Beats version 8.4.1

edit

Beats version 8.4.1

edit

View commits

Known Issue

edit

Filebeat

Filebeat agents configured to read from AWS inputs may return an error similar to the following:

sqs ReceiveMessage failed: operation error SQS: ReceiveMessage, https response
error StatusCode: 403, RequestID: cb57783a-505f-5099-9160-23b8eea8ddbb,
api error SignatureDoesNotMatch: Credential should be scoped to a valid region.

This error was introduced by a breaking change in the AWS library.

This issue also affects FIPS-enabled endpoints. If you rely on FIPS, do not upgrade until version 8.4.2 of the Elastic Stack is available. The workaround documented here will not resolve this problem.

Suggested resolution: In the Filebeat configuration, if an AWS input or module configuration sets endpoint to a non empty string, set it to an empty string instead. Also make sure the default AWS region is set in an environment variable, credentials or instance profile, or in the default_region setting in the configuration. For example:

filebeat.inputs:
- type: aws-s3
...
  endpoint: "" 
  default_region: us-east-1

You can set this value to an empty string or remove the configuration setting.

Or for modules:

s3access:
    enabled: false
...
    var.endpoint: "" 
    var.default_region: us-east-1

You can set this value to an empty string or remove the configuration setting

Bugfixes

edit

Auditbeat

Fixes a bug with the auditd module where data is corrupted because it was not copied before the byte slice was reused. 32818 32823

Filebeat

Update cloud.region parsing in cloudtrail fileset. 32763
Fix file.path field in cloudtrail fileset to use json.digestS3Object. 32759
Fix not parsing as json when json and ndjson content types have charset information in aws-s3 input 32767

Added

edit

Filebeat

httpjson input: Add toJSON helper function to template context. 32472

« Beats version 8.4.2 Beats version 8.4.0 »