Beats breaking changes

This list summarizes the most important breaking changes in Beats. For the complete list, go to Beats breaking changes.

All Elastic Beats now write ECS-compliant logs in JSON format, and the config options for enabling ECS/JSON are removed. The new log name format is {beatname}-{date}(-n)?.ndjson. For example (from oldest to newest): filebeat-20200101.ndjson, filebeat-20200101-1.ndjson, filebeat-20200101-2.ndjson, and so on.

With this change, we now provide a uniform logging scheme across Elastic products, which makes it easier to develop ECS-aware visualizations for behaviors like correlating metrics or events across products.

If you have any monitoring configurations that expect the old log format, you must update them to use the new log format.

All Beats shippers now store events in data streams in Elasticsearch instead of indices regardless of the Elasticsearch version. This change affects the underlying data storage method used in Elasticsearch; it does not change the naming convention. The name of the data stream follows the format {beatname}-{version}, and the index pattern is {beatname}-{version}. Do not confuse this change with the naming convention we use in Elastic integrations.

As part of this change, some index lifecycle managment (ILM) options (rollover_alias and pattern) are removed because data streams do not require index aliases. Also the setup.template.type option is removed because it no longer makes sense.

If you are loading JSON index templates by specifying a file in setup.template.json.path, make sure you move from the legacy format to composable index templates.

For more information, refer to the Elasticsearch documentation about data streams.

Starting with version 8.0.0, Elastic no longer publishes Homebrew formulae for Beats. You must use a different installation method. See the Beats download pages for available installation methods.

Starting with version 8.0.0, the following operating systems are no longer supported by Beats due to lack of vendor support for the operating system. In order to have the best product experience, you are encouraged to move to a vendor-supported version of the operating system.