« Release notes Beats version 8.16.1 »

› ›

Beats version 8.17.0

Beats version 8.17.0

Breaking changes

Affecting all Beats

Drop support for Debian 10 and upgrade statically linked glibc from 2.28 to 2.31. 41402

Bugfixes

Affecting all Beats

Ensure Elasticsearch output can always recover from network errors. 40794
Add translate_ldap_attribute processor. 41472
Remove unnecessary debug logs during idle connection teardown. 40824
Remove unnecessary reload for Elastic Agent managed beats when APM tracing config changes from nil to nil. 41794

Auditbeat

auditd: Use ECS event.type: end instead of stop for SERVICE_STOP, DAEMON_ABORT, and DAEMON_END messages. 41558
auditd: Update syscall names for Linux 6.11. 41558
hasher: Geneneral improvements and fixes. 41863

Filebeat

Fix double encoding of client_secret in the Entity Analytics input’s Azure Active Directory provider. 41393
Add support for Access Points in the aws-s3 input. 41495
Fix the "No such input type exist: salesforce" error on the Windows/AIX platform. 41664
Fix handling of http_endpoint request exceeding memory limits. 41764 41765
Fixes filestream logging the error "filestream input with ID ID already exists, this will lead to data duplication[…]" on Kubernetes when using autodiscover. 41585

Metricbeat

Log Cisco Meraki getDevicePerformanceScores errors without stopping metrics collection. 41622
Fix incorrect handling of types in SQL module. 40090 41607

Winlogbeat

Fix message handling in the experimental API. 19338 41730

Added

Affecting all Beats

Add lowercase processor. 22254 41424
Add uppercase processor. 22254 41535
Replace compress/gzip with https://github.com/klauspost/compress/gzip library for gzip compression. 41584

Auditbeat

Split module/system/process into common and provider bits. 41868

Filebeat

Improved Azure Blob Storage input documentation. 41252
Make ETW input GA. 41389
Added input metrics to GCS input. 36640 41505
Add support for Okta entity analytics provider to collect role and factor data for users. 41460
Add support for Journald in the System module. 41555
Improve S3 polling mode states registry when using list prefix option. 41869
AWS S3 input registry cleanup for untracked s3 objects. 41694
The environment variable BEATS_AZURE_EVENTHUB_INPUT_TRACING_ENABLED: true enables internal logs tracer for the azure-eventhub input. 41931 41932

Libbeat

Enrich events with EC2 tags in add_cloud_metadata processor. 41477

Metricbeat

Add id field to all the vSphere metricsets. 41097
Bump aerospike-client-go to version v7.7.1 and add support for basic auth in Aerospike module. 41233
Add support for region/zone for Vertex AI service in GCP module. 41551
Add support for location label as an optional configuration parameter in GCP metrics metricset. 41550 41626

Winlogbeat

Add handling for missing `EvtVarType`s in experimental API. 19337 41418
Implement exclusion range support for event_id. 38623 41639

« Release notes Beats version 8.16.1 »