IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Beats version 7.4.0
editBeats version 7.4.0
editBreaking changes
editAffecting all Beats
Auditbeat
- Socket dataset: New implementation using Kprobes for finer-grained monitoring and UDP support. 13058
Filebeat
Metricbeat
- Add new Dashboard for PostgreSQL database stats 13187
- Add new dashboard for CouchDB database 13198
- Add new dashboard for Ceph cluster stats 13216
- Add new dashboard for Aerospike database stats 13217
- Add new dashboard for Couchbase cluster stats 13212
- Add new dashboard for Prometheus server stats 13126
- Add statistic option into cloudwatch metricset. If there is no statistic method specified, default is to collect Average, Sum, Maximum, Minimum and SampleCount. 12370 12840
- Fix rds metricset dashboard. 13721
Functionbeat
- Separate management and functions in Functionbeat. 12939
Bugfixes
editAffecting all Beats
- ILM: Use GET instead of HEAD when checking for alias to expose detailed error message. 12886
-
Fix unexpected stops on docker autodiscover when a container is restarted before
cleanup_timeout
. 12962 13127 - Fix some incorrect types and formats in field.yml files. 13188
- Load DLLs only from Windows system directory. 13234 13384
- Fix mapping for kubernetes.labels and kubernetes.annotations in add_kubernetes_metadata. 12638 13226
- Fix case insensitive regular expressions not working correctly. 13250
Auditbeat
- Host dataset: Export Host fields to gob encoder. 12940
Filebeat
- Fix filebeat autodiscover fileset hint for container input. 13296
- Fix incorrect references to index patterns in AWS and CoreDNS dashboards. 13303
- Fix timezone parsing of system module ingest pipelines. 13308
- Fix timezone parsing of elasticsearch module ingest pipelines. 13367
- Change iis url path grok pattern from URIPATH to NOTSPACE. 12710 13225 7951 13378
- Add timezone information to apache error fileset. 12772 13304
- Fix timezone parsing of nginx module ingest pipelines. 13369
- Allow path variables to be used in files loaded from modules.d. 13184
- Fix incorrect field references in envoyproxy dashboard 13420 13421
Heartbeat
- Fix integer comparison on JSON responses. 13348
Metricbeat
- Ramdisk is not filtered out when collecting disk performance counters in diskio metricset 12814 12829
- Fix redis key metricset dashboard references to index pattern. 13303
- Check if fields in DBInstance is nil in rds metricset. 13294 13037
- Fix silent failures in kafka and prometheus module. 13353 13252
- Fix module-level fields in Kubernetes metricsets. 13433 13544
- Fix panic in Redis Key metricset when collecting information from a removed key. 13426
- In the elasticsearch/node_stats metricset, if xpack is enabled, make parsing of ES node load average optional as ES on Windows doesn’t report load average. 12866
- Print errors that were being omitted in vSphere metricsets. 12816
- Fix issue with aws cloudwatch module where dimensions and/or namespaces that contain space are not being parsed correctly 13389
- Fix reporting empty events in cloudwatch metricset. 13458
- Fix data race affecting config validation at startup. 13005
Packetbeat
- Fix parsing the extended RCODE in the DNS parser. 12805
Functionbeat
Added
editAffecting all Beats
-
Add support for reading the
network.iana_number
field by default to the community_id processor. 12701 - Add a check so alias creation explicitely fails if there is an index with the same name. 13070
- Update kubernetes watcher to use official client-go libraries. 13051
-
Add support for unix epoch time values in the
timestamp
processor. 13319 - add_host_metadata is now GA. 13148
-
Add an
ignore_missing
configuration option thedrop_fields
processor. 13318 -
Add
registered_domain
processor for deriving the registered domain from a given FQDN. 13326 - Add support for RFC3339 time zone offsets in JSON output. 13227
-
Added
monitoring.cluster_uuid
setting to associate Beat data with specified ES cluster in Stack Monitoring UI. 13182
Filebeat
- Add netflow dashboards based on Logstash netflow. 12857
- Parse more fields from Elasticsearch slowlogs. 11939
- Update module pipelines to enrich events with autonomous system fields. 13036
- Add module for ingesting IBM MQ logs. 8782
- Add S3 input to retrieve logs from AWS S3 buckets. 12640 12582
- Add aws module s3access metricset. 13170 12880
- Update Suricata module to populate ECS DNS fields and handle EVE DNS version 2. 13320 13329
- Update PAN-OS fileset to use the ECS NAT fields. 13320 13330
- Add fields to the Zeek DNS fileset for ECS DNS. 13320 13324
- Add container image in Kubernetes metadata 13356 12688
- Add module for ingesting Cisco FTD logs over syslog. 13286
Heartbeat
-
Record HTTP body metadata and optionally contents in
http.response.body.*
fields. 13022
Metricbeat
- Add Kubernetes proxy dashboard to Kubernetes module 12734
- Add Kubernetes controller manager dashboard to Kubernetes module 12744
- Add metrics to kubernetes apiserver metricset. 12922
- Add Kubernetes scheduler dashboard to Kubernetes module 12749
- Collect client provided name for rabbitmq connection. 12851 12852
- Add support to load default aws config file to get credentials. 12727 12708
- Add statistic option into cloudwatch metricset. 12370 12840
- Add support for kubernetes cronjobs 13001
- Add cgroup memory stats to docker/memory metricset 12916
- Add AWS elb metricset. 12952 11701
- Add AWS ebs metricset. 13167 11699
-
Add
metricset.period
field with the configured fetching period. 13242 12616 - Add rate metrics for ec2 metricset. 13203
- Add Performance metricset to Oracle module 12547
- Use DefaultMetaGeneratorConfig in MetadataEnrichers to initialize configurations 13414
- Add module for statsd. 13109
Packetbeat
Functionbeat
Winlogbeat
- Add support for event ID 4634 and 4647 to the Security module. 12906
-
Add
network.community_id
to Sysmon network events (event ID 3). 13034 -
Add
event.module
to Winlogbeat modules. 13047 -
Add
event.category: process
andevent.type: process_start/process_end
to Sysmon process events (event ID 1 and 5). 13047 - Add support for event ID 4672 to the Security module. 12975
- Add support for event ID 22 (DNS query) to the Sysmon module. 12960
- Add support for event ID 4634 and 4647 to the Security module. 12906
-
Add
network.community_id
to Sysmon network events (event ID 3). 13034 -
Add
event.module
to Winlogbeat modules. 13047 -
Add
event.category: process
andevent.type: process_start/process_end
to Sysmon process events (event ID 1 and 5). 13047 - Add support for event ID 4672 to the Security module. 12975
- Add support for event ID 22 (DNS query) to the Sysmon module. 12960
- Add certain winlog.event_data.* fields to the index template. 13700 13704