Beats version 7.3.0

Affecting all Beats

Update to ECS 1.0.1. 12284 12317
Default of output.kafka.metadata.full is set to false by now. This reduced the amount of metadata to be queried from a kafka cluster. 12738

Filebeat

convert_timezone option is removed and locale is always added to the event so timezone is used when parsing the timestamp, this behaviour can be overriden with processors. 12410

Affecting all Beats

Fix typo in TLS renegotiation configuration and setting the option correctly 10871, 12354
Add configurable bulk_flush_frequency in kafka output. 12254
Fixed setting bulk max size in kafka output. 12254
Add additional nil pointer checks to Docker client code to deal with vSphere Integrated Containers 12628
Fix seccomp policy preventing some features to function properly on 32bit Linux systems. 12990 13008

Auditbeat

Package dataset: Close librpm handle. 12215
Package dataset: Improve dpkg parsing. 12325
Host dataset: Fix reboot detection logic. 12591
Add syscalls used by librpm for the system/package dataset to the default Auditbeat seccomp policy. 12578 12617
Host dataset: Export Host fields to gob encoder. 12940

Filebeat

Parse timezone in PostgreSQL logs as part of the timestamp 12338
When TLS is configured for the TCP input and a certificate_authorities is configured we now default to required for the client_authentication. 12584
Syslog input will now omit the process object from events if it is empty. 12700
Apply max_message_size to incoming message buffer. 11966

Heartbeat

Journalbeat

Metricbeat

Refactored Windows perfmon metricset: replaced method to retrieve counter paths with PdhExpandWildCardPathW, separated code by responsibility, removed unused functions 12212
Validate that kibana/status metricset cannot be used when xpack is enabled. 12264
In the kibana/stats metricset, only log error (don’t also index it) if xpack is enabled. 12265
Fix an issue listing all processes when run under Windows as a non-privileged user. 12301 12475
When TLS is configured for the http metricset and a certificate_authorities is configured we now default to required for the client_authentication. 12584
Reuse connections in PostgreSQL metricsets. 12504 12603
PdhExpandWildCardPathW will not expand counter paths in 32 bit windows systems, workaround will use a different function.https://github.com/elastic/beats/issues/12590[12590]12622
Print errors that were being omitted in vSphere metricsets 12816
In the elasticsearch/node_stats metricset, if xpack is enabled, make parsing of ES node load average optional as ES on Windows doesn’t report load average. 12866
Fix incoherent behaviour in redis key metricset when keyspace is specified both in host URL and key pattern 12913
Fix connections leak in redis module 12914 12950

Packetbeat

Affecting all Beats

Add proxy_disable output flag to explicitly ignore proxy environment variables. 11713 12243
Processor add_cloud_metadata adds fields cloud.account.id and cloud.image.id for AWS EC2. 12307
Add decode_base64_field processor for decoding base64 field. 11914
Add aws overview dashboard. 11007 12175
Add decompress_gzip_field processor. 12733
Add timestamp processor for parsing time fields. 12699
Add Oracle Tablespaces Dashboard 12736
Add proxy_disable output flag to explicitly ignore proxy environment variables. 11713 12243

Auditbeat

Filebeat

Add timeouts on communication with docker daemon. 12310
Add specific date processor to convert timezones so same pipeline can be used when convert_timezone is enabled or disabled. 12253
Add MSSQL module 12079
Add ISO8601 date parsing support for system module. 12568 12579
Update Kubernetes deployment manifest to use container input. 12632
Add google-pubsub input type for consuming messages from a Google Cloud Pub/Sub topic subscription. 12746
Add module for ingesting Cisco IOS logs over syslog. 12748
Add module for ingesting Google Cloud VPC flow logs. 12747
Report host metadata for Filebeat logs in Kubernetes. 12790

Metricbeat

Add overview dashboard to Consul module 10665
New fields were added in the mysql/status metricset. 12227
Add Kubernetes metricset proxy. 12312
Always report Pod UID in the pod metricset. 12345
Add Vsphere Virtual Machine operating system to os field in Vsphere virtualmachine module. 12391
Add CockroachDB module. 12467
Add support for metricbeat modules based on existing modules (a.k.a. light modules) 12270 12465
Add a system/entropy metricset 12450
Add kubernetes metricset controllermanager 12409
Allow redis URL format in redis hosts config. 12408
Add tags into ec2 metricset. 12263 12372
Add kubernetes metricset scheduler 12521
Add Kubernetes scheduler dashboard to Kubernetes module 12749
Add beat module. 12181 12615
Collect tags for cloudwatch metricset in aws module. 12263 12480
Add AWS RDS metricset. 11620 10054
Add Oracle Module 11890
Add Kubernetes proxy dashboard to Kubernetes module 12734
Add Kubernetes controller manager dashboard to Kubernetes module 12744

Functionbeat

Filebeat