Beats version 6.3.1

edit

View commits

Bugfixes

edit

Affecting all Beats

  • Allow index-pattern only setup when setup.dashboards.only_index=true. 7285
  • Preserve the event when source matching fails in add_docker_metadata. 7133
  • Negotiate Docker API version from our client instead of using a hardcoded one. 7165
  • Fix duplicating dynamic_fields in template when overwriting the template. 7352

Auditbeat

  • Fixed parsing of AppArmor audit messages. 6978

Filebeat

  • Comply with PostgreSQL database name format 7198
  • Optimize PostgreSQL ingest pipeline to use anchored regexp and merge multiple regexp into a single expression. 7269
  • Keep different registry entry per container stream to avoid wrong offsets. 7281
  • Fix offset field pointing at end of a line. 6514
  • Commit registry writes to stable storage to avoid corrupt registry files. 6792

Metricbeat

  • Fix field mapping for the system process CPU ticks fields. 7230
  • Ensure canonical naming for JMX beans is disabled in Jolokia module. 7047
  • Fix Jolokia attribute mapping when using wildcards and MBean names with multiple properties. 7321

Packetbeat

  • Fix an out of bounds access in HTTP parser caused by malformed request. 6997
  • Fix missing type for http.response.body field. 7169

Added

edit

Auditbeat

  • Added caching of UID and GID values to auditd module. 6978
  • Updated syscall tables for Linux 4.16. 6978
  • Added better error messages for when the auditd module fails due to the Linux kernel not supporting auditing (CONFIG_AUDIT=n). 7012

Metricbeat

  • Collect accumulated docker network metrics and mark old ones as deprecated. 7253