Logstash 7.14.0 Release Notes
editLogstash 7.14.0 Release Notes
editNew features and enhancements
editElastic Agent input plugin
editThe Logstash Elastic Agent input plugin is now available to coincide with Elastic Agent’s general availability. The new plugin is based on the Beats input plugin, and will seem familiar to users who have been using the Beats input.
Elastic Enterprise Search integration
editThe new Elastic Workplace Search plugin is available as part of the Elastic Enterprise Search integration and is bundled with Logstash 7.14.0. The output plugins in this integration send events from Logstash to Elastic Enterprise Search.
MaxMind GeoIP database changes
editMaxMind, the company that provides the GeoIP databases that Logstash uses, has changed their licensing. Logstash has made changes to the core product and the GeoIP filter plugin to support these changes and to help you manage your geoip databases and updates. See Database License and Database Auto-update for more details.
Geoip database metrics are now available in /node/stats API.
aarch64 (ARM64) support
editAarch64 (ARM64) support for 64-bit ARM architectures is now generally available (GA) with the same set of distributions as x86_64. Check out the Logstash download page to download the latest.
Progress toward Elastic Common Schema (ECS)
editIn this release, we’ve made more Logstash plugins compatible with the Elastic Common Schema (ECS):
When a pipeline defined in Logstash Central Management in Kibana provides either pipeline.ordered
or pipeline.ecs_compatibility
, those settings are now propagated to the pipeline #12861
Check out our progress toward ECS compatibility in github issue #11635.
Performance improvements and notable issues fixed
edit- GeoIP DatabaseManager has been updated to ensure that only one instance manages the database and one scheduler downloads the database to prevent duplicate download. #12862
- Geoip database metrics are available in /node/stats API #13004
-
Fix: Windows
logstash.bat
not setting exit code #12948 -
Fix to log4j configuration issue that prevented the rollover of logstash-plain.log when the log per pipeline (
pipeline.separate_logs
) is enabled. Fixes #12921. #12964
Updates to dependencies
Plugins
editCsv Filter - 3.1.1
Fingerprint Filter - 3.3.2
Geoip Filter - 7.2.2
Json Filter - 3.2.0
- Feat: check target is set in ECS mode #49
- Refactor: logging improvements to print event details in debug mode
Useragent Filter - 3.3.1
- Fix: invalid 3.3.0 release which did not package correctly #71
- Feat: support ECS mode when setting UA fields #68
- Fix: capture os major version + update UA regexes #69
-
Plugin no longer sets the
[build]
UA version field which is not implemented and was always""
. -
Fix:
target => [field]
configuration, which wasn’t working previously
Azure_event_hubs Input - 1.3.0
-
Add EventHub
user properties
in@metadata
object #66
Beats Input - 6.1.6
- [DOC] Applied more attributes to manage plugin name in doc content, and implemented conditional text processing. #423
File Input - 4.3.1
-
Add extra safety to
chown
call inatomic_write
, avoiding plugin crashes and falling back to anon_atomic_write
in the event of failure #295 - Refactor: unify event updates to happen in one place #297
-
Test: Actually retry tests on
RSpec::Expectations::ExpectationNotMetError
and retry instead of relying on timeout #297 - Add ECS Compatibility Mode #291
Http Input - 3.4.1
Redis Input - 3.7.0
- Fix: better (Redis) exception handling #89
- Test: start running integration specs on CI
S3 Input - 3.7.0
Tcp Input - 6.2.0
- Added ECS Compatibility Mode #165
-
When operating in an ECS Compatibility mode, metadata about the connection on which we are receiving data is nested in well-named fields under
[@metadata][input][tcp]
instead of at the root level. - Fix: source address is no longer missing when a proxy is present
- Changed jar dependencies to reflect newer versions #179
- Feat: improve SSL error logging/unwrapping #178
- Fix: the plugin will no longer have a side effect of adding the Bouncy-Castle security provider at runtime
Jdbc Integration - 5.1.4
- [DOC] Update filter-jdbc_static doc to describe ECS compatibility #79
-
Improve robustness when handling errors from
sequel
library in jdbc static and streaming filters #78 -
Fix
prepared_statement_bind_values
in streaming filter to resolve nested event’s fields #76 - [DOC] Changed docs to indicate that logstash-jdbc-static requires local_table #56. Fixes #55.
-
Added
target
option to JDBC input, allowing the row columns to target a specific field instead of being expanded at the root of the event. This allows the input to play nicer with the Elastic Common Schema when the input does not follow the schema. #69 -
Added
target
to JDBC filter staticlocal_lookups
to verify it is properly valued when ECS is enabled. #71
Elastic_enterprise_search Integration - 2.1.2
- New for 7.14.0
Kafka Integration - 10.8.1
- [DOC] Removed a setting recommendation that is no longer applicable for Kafka 2.0+ #99
- Added config setting to enable schema registry validation to be skipped when an authentication scheme unsupported by the validator is used #97
-
Fix: Correct the settings to allow basic auth to work properly, either by setting
schema_registry_key/secret
or embedding username/password in the url #94
Rabbitmq Integration - 7.3.0
-
Refactor: logging improvements #47
- integrated MarchHare logging to be part of Logstash’s log instead of using std-err
- normalized logging format on (Ruby) errors
Ecs_compatibility_support Mixin - 1.3.0
- Feat: introduce a target check helper #6