Skip to content

Latest commit

 

History

History
198 lines (100 loc) · 5.76 KB

CHANGELOG.next.asciidoc

File metadata and controls

198 lines (100 loc) · 5.76 KB
Raw

Beats version HEAD

Breaking changes

Affecting all Beats

  • Upgrade to Go 1.18. Certificates signed with SHA-1 are now rejected. See the Go 1.18 release notes for details. 32493

    • Fix namespacing on self-monitoring 32336

    • Fix formatting of hardware addresses populated by the add-host-metadata processor. 32264 32265

Auditbeat

Filebeat - [Httpjson]- Fix for pagination at root level not working when used with chaining. - Import dashboard from Fortinet Fortigate firewall integration. 19810 33003

Heartbeat

Metricbeat

Packetbeat

Winlogbeat

Functionbeat

Bugfixes

Affecting all Beats

  • Fix namespacing for agent self-monitoring, CPU no longer reports as zero. 32336

  • Fix namespacing on self-monitoring 32336

  • Expand fields in decode_json_fields if target is set. 31712 32010

  • Fix race condition when stopping runners 32433

  • Fix concurrent map writes when system/process code called from reporter code 32491

  • Fix in AWS related services initialisation relying on custom endpoint resolver. 32888 32921

Auditbeat

  • auditd module: Fix parsing of audit rules where arguments are quoted (like file paths containing spaces). 32421

  • auditd module: Fix minimum AuditStatus length so that library can support kernels from 2.6.32. 32421

  • system/socket: Reduce memory usage of the dataset. 32191 32192

  • Fix rendering of MAC addresses to conform to ECS. 32621 32622

  • Fixes a bug with the auditd module where data is corrupted because it was not copied before the byte slice was reused. 32818 32823

Filebeat

  • Fix counter for number of events published in httpjson input. 31993

  • Fix handling of Checkpoint event for R81. 32380 32458

  • Fix a hang on apt-get update stage in packaging. 32580

  • gcp-pubsub input: Restart Pub/Sub client on all errors. 32550 32712

  • Fix not parsing as json when json and ndjson content types have charset information in aws-s3 input 32767

  • Update cloud.region parsing in cloudtrail fileset. 32763

  • Fix file.path field in cloudtrail fileset to use json.digestS3Object. 32759

  • Fix rendering of MAC addresses to conform to ECS. 32621 32622

  • Import dashboards from CEF integration. 32766

  • Fix how to handle IPv6 addresses in the fileset nginx/ingress_controller for Filebeat. 32989

Auditbeat

Filebeat

  • Add handling of AAA operations for Cisco ASA module. 32257 32789

  • Fix gc.log always shipped even if gc fileset is disabled 30995

Heartbeat

Metricbeat

  • Fix GCP storage field naming 32806

  • in module/windows/perfmon, changed collection method of the second counter value required to create a displayable value 32305

  • Fix and improve AWS metric period calculation to avoid zero-length intervals 32724

  • Add missing cluster metadata to k8s module metricsets 32979 33032

Packetbeat

  • Fix formatting of debug logs. 32698

  • Fix rendering of MAC addresses to conform to ECS. 32621 32622

Winlogbeat

  • Powershell: Fix processing of parameter details. 31833

  • Security: Fix processing of sidlist, access list and access mask. 31833

  • Fix fatal invalid memory write on Windows 11. 32469 32519

  • Fix handling of event formatting when no metadata is available on Windows 11. 32468 32519

  • Reduce severity of message salvage failure logging. 32697

Functionbeat

Elastic Logging Plugin

Added

Affecting all Beats

  • Improve performance of disk queue by coalescing writes. 31935

  • Update elastic/go-structform from v0.0.9 to v0.0.10 to reduce memory usage. 32536

Auditbeat

Filebeat

  • httpjson input: Add toJSON helper function to template context. 32472

  • Optimize grok patterns in system.auth module pipeline. 32360

  • Checkpoint module: add authentication operation outcome enrichment. 32230 32431

  • add documentation for decode_xml_wineventlog processor field mappings. 32456

  • httpjson input: Add request tracing logger. 32402 32412

  • Add cloudflare R2 to provider list in AWS S3 input. 32620

  • Add support for single string containing multiple relation-types in getRFC5988Link. 32811

Auditbeat

Filebeat

Heartbeat - Add new states field for internal use by new synthetics app. 30632

Metricbeat

  • Allow filtering on AWS tags by more than 1 value per key. 32775

  • Azure Billing: switch to Cost Management API for forecast data 32589

Packetbeat

  • Add option to allow sniffer to change device when default route changes. 31905 32681

Functionbeat

Winlogbeat

Elastic Log Driver

Deprecated

Affecting all Beats

Filebeat

Heartbeat

Metricbeat

Packetbeat

Winlogbeat

Functionbeat

Known Issue