IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Beats version 7.0.0-alpha1
editBeats version 7.0.0-alpha1
editBreaking changes
editAffecting all Beats
- Dissect syntax change, use * instead of ? when working with field reference. 8054
Auditbeat
Filebeat
-
Rename
fileset.name
toevent.name
. 8879 -
Rename
fileset.module
toevent.module
. 8879 - Rename source to log.file.path and log.source.ip 8902
-
Remove the deprecated
prospector(s)
option in the configuration useinput(s)
instead. 8909 -
Rename
offset
tolog.offset
. 8923 -
Rename
source_ecs
tosource
in the Filebeat Suricata module. 8983
Bugfixes
editAffecting all Beats
Filebeat
Heartbeat
- Heartbeat now always downloads the entire body of HTTP endpoints, even if no checks against the body content are declared. This fixes an issue where timing metrics would be incorrect in scenarios where the body wasn’t used since the connection would be closed soon after the headers were sent, but before the entire body was. 8894
-
Host
header can now be overridden for HTTP requests sent by Heartbeat monitors. 9516
Metricbeat
Packetbeat
- Fixed the mysql missing transactions if monitoring a connection from the start. 8173
Added
editAffecting all Beats
-
Add field
host.os.kernel
to the add_host_metadata processor and to the internal monitoring data. 7807 - Add debug check to logp.Logger 7965
- Count HTTP 429 responses in the elasticsearch output 8056
- Allow Bus to buffer events in case listeners are not configured. 8527
- Dissect will now flag event on parsing error. 8751
- add_cloud_metadata initialization is performed asynchronously to avoid delays on startup. 8845
- Add DeDot method in add_docker_metadata processor in libbeat. 9350 9505
Filebeat
- Make inputsource generic taking bufio.SplitFunc as input 7746
- Add custom unpack to log hints config to avoid env resolution 7710
- Make docker input check if container strings are empty 7960
- Keep unparsed user agent information in user_agent.original. 8537
- Allow to force CRI format parsing for better performance 8424
Heartbeat
- Add automatic config file reloading. 8023
Journalbeat
- Add the ability to check against JSON HTTP bodies with conditions. 8667
Metricbeat
- Add metrics about cache size to memcached module 7740
- Add experimental socket summary metricset to system module 6782
-
Collect custom cluster
display_name
inelasticsearch/cluster_stats
metricset. 8445 - Test etcd module with etcd 3.3. 9068
-
All
elasticsearch
metricsets now have module-levelcluster.id
andcluster.name
fields. 8770 8771 9164 9165 9166 9168 -
All
elasticsearch
node-level metricsets now havenode.id
andnode.name
fields. 9168 9209
Packetbeat