Skip to content

Latest commit

 

History

History
175 lines (97 loc) · 5.79 KB

CHANGELOG.next.asciidoc

File metadata and controls

175 lines (97 loc) · 5.79 KB
Raw

Beats version HEAD

Breaking changes

Affecting all Beats

Auditbeat

Filebeat

  • Add a new salesforce module to collect data from salesforce. 31486

Heartbeat

Metricbeat

Packetbeat

Winlogbeat

Functionbeat

Bugfixes

Affecting all Beats

Auditbeat

  • Fix audit status collection on kernels prior to version 5.9. 31616 31710

Filebeat

  • Do not emit error log when filestream reader reaches EOF and close.reader.on_eof is enabled. 31109

  • sophos.xg: Update module to handle new log fields. 31038 31388

  • Fix MISP documentation for var.filters config option. 31434

  • Fix type mapping of client.as.number in okta module. 31676

  • Fix last write pagination commit checkpoint on aws-s3 input for s3 direct polling when using the same bucket and different list prefixes. 31776

Heartbeat

  • Fix unintentional use of no-op logger. 31543

Metricbeat

  • make system/filesystem code sensitive to hostfs and migrate libraries to elastic-agent-opts 31001

  • Fix kubernetes module’s internal cache expiration issue. This avoid metrics like kubernetes.container.cpu.usage.limit.pct from not being populated. 31785

  • add missing HealthyHostCount and UnHealthyHostCount for application ELB. 31853

Packetbeat

Winlogbeat

  • Sysmon: Drop fields with "-" value (unset) 31556

Functionbeat

Elastic Logging Plugin

Added

Affecting all Beats

  • Add new config option timestamp.precision to configure timestamps. 31682

  • Improve performance of disk queue by coalescing writes. 31935

Auditbeat

  • Add backlog_wait_time_actual to the output of the auditbeat auditd show-status command. 31535

Filebeat

  • Add text/csv decoder to httpjson input 28564

  • Update aws-s3 input to connect to non AWS S3 buckets 28222 28234

  • Add support for '/var/log/pods/' path for add_kubernetes_metadata processor with resource_type: pod. 28868

  • Add documentation for add_kubernetes_metadata processors log_path matcher. 28868

  • Add support for parsers on journald input 29070

  • Add support in httpjson input for oAuth2ProviderDefault of password grant_type. 29087

  • threatintel module: Add new Recorded Future integration. 30030

  • Support SASL/SCRAM authentication in the Kafka input. 31167

  • checkpoint module: Add network.transport derived from IANA number. 31076

  • Add URL Encode template function for httpjson input. 30962

  • Add application/zip decoder to the httpsjon input. 31282 31304

  • Default value of filebeat.registry.flush increased from 0s to 1s. CPU and disk I/O usage are reduced because the registry is not written to disk for each ingested log line. 30279

  • Cisco ASA/FTD: Add support for messages 434001 and 434003. 31533

  • Change threatintel module from beta to GA. 31693

  • Add template helper function for hashing strings. 31613 31630

  • Add extended okta.debug_context.debug_data handling. 31676

  • Add auth.oauth2.google.jwt_json option to httpjson input. 31750

  • Add authentication fields to RabbitMQ module documents. 31159 31680

  • Add template helper function for decoding hexadecimal strings. 31886

Auditbeat

  • auditd: Updated the go-libaudit library version to v2.3.0. This refreshes the syscall names for Linux and adds ECS categorizations for more audit anomaly events. 31519

Filebeat

  • http_endpoint input: Add support for requests with Content-Encoding: gzip. 31005

Heartbeat

  • Add support for pushed browser monitor source from the synthetics agent. 31428

  • Add ARM64 seccomp profile. 31285 31422

  • Add new playwright_options config for browser monitors. 28196 31737

Metricbeat

  • Enhance Oracle Module: Change tablespace metricset collection period 30948 #31259

  • Add orchestrator cluster ECS fields in kubernetes events 31341

  • Add new Kubernetes module dashboards 31591

  • system/core: add cpuinfo information for Linux hosts 31643

  • Enhance Oracle Module: Refactor module to properly use host parsers instead of doing its own parsing of hosts 31611 #31692

  • Enhance Oracle Module: Connection string for Oracle does not handle special characters properly 24609 #31368

  • Enhance Oracle Module: New sysmetric metricset 30946 #31462

Packetbeat

Functionbeat

Winlogbeat

  • Add parent process ID to new process creation events. 29237 31102

  • Sysmon: Support for Sysmon Registry non-QWORD/DWORD events. 31556

Elastic Log Driver

Deprecated

Affecting all Beats

Filebeat

Heartbeat - Bump node.js version for synthetics to 16.15.0. 31675

Metricbeat

Packetbeat

Winlogbeat

Functionbeat

Known Issue