Breaking changes in 8.0
editBreaking changes in 8.0
editSee the release notes for a complete list of breaking changes, bug fixes, and enhancements, including changes to beta or experimental functionality.
Beats logs are now ECS-compliant
editAll Elastic Beats now write ECS-compliant logs in JSON format, and the config
options for enabling ECS/JSON are removed. The new log name format is
{beatname}-{date}(-n)?.ndjson
. For example (from oldest to newest):
filebeat-20200101.ndjson
, filebeat-20200101-1.ndjson
,
filebeat-20200101-2.ndjson
, and so on.
With this change, we now provide a uniform logging scheme across Elastic products, which makes it easier to develop ECS-aware visualizations for behaviors like correlating metrics or events across products.
If you have any monitoring configurations that expect the old log format, you must update them to use the new log format.
Beats now store events in data streams instead of indices
editAll Beats shippers now store events in data streams in Elasticsearch instead of indices
regardless of the Elasticsearch version. This change affects the underlying data storage
method used in Elasticsearch; it does not change the naming convention. The name of the
data stream follows the format {beatname}-{version}
, and the index pattern is
{beatname}-{version}
. Do not confuse this change with the naming convention we
use in Elastic integrations.
As part of this change, some index lifecycle managment (ILM) options
(rollover_alias
and pattern
) are removed because data streams do not
require index aliases. Also the setup.template.type
option is removed because
it no longer makes sense.
If you are loading JSON index templates by specifying a file in
setup.template.json.path
, make sure you move from the legacy format to
composable index templates.
Data streams support create operations only. Thus, there is no way to use operation types like "index" or "delete" when sending events to Elasticsearch.
For more information, refer to the Elasticsearch documentation about data streams.
Homebrew formulae no longer available for Beats
editStarting with version 8.0.0, Elastic no longer publishes Homebrew formulae for Beats. You must use a different installation method. See the Beats download pages for available installation methods.
Removal of older platforms from Beats support matrix
editStarting with version 8.0.0, the following operating systems are no longer supported by Beats due to lack of vendor support for the operating system. In order to have the best product experience, you are encouraged to move to a vendor-supported version of the operating system.
These platforms are:
- Centos 6
- Centos 8
- RHEL 6
- Ubuntu 14.04
- Ubuntu 16.04
- Debian 8
- Windows 7 SP1
- Windows Server 2008 R2
- MacOS 10.13
- MacOS 10.14
Filebeat filesets are disabled by default
editPrior to version 8.0.0, modules had some filesets that were enabled by default.
This meant that in some cases you could enable a module from the command line
and run it without modifying the configuration in the modules.d
directory.
However this caused problems for some users.
Starting in version 8.0.0, filesets are disabled by default. You must explicitly enable the filesets you want Filebeat to use.