This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.
« Beats version 7.2.1 Beats version 7.1.1 »
Elastic Docs ›Beats Platform Reference [8.16] ›Release notes

Beats version 7.2.0

edit

Beats version 7.2.0

edit

View commits

Breaking changes

edit

Affecting all Beats

  • Update to Golang 1.12.4. 11782

Auditbeat

  • Auditd module: Normalized value of event.category field from user-login to authentication. 11432
  • Auditd module: Unset auditd.session and user.audit.id fields are removed from audit events. 11431 11815
  • Socket dataset: Exclude localhost by default 11993

Filebeat

  • Add read_buffer configuration option. 11739

Heartbeat

  • Removed the add_host_metadata and add_cloud_metadata processors from the default config. These don’t fit well with ECS for Heartbeat and were rarely used.

Journalbeat

Metricbeat

  • Add new option OpMultiplyBuckets to scale histogram buckets to avoid decimal points in final events 10994
  • system/raid metricset now uses /sys/block instead of /proc/mdstat for data. 11613

Packetbeat

  • Add support for mongodb opcode 2013 (OP_MSG). 6191 8594
  • NFSv4: Always use opname ILLEGAL when failed to match request to a valid nfs operation. 11503

Winlogbeat

Functionbeat

Bugfixes

edit

Affecting all Beats

  • Ensure all beat commands respect configured settings. 10721
  • Add missing fields and test cases for libbeat add_kubernetes_metadata processor. 11133, 11134
  • decode_json_field: process objects and arrays only 11312
  • decode_json_field: do not process arrays when flag not set. 11318
  • Report faulting file when config reload fails. 11304
  • Fix a typo in libbeat/outputs/transport/client.go by updating c.conn.LocalAddr() to c.conn.RemoteAddr(). 11242
  • Management configuration backup file will now have a timestamps in their name. 11034
  • [CM] Parse enrollment_token response correctly 11648
  • Not hiding error in case of http failure using elastic fetcher 11604
  • Escape BOM on JsonReader before trying to decode line 11661
  • Fix matching of string arrays in contains condition. 11691
  • Replace wmi queries with win32 api calls as they were consuming CPU resources 3249 and 11840
  • Fix queue.spool.write.flush.events config type. 12080
  • Fixed a memory leak when using the add_process_metadata processor under Windows. 12100
  • Fix of docker json parser for missing "log" jsonkey in docker container’s log 11464
  • Fixed Beat ID being reported by GET / API. 12180
  • Add host.os.codename to fields.yml. 12261
  • Fix @timestamp being duplicated in events if @timestamp is set in a processor (or by any code utilizing PutValue() on a beat.Event).
  • Fix leak in script processor when using Javascript functions in a processor chain. 12600

Auditbeat

  • Process dataset: Fixed a memory leak under Windows. 12100
  • Login dataset: Fix re-read of utmp files. 12028
  • Package dataset: Fixed a crash inside librpm after Auditbeat has been running for a while. 12147 12168
  • Fix formatting of config files on macOS and Windows. 12148
  • Fix direction of incoming IPv6 sockets. 12248
  • Package dataset: Auto-detect package directories. 12289
  • System module: Start system module without host ID. 12373

Filebeat

  • Add support for Cisco syslog format used by their switch. 10760
  • Cover empty request data, url and version in Apache2 modulehttps://github.com/elastic/beats/pull/10730[10730]
  • Fix registry entries not being cleaned due to race conditions. 10747
  • Improve detection of file deletion on Windows. 10747
  • Add missing Kubernetes metadata fields to Filebeat CoreDNS module, and fix a documentation error. 11591
  • Reduce memory usage if long lines are truncated to fit max_bytes limit. The line buffer is copied into a smaller buffer now. This allows the runtime to release unused memory earlier. 11524
  • Fix memory leak in Filebeat pipeline acker. 12063
  • Fix goroutine leak caused on initialization failures of log input. 12125
  • Fix goroutine leak on non-explicit finalization of log input. 12164
  • Require client_auth by default when ssl is enabled for tcp input 12333
  • Fix timezone offset parsing in system/syslog. 12529

Heartbeat

  • Fix NPEs / resource leaks when executing config checks. 11165
  • Fix duplicated IPs on mode: all monitors. 12458

Journalbeat

  • Use backoff when no new events are found. 11861

Metricbeat

  • Change diskio metrics retrieval method (only for Windows) from wmi query to DeviceIOControl function using the IOCTL_DISK_PERFORMANCE control code 11635
  • Call GetMetricData api per region instead of per instance. 11820 11882
  • Update documentation with cloudwatch:ListMetrics permission. 11987
  • Check permissions in system socket metricset based on capabilities. 12039
  • Get process information from sockets owned by current user when system socket metricset is run without privileges. 12039
  • Avoid generating hints-based configuration with empty hosts when no exposed port is suitable for the hosts hint. 8264 12086
  • Fixed a socket leak in the postgresql module under Windows when SSL is disabled on the server. 11393
  • Change some field type from scaled_float to long in aws module. 11982
  • Fixed RabbitMQ queue metricset gathering when consumer_utilisation is set empty at the metrics source 12089
  • Fix direction of incoming IPv6 sockets. 12248
  • Ignore prometheus metrics when their values are NaN or Inf. 12084 10849
  • Require client_auth by default when ssl is enabled for module http metricset serverhttps://github.com/elastic/beats/pull/12333[12333]
  • The elasticsearch/index_summary metricset gracefully handles an empty Elasticsearch cluster when xpack.enabled: true is set. 12489 12487

Packetbeat

  • Prevent duplicate packet loss error messages in HTTP events. 10709
  • Fixed a memory leak when using process monitoring under Windows. 12100
  • Improved debug logging efficiency in PGQSL module. 12150

Winlogbeat

Functionbeat

  • Fix function name reference for Kinesis streams in CloudFormation templates 11646

Added

edit

Affecting all Beats

  • Add an option to append to existing logs rather than always rotate on start. 11953
  • Add network condition to processors for matching IP addresses against CIDRs. 10743
  • Add if/then/else support to processors. 10744
  • Add community_id processor for computing network flow hashes. 10745
  • Add output test to kafka output 10834
  • Gracefully shut down on SIGHUP 10704
  • New processor: copy_fields. 11303
  • Add error.message to events when fail_on_error is set in rename and copy_fields processors. 11303
  • New processor: truncate_fields. 11297
  • Allow a beat to ship monitoring data directly to an Elasticsearch monitoring clsuter. 9260
  • Updated go-seccomp-bpf library to v1.1.0 which updates syscall lists for Linux v5.0. NNNN
  • Add add_observer_metadata processor. 11394
  • Add decode_csv_fields processor. 11753
  • Add convert processor for converting data types of fields. 8124 11686
  • New extract_array processor. 11761
  • Add number of goroutines to reported metrics. 12135

Auditbeat

  • Auditd module: Add event.outcome and event.type for ECS. 11432
  • Process: Add file hash of process executable. 11722
  • Socket: Add network.transport and network.community_id. 12231
  • Host: Fill top-level host fields. 12259

Filebeat

  • Add more info to message logged when a duplicated symlink file is found 10845
  • Add option to configure docker input with paths 10687
  • Add Netflow module to enrich flow events with geoip data. 10877
  • Set event.category: network_traffic for Suricata. 10882
  • Allow custom default settings with autodiscover (for example, use of CRI paths for logs). 12193
  • Allow to disable hints based autodiscover default behavior (fetching all logs). 12193
  • Change Suricata module pipeline to handle destination.domain being set if a reverse DNS processor is used. 10510
  • Add the network.community_id flow identifier to field to the IPTables, Suricata, and Zeek modules. 11005
  • New Filebeat coredns module to ingest coredns logs. It supports both native coredns deployment and coredns deployment in kubernetes. 11200
  • New module for Cisco ASA logs. 9200 11171
  • Added support for Cisco ASA fields to the netflow input. 11201
  • Configurable line terminator. 11015
  • Add Filebeat envoyproxy module. 11700
  • Add apache2(httpd) log path (/var/log/httpd) to make apache2 module work out of the box on Redhat-family OSes. 11887 11888
  • Add support to new MongoDB additional diagnostic information 11952
  • New module panw for Palo Alto Networks PAN-OS logs. 11999
  • Add RabbitMQ module. 12032
  • Add new container input. 12162

Heartbeat

  • Enable add_observer_metadata processor in default config. 11394

Metricbeat

  • Add AWS SQS metricset. 10684 10053
  • Add AWS s3_request metricset. 10949 10055
  • Add s3_daily_storage metricset. 10940 10055
  • Add coredns metricbeat module. 10585
  • Add SSL support for Metricbeat HTTP server. 11482 11457
  • The elasticsearch.index metricset (with xpack.enabled: true) now collects refresh.external_total_time_in_millis fields from Elasticsearch. 11616
  • Allow module configurations to have variants 9118
  • Add timeseries.instance field calculation. 10293
  • Added new disk states and raid level to the system/raid metricset. 11613
  • Added path_name and start_name to service metricset on windows module 8364 11877
  • Add check on object name in the counter path if the instance name is missing 6528 11878
  • Add AWS cloudwatch metricset. 11798 11734
  • Add regions in aws module config to specify target regions for querying cloudwatch metrics. 11932 11956
  • Keep etcd followers members from reporting leader metricset events 12004
  • Add validation for elasticsearch and kibana modules' metricsets when xpack.enabled is set to true. 12386

Functionbeat

  • Add new options to configure roles and VPC. 11779

Winlogbeat

  • Add support for reading from .evtx files. 4450

Deprecated

edit

Filebeat

  • Deprecate docker input in favor of container. 12162

Functionbeat

Known Issue

edit

Journalbeat

« Beats version 7.2.1 Beats version 7.1.1 »