IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Beats version 6.0.0
editBeats version 6.0.0
editThe list below covers the changes during the 6.0.0-alpha1, -alpha2, -beta1, -beta2, -rc1 and -rc2 releases.
Also read Breaking changes for more detail about changes that affect upgrade.
Breaking changes
editAffecting all Beats
-
The log directory (
path.log
) for Windows services is now set toC:\ProgramData\[beatname]\logs
. 4764 - The _all field is disabled in Elasticsearch 6.0. This means that searching by individual words only work on text fields. 4901
- Fail if removed setting output.X.flush_interval is explicitly configured.
-
Rename the
/usr/bin/beatname.sh
script (e.g.metricbeat.sh
) to/usr/bin/beatname
. 4933 - Beat does not start if elasticsearch index pattern was modified but not the template name and pattern. 4769
- Fail if removed setting output.X.flush_interval is explicitly configured. 4880
-
Rename
kubernetes
processor toadd_kubernetes_metadata
. 4473 -
Rename
*.full.yml
config files to*.reference.yml
. 4563 -
The
scripts/import_dashboards
is removed from packages. Use thesetup
command instead. 4586 - Change format of the saved kibana dashboards to have a single JSON file for each dashboard 4413
-
Rename
configtest
command totest config
. 4590 -
Remove setting
queue_size
andbulk_queue_size
. 4650 -
Remove setting
dashboard.snapshot
anddashboard.snapshot_url
. They are no longer needed because the dashboards are included in the packages by default. 4675 - Beats can no longer be launched from Windows Explorer (GUI), command line is required. 4420
Filebeat
Metricbeat
-
Change all
system.cpu.*.pct
metrics to be scaled by the number of CPU cores. This will make the CPU usage percentages from the system cpu metricset consistent with the system process metricset. The documentation for these metrics already stated that on multi-core systems the percentages could be greater than 100%. 4544 - Remove filters setting from metricbeat modules. 4699
-
Added
type
field to filesystem metrics. 4717
Heartbeat
-
Renamed the heartbeat RPM/DEB name to
heartbeat-elastic
. 4601
Packetbeat
Auditbeat
-
Changed file metricset config to make
file.paths
a list instead of a dictionary. 4796
Bugfixes
editAffecting all Beats
- Fix data race accessing watched containers. 5147
- Do not require template if index change and template disabled 5319
- Fix missing ACK in redis output. 5404
-
Fix the
/usr/bin/beatname
script to accept-d "*"
as a parameter. 5040 -
Combine
fields.yml
properties when they are defined in different sources. 5075 - Keep Docker & Kubernetes pod metadata after container dies while they are needed by processors. 5084
-
Fix
fields.yml
lookup when usingexport template
with a custompath.config
param. 5089 - Remove runner creation from every reload check 5141
- Fix add_kubernetes_metadata matcher registry lookup. 5159
-
Register kubernetes
field_format
matcher and remove logger inEncode
API 4888 - Fix go plugins not loaded when beat starts 4799
-
Add support for
initContainers
inadd_kubernetes_metadata
processor. 4825 - Eliminate deprecated default mapping in 6.x 4864
- Fix pod name indexer to use both namespace, pod name to frame index key 4775
- Don’t stop with error loading the ES template if the ES output is not enabled. 4436
- Fix race condition in internal logging rotator. 4519
- Normalize all times to UTC to ensure proper index naming. 4569
- Fix issue with loading dashboards to ES 6.0 when .kibana index did not already exist. 4659
- Fix importing the dashboards when the limit for max open files is too low. 4244
- Fix configuration documentation for kubernetes processor 4313
-
Fix misspelling in
add_locale
configuration option for abbreviation.
Filebeat
- Fix machine learning jobs setup for dynamic modules. 5509
- Fix default paths for redis 4.0.1 logs on macOS 5173
- Fix Filebeat not starting if command line and modules configs are used together. 5376
-
Fix double
@timestamp
field when JSON decoding was used. 5436 -
Fix issue where the
fileset.module
could have the wrong value. 4761 - Fix race condition on harvester stopping with reloading enabled. 3779
- Fix recursive glob config parsing and resolution across restarts. 4269
- Allow string characters in user agent patch version (NGINX and Apache) 4415
- Fix grok pattern in filebeat module system/auth without hostname. 4224
Winlogbeat
- Removed validation of top-level config keys. This behavior was inconsistent with other Beats and caused maintainability issues. 4657
Metricbeat
-
Use
beat.name
instead ofbeat.hostname
in the Host Overview dashboard. 5340 - Fix the loading of 5.x dashboards. 5277
- Fix a memory allocation issue where more memory was allocated than needed in the windows-perfmon metricset. 5035
- Don’t start metricbeat if external modules config is wrong and reload is disabled 5053
- The MongoDB module now connects on each fetch, to avoid stopping the whole Metricbeat instance if MongoDB is not up when starting. 5120
- Fix kubernetes events module to be able to index time fields properly. 5093
-
Fixed
cmd_set
andcmd_get
being mixed in the Memcache module. 5189 -
Added missing mongodb configuration file to the
modules.d
folder. 4870 - Fix wrong MySQL CRUD queries timelion visualization 4857
- Add new metrics to CPU metricset 4969
- Fix issue affecting Windows services timing out at startup. 4491
- Fix incorrect docker.diskio.total metric calculation. 4507
- Vsphere module: used memory field corrected. 4461
- Set correct format for percent fields in memory module. 4619
- Fix a debug statement that said a module wrapper had stopped when it hadn’t. 4264
- Use MemAvailable value from /proc/meminfo on Linux 3.14. 4316
- Fix panic when events were dropped by filters. 4327
- Add filtering to system filesystem metricset to remove relative mountpoints like those from Linux network namespaces. 4370
- Remove unnecessary print statement in schema apis. 4355
-
Fix type of field
haproxy.stat.check.health.last
. 4407
Heartbeat
Packetbeat
- Fix missing length check in the PostgreSQL module. 5457
- Fix panic in ACK handler if event is dropped on blocked queue 5524
- Update flow timestamp on each packet being received. 4895
- Enabled /proc/net/tcp6 scanning and fixed ip v6 parsing. 4442
- Enable memcache filtering only if a port is specified in the config file. 4335
Auditbeat
-
Fix
file.max_file_size
config option for the audit file metricset. 4796
Added
editAffecting all Beats
- Enable flush timeout by default. 5150
- Add @metadata.version to events send to Logstash. 5166
- Add setting to enable/disable the slow start in logstash output. 4972
-
Update init scripts to use the
test config
subcommand instead of the deprecated-configtest
flag. 4600 - Get by default the credentials for connecting to Kibana from the Elasticsearch output configuration. 4867
-
Added
cloud.id
andcloud.auth
settings, for simplifying using Beats with the Elastic Cloud. 4959 - Add lz4 compression support to kafka output. 4977
- Add newer kafka versions to kafka output. 4977
- Configure the index name when loading the dashboards and the index pattern. 4949
- New cli subcommands interface. 4420
-
Allow source path matching in
add_docker_metadata
processor. 4495 - Add support for analyzers and multifields in fields.yml. 4574
- Add support for JSON logging. 4523
-
Add
test output
command, to test Elasticsearch and Logstash output settings. 4590 - Introduce configurable event queue settings: queue.mem.events, queue.mem.flush.min_events and queue.mem.flush.timeout. 4650
- Enable pipelining in Logstash output by default. 4650
- Added result field to Elasticsearch QueryResult struct for compatibility with 6.x Index and Delete API responses. {issue]4661[4661]
- The sample dashboards are now included in the Beats packages. 4675
-
Add
pattern
option to be used in the fields.yml to specify the pattern for a number field. 4731 - Upgraded to Golang 1.8.3. 4401
- Added the possibility to set Elasticsearch mapping template settings from the Beat configuration file. 4284 4317
- Add a variable to the SysV init scripts to make it easier to change the user. 4340
- Add the option to write the generated Elasticsearch mapping template into a file. 4323
-
Add
instance_name
in GCE add_cloud_metadata processor. 4414 -
Add
add_docker_metadata
processor. 4352 -
Add
logging.files
permissions
option. 4295
Filebeat
- Add Kubernetes manifests to deploy Filebeat. 5349
- Changed the number of shards in the default configuration to 3. 5095
- Don’t start filebeat if external modules/prospectors config is wrong and reload is disabled 5053
-
Add
filebeat.registry_flush
setting, to delay the registry updates. 5146 - Add experimental Redis module. 4441
- Nginx module: use the first not-private IP address as the remote_ip. 4417
- Load Ingest Node pipelines when the Elasticsearch connection is established, instead of only once at startup. 4479
- Add support for loading Xpack Machine Learning configurations from the modules, and added sample configurations for the Nginx module. 4506 4609
- Add udp prospector type. 4452
- Enabled Cgo which means libc is dynamically compiled. 4546
- Add Beta module config reloading mechanism 4566
- Remove spooler and publisher components and settings. 4644
- Added ability to sort harvested files. 4374
- Add experimental Redis slow log prospector type. 4180
Winlogbeat
Metricbeat
- Add Kubernetes manifests to deploy Metricbeat. 5349
- Auto-select a hostname (based on the host on which the Beat is running) in the Host Overview dashboard. 5340
-
Add
filesystem.ignore_types
to system module for ignoring filesystem types. 4685 - Add support to exclude labels from kubernetes pod metadata. 4757
- Add random startup delay to each metricset to avoid the thundering herd problem. 4010
- Add the ability to configure audit rules to the kernel module. 4482
- Add the ability to configure kernel’s audit failure mode. 4516
- Add experimental Aerospike module. 4560
- Vsphere module: collect custom fields from virtual machines. 4464
-
Add
test modules
command, to test modules expected output. 4656 -
Add
processors
setting to metricbeat modules. 4699 -
Support
npipe
protocol (Windows) in Docker module. 4751 - Add macOS implementation of the system diskio metricset. 4144
- Add process_summary metricset that records high level metrics about processes. 4231
-
Add
kube-state-metrics
based metrics tokubernetes
module 4253 - Add debug logging to Jolokia JMX metricset. 4341
- Add events metricset for kubernetes metricbeat module 4315
- Change Metricbeat default configuration file to be better optimized for most users. 4329
- Add experimental RabbitMQ module. 4394
- Add Kibana dashboard for the Kubernetes modules. 4138
Heartbeat
Packetbeat
- Changed the number of shards in the default configuration to 3. 5095
Auditbeat
- Changed the number of shards in the default configuration to 3. 5095
- Add support for receiving audit events using a multicast socket. 4850
-
Added
file.hash_types
config option for controlling the hash types. 4796 -
Added the ability to specify byte unit suffixes to
file.max_file_size
. 4796 - Add file integrity metricset to the audit module. 4486