Beats version 6.0.0-alpha1

edit

View commits

Breaking changes

edit

Affecting all Beats

  • Introduce beat version in the Elasticsearch index and mapping template 3527
  • Usage of field _type is now ignored and hardcoded to doc. 3757
  • Change vendor manager from glide to govendor. 3851
  • Rename error field to error.message. 3987
  • Change dashboards.* config options to setup.dashboards.*. 3921
  • Change outputs.elasticsearch.template.* to `setup.template.* 4080

Filebeat

  • Remove code to convert states from 1.x. 3767
  • Remove deprecated config options force_close_files and close_older. 3768
  • Change clean_removed behaviour to also remove states for files which cannot be found anymore under the same name. 3827
  • Remove document_type config option. Use fields instead. 4204
  • Move json_error under error.message and error.key. 4167

Packetbeat

  • Remove deprecated geoip. 3766
  • Replace waitstop command line argument by shutdown_timeout in configuration file. 3588

Winlogbeat

  • Remove metrics endpoint. Replaced by http endpoint in libbeat (see #3717). 3901

Bugfixes

edit

Affecting all Beats

  • Add _id, _type, _index and _score fields in the generated index pattern. 3282

Filebeat

  • Fix the Mysql slowlog parsing of IP addresses. 4183
  • Fix issue that new prospector was not reloaded on conflict 4128

Heartbeat

  • Use IP type of elasticsearch for ip field. 3926

Metricbeat

  • Support common.Time in mapstriface.toTime() 3812
  • Fix MongoDB dbstats fields mapping. 4025
  • Fixing prometheus collector to aggregate metrics based on metric family. 4075
  • Fixing multiEventFetch error reporting when no events are returned 4153

Added

edit

Affecting all Beats

  • Initialize a beats UUID from file on startup. 3615
  • Add new add_locale processor to export the local timezone with an event. 3902
  • Add http endpoint. 3717
  • Updated to Go 1.8.1. 4033
  • Add kubernetes processor 3888
  • Add support for include_labels and include_annotations in kubernetes processor 4043
  • Support new index_patterns field when loading templates for Elasticsearch >= 6.0 4056
  • Adding goimports support to make check and fmt 4114
  • Make kubernetes indexers/matchers pluggable 4151
  • Abstracting pod interface in kubernetes plugin to enable easier vendoring 4152

Filebeat

  • Restructure input.Event to be inline with outputs.Data 3823
  • Add base for supporting prospector level processors 3853
  • Add filebeat.config.path as replacement for config_dir. 4051
  • Add a recursive_glob.enabled setting to expand ** in patterns. 3980
  • Add Icinga module. 3904
  • Add ability to parse nginx logs exposing the X-Forwarded-For header instead of the remote address.

Heartbeat

  • Event format and field naming changes in Heartbeat and sample Dashboard. 4091

Metricbeat

  • Add experimental metricset perfmon to Windows module. 3758
  • Add memcached module with stats metricset. 3693
  • Add the process.cmdline.cache.enabled config option to the System Process Metricset. 3891
  • Add new MetricSet interfaces for developers (Closer, ReportingFetcher, and PushMetricSet). 3908
  • Add kubelet module 3916
  • Add dropwizard module 4022
  • Adding query APIs for metricsets and modules from metricbeat registry 4102
  • Fixing nil pointer on prometheus collector when http response is nil 4119
  • Add http module with json metricset. 4092
  • Add the option to the system module to include only the first top N processes by CPU and memory. 4127.
  • Add experimental Vsphere module. 4028
  • Add experimental Elasticsearch module. 3903
  • Add experimental Kibana module. 3895
  • Move elasticsearch metricset node_stats under node.stats namespace. 4142
  • Make IP port indexer constructor public 4434

Packetbeat

  • Add fields and fields_under_root to Packetbeat protocols configurations. 3518
  • Add list style Packetbeat protocols configurations. This change supports specifying multiple configurations of the same protocol analyzer. 3518

Winlogbeat

Deprecated

edit

Affecting all Beats

  • Usage of field _type is deprecated. It should not be used in queries or dashboards. 3409

Packetbeat

  • Deprecate dictionary style protocols configuration. 3518

Winlogbeat

Known Issue

edit

Filebeat

  • Prospector reloading only works properly with new files. 3546