IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Beats version 5.0.0-alpha1
editBeats version 5.0.0-alpha1
editBreaking changes
editlibbeat
Packetbeat
-
Rename output fields in the dns package. Former flag
recursion_allowed
becomesrecursion_available
. 803 Former SOA fieldttl
becomesminimum
. 803 - The fully qualified domain names which are part of output fields values of the dns package now terminate with a dot. 803
- Remove the count field from the exported event 1210
Topbeat
Filebeat
Winlogbeat
Bugfixes
editAffecting all Beats
- Logstash output will not retry events that are not JSON-encodable 927
Packetbeat
Topbeat
-
Fix issue with
cpu.system_p
being greater than 1 on Windows 1128
Filebeat
Winlogbeat
Added
editAffecting all Beats
- Update builds to Golang version 1.6
- Add option to Elasticsearch output to pass http parameters in index operations 805
- Improve Logstash and Elasticsearch backoff behavior. 927
- Add experimental Kafka output. 942
- Add config file option to configure GOMAXPROCS. 969
- Improve shutdown handling in libbeat. 1075
-
Add
fields
andfields_under_root
options under theshipper
configuration 1092 - Add the ability to use a SOCKS5 proxy with the Logstash output 823
-
The
-configtest
flag will now print "Config OK" to stdout on success 1249
Packetbeat
Topbeat
-
Add
username
to processes 845
Filebeat
Winlogbeat
- Add caching of event metadata handles and the system render context for the wineventlog API 888
- Improve config validation by checking for unknown top-level YAML keys. 1100
- Add the ability to set tags, fields, and fields_under_root as options for each event log 1092
-
Add additional data to the events published by Winlogbeat. The new fields are
activity_id
,event_data
,keywords
,opcode
,process_id
,provider_guid
,related_activity_id
,task
,thread_id
,user_data
, andversion
. 1053 -
Add
event_id
,level
, andprovider
configuration options for filtering events 1218 -
Add
include_xml
configuration option for including the raw XML with the event 1218
Known issues
edit- All Beats can hang or panic on shutdown if the next server in the pipeline (e.g. Elasticsearch or Logstash) is not reachable. 1319
- When running the Beats as a service on Windows, you need to manually load the Elasticsearch mapping template. 1315
- The ES template automatic load doesn’t work if Elasticsearch is not available when the Beat is starting. 1321