • Optimize grok patterns in system.auth module pipeline. 32360

  • Checkpoint module: add authentication operation outcome enrichment. 32230 32431

  • add documentation for decode_xml_wineventlog processor field mappings. 32456

  • httpjson input: Add request tracing logger. 32402 32412

  • Add cloudflare R2 to provider list in AWS S3 input. 32620

  • Add support for single string containing multiple relation-types in getRFC5988Link. 32811

Auditbeat

Filebeat

Heartbeat - Add new states field for internal use by new synthetics app. 30632

Metricbeat

Packetbeat

  • Add option to allow sniffer to change device when default route changes. 31905 32681

  • Add option to allow sniffing multiple interface devices. 31905 32933

  • Bump Windows Npcap version to v1.71. 33164 33172

Functionbeat

Winlogbeat

Elastic Log Driver

Deprecated

Affecting all Beats

Filebeat

Heartbeat

Metricbeat

Packetbeat

Winlogbeat

Functionbeat

Known Issue