Beats version 5.3.0

edit

View commits

Breaking changes

edit

Affecting all Beats

  • Configuration files must be owned by the user running the Beat or by root, and they must not be writable by others. 3544 3689
  • Change Beat generator. Use $GOPATH/src/github.com/elastic/beats/script/generate.py to generate a beat. 3452

Filebeat

  • Always use absolute path for event and registry. This can lead to issues when relative paths were used before. 3328

Metricbeat

  • Linux cgroup metrics are now enabled by default for the system process metricset. The configuration option for the feature was renamed from cgroups to process.cgroups.enabled. 3519
  • Change field names couchbase.node.couch.*.actual_disk_size.* to couchbase.node.couch.*.disk_size.* 3545

Bugfixes

edit

Affecting all Beats

  • Add _id, _type, _index and _score fields in the generated index pattern. 3282
  • Fix potential elasticsearch output URL parsing error if protocol scheme is missing. 3671
  • Improve error message when downloading the dashboards fails. 3805
  • Downgrade Elasticsearch per batch item failure log to debug level. 3953
  • Fix panic due to race condition in kafka output. 4098

Filebeat - Always use absolute path for event and registry. 3328 - Raise an exception in case there is a syntax error in one of the configuration files available under filebeat.config_dir. 3573 - Fix empty registry file on machine crash. 3537

Metricbeat

  • Add error handling to system process metricset for when Linux cgroups are missing from the kernel. 3692
  • Add labels to the Docker healthcheck metricset output. 3707
  • Make system process metricset honor the cpu_ticks config option. 3590
  • Support common.Time in mapstriface.toTime() 3812
  • Fixing panic on prometheus collector when label has , 3947
  • Fix MongoDB dbstats fields mapping. 4025

Packetbeat

Winlogbeat

  • Fix handling of empty strings in event_data. 3705

Added

edit

Affecting all Beats

  • Files created by Beats (logs, registry, file output) will have 0600 permissions. 3387.
  • RPM/deb packages will now install the config file with 0600 permissions. 3382
  • Add the option to pass custom HTTP headers to the Elasticsearch output. 3400
  • Unify regexp and contains conditionals, for both to support array of strings and convert numbers to strings if required. 3469
  • Add the option to load the sample dashboards during the Beat startup phase. 3506
  • Disabled date detection in Elasticsearch index templates. Date fields must be explicitly defined in index templates. 3528
  • Using environment variables in the configuration file is now GA, instead of experimental. 3525

Filebeat

  • Add Filebeat modules for system, apache2, mysql, and nginx. 3159
  • Add the pipeline config option at the prospector level, for configuring the Ingest Node pipeline ID. 3433
  • Update regular expressions used for matching file names or lines (multiline, include/exclude functionality) to new matchers improving performance of simple string matches. 3469
  • The symlinks and harverster_limit settings are now GA, instead of experimental. 3525
  • close_timeout is also applied when the output is blocking. 3511
  • Improve handling of different path variants on Windows. 3781

Metricbeat

  • Add experimental dbstats metricset to MongoDB module. 3228
  • Use persistent, direct connections to the configured nodes for MongoDB module. 3228
  • Add dynamic configuration reloading for modules. 3281
  • Add docker health metricset 3357
  • Add docker image metricset 3467
  • System module uses new matchers for white-listing processes. 3469
  • Add Beta CEPH module with health metricset. 3311
  • Add Beta php_fpm module with pool metricset. 3415
  • The Docker, Kafka, and Prometheus modules are now Beta, instead of experimental. 3525
  • The HAProxy module is now GA, instead of experimental. 3525
  • Add the ability to collect the environment variables from system processes. 3337

Deprecated

edit

Affecting all Beats

  • Usage of field _type is deprecated. It should not be used in queries or dashboards. 3409

Filebeat

  • The experimental publish_async option is now deprecated and is planned to be removed in 6.0. 3525