IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Beats version 7.0.0-rc1
editBeats version 7.0.0-rc1
editBreaking changes
editAffecting all Beats
- On Google Cloud Engine (GCE) the add_cloud_metadata will now trim the project info from the cloud.machine.type and cloud.availability_zone. 10968
-
Add
cleanup_timeout
option to docker autodiscover, to wait some time before removing configurations after a container is stopped. 10374 10905 -
Empty
meta.json
file will be treated as a missing meta file. 8558 -
Rename
migration.enabled
config tomigration.6_to_7.enabled
. 11284 -
Initialize the Paths before the keystore and save the keystore into
data/{beatname}.keystore
. 10706 - Beats Xpack now checks for Basic license on connect. 11296
Auditbeat
- Process dataset: Only report processes with executable. 11232
Filebeat
Metricbeat
- Migrate docker module to ECS. 10927
Functionbeat
- Correctly extract Kinesis Data field from the Kinesis Record. 11141
Bugfixes
editAffecting all Beats
- Reconnections of Kubernetes watchers are now logged at debug level when they are harmless. 10988
- Add missing host.* fields to fields.yml. 11016
- Include ip and boolean type when generating index pattern. 10995
- Using an environment variable for the password when enrolling a beat will now raise an error if the variable doesn’t exist. 10936
- Cancelling enrollment of a beat will not enroll the beat. 10150
- Allow to configure Kafka fetching strategy for the topic metadata. 10682
Auditbeat
Filebeat
- Fix errors in filebeat Zeek dashboard and README files. Add notice.log support. 10916
- Fix a bug when converting NetFlow fields to snake_case. 10950
- Add on_failure handler for Zeek ingest pipelines. Fix one field name error for notice and add an additional test case. 11004 11105
- Fix issue preventing docker container events to be stored if the container has a network interface without ip address. 11225 11247
- Change URLPATH grok pattern to support brackets. 11135 11252
- Add support for iis log with different address format. 11255 11256
Heartbeat
- Fix checks for TCP send/receive data 11118
Metricbeat
- Migrate docker autodiscover to ECS. 10757 10862
- Fix issue in kubernetes module preventing usage percentages to be properly calculated. 10946
- Fix for not reusable http client leading to connection leaks in Jolokia module 11014
- Fix parsing error using GET in Jolokia module. 11075 11071
- Collect metrics when EC2 instances are not in running state. 11008 11023
- Change ECS field cloud.provider to aws. 11023
- Add documentation about jolokia autodiscover fields. 10925 10979
- Add missing aws.ec2.instance.state.name into fields.yml. 11219 11221
- Fix ec2 metricset to collect metrics from Cloudwatch with the same timestamp. 11142
- Fix potential memory leak in stopped docker metricsets 11294
Packetbeat
- Avoid reporting unknown MongoDB opcodes more than once. 10878
Winlogbeat
Functionbeat
Added
editAffecting all Beats
- Add ip fields to default_field in Elasticsearch template. 11035
Auditbeat
- Move System module to beta. 10800
Filebeat
Metricbeat
- Add filters and pie chart for AWS EC2 dashboard. 10596
Known Issue
editJournalbeat
- Journalbeat requires at least systemd v233 in order to follow entries after journal changes (rotation, vacuum).