IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Beats version 7.9.0
editBeats version 7.9.0
editBreaking changes
editAffecting all Beats
- Ensure dynamic template names are unique for the same field. 18849
Filebeat
-
With the default configuration the cloud modules (AWS, Azure, Googlecloud, o365, Okta)
will no longer send the
host
field that contains information about the host Filebeat is running on. This is because thehost
field specifies the host on which the event happened. 13920 18223 -
With the default configuration the following modules will no longer send the
host
field. You can revert this change by configuring tags for the module and omittingforwarded
from the list.- Cisco 18753
- CrowdStrike 19132
- Fortinet 19133
- Iptables 18756
- Checkpoint 18754
- Netflow 19087
-
Zeek 19113 (
forwarded
tag is not included by default) -
Suricata 19107 (
forwarded
tag is not included by default) -
CoreDNS 19134 (
forwarded
tag is not included by default) -
Envoy Proxy 19134 (
forwarded
tag is not included by default) - CEF module 13920 18223
- Palo Alto Networks module 13920 18223
-
Okta module now requires objects instead of JSON strings for the
http_headers
,http_request_body
,pagination
,rate_limit
, andssl
variables. 18953 - Add oauth support for httpjson input. 18415 18892
-
Add
split_events_by
option to httpjson input. 19246 -
Add
date_cursor
option to httpjson input. 19483 - Add Gsuite module with SAML support. 19329
- Add Gsuite User Accounts support. 19329
- Add Gsuite Login audit support. 19702
- Add Gsuite Admin support. 19769
- Add Gsuite Drive support. 19704
- Add Gsuite Groups support. 19725
Metricbeat
Winlogbeat
Bugfixes
editAffecting all Beats
- Fix potential race condition in fingerprint processor. 18738
- Add better handling for Kubernetes Update and Delete watcher events. 18882
-
Fix config reload metrics (
libbeat.config.module.start/stops/running
). 19168 - Fix metrics hints builder to avoid wrong container metadata usage when port is not exposed. 18979
- Server-side TLS config now validates that certificate and key settings are both specified. 19584
Auditbeat
Filebeat
-
Fix Kubernetes Watcher goroutine leaks when input config is invalid and
input.reload
is enabled. 18629 18630 -
Okta module now sets the Elasticsearch
_id
field to the Okta UUID value contained in each system log to minimize the possibility of duplicating events. 18953 -
Fix
netflow
module to support 7 bytepad for IPFIX template. 18098 - Fix improper nesting of session_issuer object in AWS cloudtrail fileset. 18894 18915
- Fix Cisco ASA 3020** and 106023 messages. 17964
-
Add missing
default_field: false
to AWS filesets fields.yml. 19568 - Fix memory leak in tcp and unix input sources. 19459
- Fix Cisco ASA dissect pattern for 313008 & 313009 messages. 19149
- Fix bug with empty filter values in system/service. 19812
Metricbeat
- Fix incorrect usage of hints builder when exposed port is a substring of the hint. 19052
- Stop counterCache only when already started. 19103
- Remove dedot for tag values in AWS module. 19112 19221
- Fix empty field name errors in the application pool metricset. 19537
- Fix mapping of service start type in the service metricset of the Windows module. 19551
- Fix config example in the perfmon configuration files. 19539
- Fix k8s scheduler compatibility issue. 19699
- Fix SQL module mapping NULL values as string. 18955 18898
Packetbeat
Added
editAffecting all Beats
- Add initial instrument of Beats with APM GO Agent. 17938
-
Add optional regex based cid extractor to
add_kubernetes_metadata
processor. 17360 - Add k8s keystore backend. 18096
- Change ownership of files in docker images so they can be used in secured environments. 12905
- Upgrade k8s.io/client-go and k8s keystore tests. 18817
- Add support for multiple sets of hints on autodiscover. 18883
-
Add a configurable delay between retries when app metadata cannot be retrieved by
add_cloudfoundry_metadata
. 19181 -
Add data type conversion in
dissect
processor for converting string values to other basic data types. 18683 -
Add the
ignore_failure
configuration option to the dissect processor. 19464 -
Add the
overwrite_keys
configuration option to the dissect processor. 19464 - Add support to trim captured values in the dissect processor. 19464
-
Add the
max_cached_sessions
option to the script processor. 19562
Auditbeat
- Add ECS categorization info for Auditd module. 18596
Filebeat
- Add http_endpoint input. 18298
-
Add
observer.vendor
,observer.product
, andobserver.type
to Palo Alto Networks module events. 18223 -
The
logstash
module can now automatically detect the log file format (JSON or plaintext) and process it accordingly. 9964 18095 - Improve ECS categorization field mappings in CoreDNS module. 16159 18424
- Improve ECS categorization field mappings in Envoyproxy module. 16161 18395
- Improve ECS categorization field mappings in Cisco module. 16028 18537
- The s3 input can now automatically detect gzipped objects. 18283 18764
- Add geoip AS lookup and improve ECS categorization in AWS cloudtrail fileset. 18644 18958
- Add support for v1 consumer API in Cloud Foundry input and use it by default. 19125
- Add new mode to multiline reader to aggregate constant number of lines. 18352
- Explicitly set ECS version in all Filebeat modules. 19198
- Add awscloudwatch input. 19025
- Add automatic retries and exponential backoff to httpjson input. 18956
- Change the Palo Alto Networks module to pass through (rather than drop) message types other than threat and traffic. 16815 19375
- Improve ECS categorization field mappings in Traefik module. 16183 19379
- Improve ECS categorization field mappings in Azure module. 16155 19376
- Add automatic retries and exponential backoff to httpjson input. 18956
- Add text and flattened versions of fields with unknown subfields in AWS cloudtrail fileset. 18866 19121
- Add Microsoft Defender ATP Module. 17997 19197
- Add initial support for configurable file identity tracking. 18748
- Add experimental dataset tomcat/log for Apache Tomcat logs. 19713
- Add experimental dataset netscout/sightline for Netscout Arbor Sightline logs. 19713
- Add experimental dataset barracuda/waf for Barracuda Web Application Firewall logs. 19713
- Add experimental dataset f5/bigipapm for F5 Big-IP Access Policy Manager logs. 19713
- Add experimental dataset bluecoat/director for Bluecoat Director logs. 19713
- Add experimental dataset cisco/nexus for Cisco Nexus logs. 19713
- Add experimental dataset citrix/virtualapps for Citrix Virtual Apps logs. 19713
- Add experimental dataset cylance/protect for Cylance Protect logs. 19713
- Add experimental dataset fortinet/clientendpoint for Fortinet FortiClient Endpoint Protection logs. 19713
- Add experimental dataset imperva/securesphere for Imperva Secure Sphere logs. 19713
- Add experimental dataset infoblox/nios for Infoblox Network Identity Operating System logs. 19713
- Add experimental dataset juniper/junos for Juniper Junos OS logs. 19713
- Add experimental dataset kaspersky/av for Kaspersky Anti-Virus logs. 19713
- Add experimental dataset microsoft/dhcp for Microsoft DHCP Server logs. 19713
- Add experimental dataset tenable/nessus_security for Tenable Nessus Security Scanner logs. 19713
- Add experimental dataset rapid7/nexpose for Rapid7 Nexpose logs. 19713
- Add experimental dataset radware/defensepro for Radware DefensePro logs. 19713
- Add experimental dataset sonicwall/firewall for Sonicwall Firewalls logs. 19713
- Add experimental dataset squid/log for Squid Proxy Server logs. 19713
- Add experimental dataset zscaler/zia for Zscaler Internet Access logs. 19713
Heartbeat
- Record HTTP response headers. 18327
Journalbeat
Metricbeat
- Add client address to events from http server module. 18336
- Add new fields to HAProxy module. 18523
- Add Tomcat overview dashboard. 14026
- Accept prefix as metric_types config parameter in googlecloud stackdriver metricset. 19345
- Add dashboards for googlecloud load balancing metricset. 18369
- Add support for v1 consumer API in Cloud Foundry module and use it by default. 19268
- Add support for named ports in autodiscover. 19398
-
Add param
aws_partition
to support aws-cn, aws-us-gov regions. 18850 19423 -
Add support for wildcard
*
in dimension value of AWS CloudWatch metrics config. 18050 19660 -
The
elasticsearch/index
metricset now collects metrics for hidden indices. 18639 18703 -
Added
performance
andquery
metricsets tomysql
module. 18955 -
The
elasticsearch-xpack/index
metricset now reports hidden indices as such. 18639 18706 - Adds support for app insights metrics in the Azure module. 18570 18940
- Added cache and connection_errors metrics to status metricset of MySQL module. 16955 19844
- Update MySQL dashboard with connection errors and cache metrics. 19913 16955
Packetbeat
Functionbeat
-
Add basic ECS categorization and
cloud
fields. 19174
Elastic Log Driver
-
Add support for
docker logs
command. 19531