diff --git a/CHANGELOG-developer.asciidoc b/CHANGELOG-developer.asciidoc index 936eab11a1f..a137d03e062 100644 --- a/CHANGELOG-developer.asciidoc +++ b/CHANGELOG-developer.asciidoc @@ -12,10 +12,28 @@ other Beats should be migrated. Note: This changelog was only started after the 6.3 release. +=== Beats version 7.0.0-rc1 +https://github.com/elastic/beats/compare/v7.0.0-beta1..v7.0.0-rc1[Check the HEAD diff] + +==== Breaking changes + +- Remove support for deprecated `GenRootCmd` methods. {pull}10721[10721] +- Remove SkipNormalization, SkipAgentMetadata, SkipAddHostName. {pull}10801[10801] {pull}10769[10769] + +==== Bugfixes + +- Align default index between elasticsearch and logstash and kafka output. {pull}10841[10841] +- Fix duplication check for `append_fields` option. {pull}10959[10959] + +==== Added + +- Introduce processing.Support to instance.Setting. This allows Beats to fully modify the event processing. {pull}10801[10801] + === Beats version 7.0.0-beta1 https://github.com/elastic/beats/compare/v7.0.0-alpha2..v7.0.0-beta1[Check the HEAD diff] ==== Breaking changes + - Outputs receive Index Manager as additional parameter. The index manager can be used to create an index selector. {pull}10347[10347] - Remove support for loading dashboards to Elasticsearch 5. {pull}10451[10451] diff --git a/CHANGELOG-developer.next.asciidoc b/CHANGELOG-developer.next.asciidoc index 0dc3843ba52..2f0bdf798f7 100644 --- a/CHANGELOG-developer.next.asciidoc +++ b/CHANGELOG-developer.next.asciidoc @@ -14,22 +14,12 @@ Note: This changelog documents the current changes which are not yet present in an actual release. === Beats version HEAD -https://github.com/elastic/beats/compare/v7.0.0-beta1..master[Check the HEAD diff] +https://github.com/elastic/beats/compare/v7.0.0-rc1..master[Check the HEAD diff] -The list below covers the major changes between 7.0.0-beta1 and master only. +The list below covers the major changes between 7.0.0-rc1 and master only. ==== Breaking changes -- Outputs receive Index Manager as additional parameter. The index manager can - be used to create an index selector. {pull}10347[10347] -- Remove support for loading dashboards to Elasticsearch 5. {pull}10451[10451] -- Remove support for deprecated `GenRootCmd` methods. {pull}10721[10721] -- Remove SkipNormalization, SkipAgentMetadata, SkipAddHostName. {pull}10801[10801] {pull}10769[10769] ==== Bugfixes -- Align default index between elasticsearch and logstash and kafka output. {pull}10841[10841] -- Fix duplication check for `append_fields` option. {pull}10959[10959] - ==== Added - -- Introduce processing.Support to instance.Setting. This allows Beats to fully modify the event processing. {pull}10801[10801] diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc index 035a2d24bac..9aea1d7db74 100644 --- a/CHANGELOG.asciidoc +++ b/CHANGELOG.asciidoc @@ -3,92 +3,119 @@ :issue: https://github.com/elastic/beats/issues/ :pull: https://github.com/elastic/beats/pull/ -//////////////////////////////////////////////////////////// -// Template, add newest changes here - -=== Beats version HEAD -https://github.com/elastic/beats/compare/v7.0.0-beta1...master[Check the HEAD diff] +[[release-notes-7.0.0-rc1]] +=== Beats version 7.0.0-rc1 +https://github.com/elastic/beats/compare/v7.0.0-beta1...v7.0.0-rc1[Check the HEAD diff] ==== Breaking changes *Affecting all Beats* +- On Google Cloud Engine (GCE) the add_cloud_metadata will now trim the project + info from the cloud.machine.type and cloud.availability_zone. {issue}10968[10968] +- Add `cleanup_timeout` option to docker autodiscover, to wait some time before removing configurations after a container is stopped. {issue}10374[10374] {pull}10905[10905] +- Empty `meta.json` file will be treated as a missing meta file. {issue}8558[8558] +- Rename `migration.enabled` config to `migration.6_to_7.enabled`. {pull}11284[11284] +- Initialize the Paths before the keystore and save the keystore into `data/{beatname}.keystore`. {pull}10706[10706] +- Beats Xpack now checks for Basic license on connect. {pull}11296[11296] + *Auditbeat* -*Filebeat* +- Process dataset: Only report processes with executable. {pull}11232[11232] -*Heartbeat* +*Filebeat* -*Journalbeat* +- Set `ecs: true` in user_agent processors when loading pipelines with Filebeat 7.0.x into Elasticsearch 6.7.x. {issue}10655[10655] {pull}10875[10875] *Metricbeat* -*Packetbeat* - -*Winlogbeat* +- Migrate docker module to ECS. {pull}10927[10927] *Functionbeat* +- Correctly extract Kinesis Data field from the Kinesis Record. {pull}11141[11141] + ==== Bugfixes *Affecting all Beats* +- Reconnections of Kubernetes watchers are now logged at debug level when they are harmless. {pull}10988[10988] +- Add missing host.* fields to fields.yml. {pull}11016[11016] +- Include ip and boolean type when generating index pattern. {pull}10995[10995] +- Using an environment variable for the password when enrolling a beat will now raise an error if the variable doesn't exist. {pull}10936[10936] +- Cancelling enrollment of a beat will not enroll the beat. {issue}10150[10150] +- Allow to configure Kafka fetching strategy for the topic metadata. {pull}10682[10682] + *Auditbeat* +- Package: Disable librpm signal handlers. {pull}10694[10694] +- Login: Handle different bad login UTMP types. {pull}10865[10865] +- System module: Fix and unify bucket closing logic. {pull}10897[10897] +- User dataset: Numerous fixes to error handling. {pull}10942[10942] + *Filebeat* +- Fix errors in filebeat Zeek dashboard and README files. Add notice.log support. {pull}10916[10916] +- Fix a bug when converting NetFlow fields to snake_case. {pull}10950[10950] +- Add on_failure handler for Zeek ingest pipelines. Fix one field name error for notice and add an additional test case. {issue}11004[11004] {pull}11105[11105] +- Fix issue preventing docker container events to be stored if the container has a network interface without ip address. {issue}11225[11225] {pull}11247[11247] +- Change URLPATH grok pattern to support brackets. {issue}11135[11135] {pull}11252[11252] +- Add support for iis log with different address format. {issue}11255[11255] {pull}11256[11256] + *Heartbeat* -*Journalbeat* +- Fix checks for TCP send/receive data {pull}11118[11118] *Metricbeat* +- Migrate docker autodiscover to ECS. {issue}10757[10757] {pull}10862[10862] +- Fix issue in kubernetes module preventing usage percentages to be properly calculated. {pull}10946[10946] +- Fix for not reusable http client leading to connection leaks in Jolokia module {pull}11014[11014] +- Fix parsing error using GET in Jolokia module. {pull}11075[11075] {issue}11071[11071] +- Collect metrics when EC2 instances are not in running state. {issue}11008[11008] {pull}11023[11023] +- Change ECS field cloud.provider to aws. {pull}11023[11023] +- Add documentation about jolokia autodiscover fields. {issue}10925[10925] {pull}10979[10979] +- Add missing aws.ec2.instance.state.name into fields.yml. {issue}11219[11219] {pull}11221[11221] +- Fix ec2 metricset to collect metrics from Cloudwatch with the same timestamp. {pull}11142[11142] +- Fix potential memory leak in stopped docker metricsets {pull}11294[11294] + *Packetbeat* +- Avoid reporting unknown MongoDB opcodes more than once. {pull}10878[10878] + *Winlogbeat* +- Prevent Winlogbeat from dropping events with invalid XML. {pull}11006[11006] +- Fix Winlogbeat escaping CR, LF and TAB characters. {issue}11328[11328] {pull}11357[11357] + *Functionbeat* ==== Added *Affecting all Beats* -*Auditbeat* - -*Filebeat* - -*Heartbeat* - -*Journalbeat* +- Add ip fields to default_field in Elasticsearch template. {pull}11035[11035] -*Metricbeat* - -*Packetbeat* - -*Functionbeat* - -==== Deprecated +*Auditbeat* -*Affecting all Beats* +- Move System module to beta. {pull}10800[10800] *Filebeat* -*Heartbeat* - -*Journalbeat* +- Add ISO8601 timestamp support in syslog metricset. {issue}8716[8716] {pull}10736[10736] +- Add support for loading custom NetFlow and IPFIX field definitions to netflow input. {pull}10945[10945] {pull}11223[11223] +- Added categorization fields for SSH login events in the system/auth fileset. {pull}11334[11334] *Metricbeat* -*Packetbeat* - -*Winlogbeat* +- Add filters and pie chart for AWS EC2 dashboard. {pull}10596[10596] -*Functionbeat* ==== Known Issue +*Journalbeat* -//////////////////////////////////////////////////////////// +- Journalbeat requires at least systemd v233 in order to follow entries after journal changes (rotation, vacuum). [[release-notes-7.0.0-beta1]] === Beats version 7.0.0-beta1 @@ -661,6 +688,261 @@ https://github.com/elastic/beats/compare/v6.5.0...v7.0.0-alpha1[View commits] - Added support to calculate certificates' fingerprints (MD5, SHA-1, SHA-256). {issue}8180[8180] - Support new TLS version negotiation introduced in TLS 1.3. {issue}8647[8647]. +[[release-notes-6.7.0]] +=== Beats version 6.7.0 +https://github.com/elastic/beats/compare/v6.6.2...v6.7.0[View commits] + +==== Breaking changes + +*Affecting all Beats* + +- Port settings have been deprecated in redis/logstash output and will be removed in 7.0. {pull}9915[9915] +- Update the code of Central Management to align with the new returned format. {pull}10019[10019] +- Allow Central Management to send events back to kibana. {issue}9382[9382] +- Fix panic if fields settting is used to configure `hosts.x` fields. {issue}10824[10824] {pull}10935[10935] +- Introduce query.default_field as part of the template. {pull}11205[11205] +- Beats Xpack now checks for Basic license on connect. {pull}11296[11296] + +*Filebeat* + +- Filesets with multiple ingest pipelines added in {pull}8914[8914] only work with Elasticsearch >= 6.5.0 {pull}10001[10001] +- Add grok pattern to support redis 5.0.3 log timestamp. {issue}9819[9819] {pull}10033[10033] +- Ingesting Elasticsearch audit logs is only supported with Elasticsearch 6.5.0 and above {pull}8852[8852] +- Remove `ecs` option from user_agent processors when loading pipelines with Filebeat 6.7.x into Elasticsearch < 6.7.0. {issue}10655[10655] {pull}11362[11362] + +*Heartbeat* + +- Remove monitor generator script that was rarely used. {pull}9648[9648] + +==== Bugfixes + +*Affecting all Beats* + +- Fix TLS certificate DoS vulnerability. {pull}10303[10303] +- Fix panic and file unlock in spool on atomic operation (arm, x86-32). File lock was not released when panic occurs, leading to the beat deadlocking on startup. {pull}10289[10289] +- Adding logging traces at debug level when the pipeline client receives the following events: onFilteredOut, onDroppedOnPublish. {pull}9016[9016] +- Do not panic when no tokenizer string is configured for a dissect processor. {issue}8895[8895] +- Fix a issue when remote and local configuration didn't match when fetching configuration from Central Management. {issue}10587[10587] +- Add ECS-like selectors and dedotting to docker autodiscover. {issue}10757[10757] {pull}10862[10862] +- Fix encoding of timestamps when using disk spool. {issue}10099[10099] +- Include ip and boolean type when generating index pattern. {pull}10995[10995] +- Using an environment variable for the password when enrolling a beat will now raise an error if the variable doesn't exist. {pull}10936[10936] +- Cancelling enrollment of a beat will not enroll the beat. {issue}10150[10150] +- Remove IP fields from default_field in Elasticsearch template. {pull}11399[11399] + +*Auditbeat* + +- Package: Disable librpm signal handlers. {pull}10694[10694] +- Login: Handle different bad login UTMP types. {pull}10865[10865] +- Fix hostname references in System module dashbords. {pull}11064[11064] +- User dataset: Numerous fixes to error handling. {pull}10942[10942] + +*Filebeat* + +- Support IPv6 addresses with zone id in IIS ingest pipeline. {issue}9836[9836] error log: {pull}9869[9869] access log: {pull}10029[10029] +- Fix bad bytes count in `docker` input when filtering by stream. {pull}10211[10211] +- Fixed data types for roles and indices fields in `elasticsearch/audit` fileset {pull}10307[10307] +- Cover empty request data, url and version in Apache2 module{pull}10846[10846] +- Fix a bug with the convert_timezone option using the incorrect timezone field. {issue}11055[11055] {pull}11164[11164] +- Change URLPATH grok pattern to support brackets. {issue}11135[11135] {pull}11252[11252] +- Add support for iis log with different address format. {issue}11255[11255] {pull}11256[11256] +- Add fix to parse syslog message with priority value 0. {issue}11010[11010] + +*Heartbeat* + +- `Host` header can now be overridden for HTTP requests sent by Heartbeat monitors. {pull}9148[9516] +- Fix checks for TCP send/receive data {pull}10777[10777] + +*Journalbeat* + +- Do not stop collecting events when journal entries change. {pull}9994[9994] + +*Metricbeat* + +- Fix MongoDB dashboard that had some incorrect field names from `status` Metricset {pull}9795[9795] {issue}9715[9715] +- Fix issue that would prevent collection of processes without command line on Windows. {pull}10196[10196] +- Fixed data type for tags field in `docker/container` metricset {pull}10307[10307] +- Fixed data type for tags field in `docker/image` metricset {pull}10307[10307] +- Fixed data type for isr field in `kafka/partition` metricset {pull}10307[10307] +- Fixed data types for various hosts fields in `mongodb/replstatus` metricset {pull}10307[10307] +- Added function to close sql database connection. {pull}10355[10355] +- Fix parsing error using GET in Jolokia module. {pull}11075[11075] {issue}11071[11071] + +*Winlogbeat* + +- Fix Winlogbeat escaping CR, LF and TAB characters. {issue}11328[11328] {pull}11357[11357] + +*Functionbeat* + +- Correctly extract Kinesis Data field from the Kinesis Record. {pull}11141[11141] +- Add the required permissions to the role when deployment SQS functions. {issue}9152[9152] + +==== Added + +*Affecting all Beats* + +- Add ip fields to default_field in Elasticsearch template. {pull}11035[11035] +- Add `cleanup_timeout` option to docker autodiscover, to wait some time before removing configurations after a container is stopped. {issue}10374[10374] {pull}10905[10905] + +*Auditbeat* + +- System module `process` dataset: Add user information to processes. {pull}9963[9963] +- Add system `package` dataset. {pull}10225[10225] +- Add system module `login` dataset. {pull}9327[9327] +- Add `entity_id` fields. {pull}10500[10500] +- Add seven dashboards for the system module. {pull}10511[10511] + +*Filebeat* + +- Add field log.source.address and log.file.path to replace source. {pull}9435[9435] +- Support mysql 5.7.22 slowlog starting with time information. {issue}7892[7892] {pull}9647[9647] +- Add support for ssl_request_log in apache2 module. {issue}8088[8088] {pull}9833[9833] +- Add support for iis 7.5 log format. {issue}9753[9753] {pull}9967[9967] +- Add support for MariaDB in the `slowlog` fileset of `mysql` module. {pull}9731[9731] +- Add convert_timezone to nginx module. {issue}9839[9839] {pull}10148[10148] +- Add support for Percona in the `slowlog` fileset of `mysql` module. {issue}6665[6665] {pull}10227[10227] +- Added support for ingesting structured Elasticsearch audit logs {pull}8852[8852] +- New iptables module that receives iptables/ip6tables logs over syslog or file. Supports Ubiquiti Firewall extensions. {issue}8781[8781] {pull}10176[10176] +- Populate more ECS fields in the Suricata module. {pull}10006[10006] + +*Heartbeat* + +- Made monitors.d configuration part of the default config. {pull}9004[9004] +- Autodiscover metadata is now included in events by default. So, if you are using the docker provider for instance, you'll see the correct fields under the `docker` key. {pull}10258[10258] + +*Metricbeat* + +- Add field `event.dataset` which is `{module}.{metricset}`. +- Add more TCP statuses to `socket_summary` metricset. {pull}9430[9430] +- Remove experimental tag from ceph metricsets. {pull}9708[9708] +- Add `key` metricset to the Redis module. {issue}9582[9582] {pull}9657[9657] +- Add DeDot for kubernetes labels and annotations. {issue}9860[9860] {pull}9939[9939] +- Add docker `event` metricset. {pull}9856[9856] +- Release Ceph module as GA. {pull}10202[10202] +- Release windows Metricbeat module as GA. {pull}10163[10163] +- Release traefik Metricbeat module as GA. {pull}10166[10166] +- List filesystems on Windows that have an access path but not an assigned letter {issue}8916[8916] {pull}10196[10196] +- Release uswgi Metricbeat module GA. {pull}10164[10164] +- Release php_fpm module as GA. {pull}10198[10198] +- Release Memcached module as GA. {pull}10199[10199] +- Release etcd module as GA. {pull}10200[10200] +- Release kubernetes apiserver and event metricsets as GA {pull}10212[10212] +- Release Couchbase module as GA. {pull}10201[10201] +- Release aerospike module as GA. {pull}10203[10203] +- Release envoyproxy module GA. {pull}10223[10223] +- Release mongodb.metrics and mongodb.replstatus as GA. {pull}10242[10242] +- Release mysql.galera_status as Beta. {pull}10242[10242] +- Release postgresql.statement as GA. {pull}10242[10242] +- Release RabbitMQ Metricbeat module GA. {pull}10165[10165] +- Release Dropwizard module as GA. {pull}10240[10240] +- Release Graphite module as GA. {pull}10240[10240] +- Release http.server metricset as GA. {pull}10240[10240] +- Add support for MySQL 8.0 and tests also for Percona and MariaDB. {pull}10261[10261] +- Release use of xpack.enabled: true flag in Elasticsearch and Kibana modules as GA. {pull}10222[10222] +- Release Elastic stack modules (Elasticsearch, Logstash, and Kibana) as GA. {pull}10094[10094] +- Add remaining memory metrics of pods in Kubernetes metricbeat module {pull}10157[10157] +- Added 'server' Metricset to Zookeeper Metricbeat module {issue}8938[8938] {pull}10341[10341] +- Add overview dashboard to Zookeeper Metricbeat module {pull}10379[10379] + +*Functionbeat* + +- Mark Functionbeat as GA. {pull}10564[10564] +- Functionbeat can now deploy a function for Kinesis. {pull}10116[10116] +- Allow functionbeat to use the keystore. {issue}9009[9009] + +==== Deprecated + +*Filebeat* + +- Deprecate field source. Will be replaced by log.source.address and log.file.path in 7.0. {pull}9435[9435] + +*Metricbeat* + +- Deprecate field `metricset.rtt`. Replaced by `event.duration` which is in nano instead of micro seconds. + +*Packetbeat* + +- Support new TLS version negotiation introduced in TLS 1.3. {issue}8647[8647]. + +==== Known Issue + +*Journalbeat* + +- Journalbeat requires at least systemd v233 in order to follow entries after journal changes (rotation, vacuum). + +[[release-notes-6.6.2]] +=== Beats version 6.6.2 +https://github.com/elastic/beats/compare/v6.6.1...6.6.2[View commits] + +==== Bugfixes + +*Auditbeat* + +- System module: Fix and unify bucket closing logic. {pull}10897[10897] + +*Filebeat* + +- Fix a bug when converting NetFlow fields to snake_case. {pull}10950[10950] + +*Metricbeat* + +- Fix issue in kubernetes module preventing usage percentages to be properly calculated. {pull}10946[10946] + +*Packetbeat* + +- Avoid reporting unknown MongoDB opcodes more than once. {pull}10878[10878] + +*Winlogbeat* + +- Prevent Winlogbeat from dropping events with invalid XML. {pull}11006[11006] + +[[release-notes-6.6.1]] +=== Beats version 6.6.1 +https://github.com/elastic/beats/compare/v6.6.0...6.6.1[View commits] + +==== Breaking changes + +*Affecting all Beats* + +- Fix stopping of modules started by kubernetes autodiscover. {pull}10476[10476] + +*Auditbeat* + +- Enable System module config on Windows. {pull}10237[10237] + +*Filebeat* + +- Fix bad bytes count in `docker` input when filtering by stream. {pull}10211[10211] +- Add `convert_timezone` option to Logstash module to convert dates to UTC. {issue}9756[9756] {pull}9797[9797] +- Add `convert_timezone` option to Elasticsearch module to convert dates to UTC. {issue}9756[9756] {pull}9761[9761] +- Make elasticsearch/audit fileset be more lenient in parsing node name. {issue}10035[10035] {pull}10135[10135] + +*Journalbeat* + +- Fix fields.yml indentation of audit group which had the effect of creating an incomplete Elasticsearch index template. {pull}10556[10556] + +*Metricbeat* + +- Fix issue with `elasticsearch/node_stats` metricset (x-pack) not indexing `source_node` field. {pull}10639[10639] + +*Packetbeat* + +- Fixed a crash when using af_packet capture {pull}10477[10477] + +*Functionbeat* + +- Ensure that functionbeat is logging at info level not debug. {issue}10262[10262] + +==== Added + +*Filebeat* + +- Teach elasticsearch/audit fileset to parse out some more fields. {issue}10134[10134] {pull}10137[10137] + +*Journalbeat* + +- Migrate registry from previously incorrect path. {pull}10486[10486] + [[release-notes-6.6.0]] === Beats version 6.6.0 https://github.com/elastic/beats/compare/v6.5.4...6.6[View commits] diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index df313876853..e78162da1e9 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -4,20 +4,12 @@ :pull: https://github.com/elastic/beats/pull/ === Beats version HEAD -https://github.com/elastic/beats/compare/v7.0.0-beta1...master[Check the HEAD diff] +https://github.com/elastic/beats/compare/v7.0.0-rc1...master[Check the HEAD diff] ==== Breaking changes *Affecting all Beats* -- On Google Cloud Engine (GCE) the add_cloud_metadata will now trim the project - info from the cloud.machine.type and cloud.availability_zone. {issue}10968[10968] -- Add `cleanup_timeout` option to docker autodiscover, to wait some time before removing configurations after a container is stopped. {issue]10374[10374] {pull}10905[10905] -- Empty `meta.json` file will be treated as a missing meta file. {issue}8558[8558] -- Rename `migration.enabled` config to `migration.6_to_7.enabled`. {pull}11284[11284] -- Initialize the Paths before the keystore and save the keystore into `data/{beatname}.keystore`. {pull}10706[10706] -- Beats Xpack now checks for Basic license on connect. {pull}11296[11296] - *Auditbeat* - Process dataset: Only report processes with executable. {pull}11232[11232] @@ -25,108 +17,50 @@ https://github.com/elastic/beats/compare/v7.0.0-beta1...master[Check the HEAD di *Filebeat* -- Set `ecs: true` in user_agent processors when loading pipelines with Filebeat 7.0.x into Elasticsearch 6.7.x. {issue}10655[10655] {pull}10875[10875] - *Heartbeat* *Journalbeat* *Metricbeat* -- Migrate docker module to ECS. {pull}10927[10927] - *Packetbeat* *Winlogbeat* *Functionbeat* -- Correctly extract Kinesis Data field from the Kinesis Record. {pull}11141[11141] - ==== Bugfixes *Affecting all Beats* -- Enforce validation for the Central Management access token. {issue}9621[9621] -- Fix config appender registration. {pull}9873[9873] -- Gracefully handle TLS options when enrolling a Beat. {issue}9129[9129] -- The backing off now implements jitter to better distribute the load. {issue}10172[10172] -- Fix TLS certificate DoS vulnerability. {pull}10302[10302] -- Fix panic and file unlock in spool on atomic operation (arm, x86-32). File lock was not released when panic occurs, leading to the beat deadlocking on startup. {pull}10289[10289] -- Fix encoding of timestamps when using disk spool. {issue}10099[10099] -- Fix stopping of modules started by kubernetes autodiscover. {pull}10476[10476] -- Fix a issue when remote and local configuration didn't match when fetching configuration from Central Management. {issue}10587[10587] -- Fix unauthorized error when loading dashboards by adding username and password into kibana config. {issue}10513[10513] {pull}10675[10675] -- Ensure all beat commands respect configured settings. {pull}10721[10721] -- Reconnections of Kubernetes watchers are now logged at debug level when they are harmless. {pull}10988[10988] -- Add missing host.* fields to fields.yml. {pull}11016[11016] -- Include ip and boolean type when generating index pattern. {pull}10995[10995] -- Using an environment variable for the password when enrolling a beat will now raise an error if the variable doesn't exist. {pull}10936[10936] -- Cancelling enrollment of a beat will not enroll the beat. {issue}10150[10150] -- Allow to configure Kafka fetching strategy for the topic metadata. {pull}10682[10682] -- Remove IP fields from default_field in Elasticsearch template. {pull}11400[11400] - *Auditbeat* -- Package: Disable librpm signal handlers. {pull}10694[10694] -- Login: Handle different bad login UTMP types. {pull}10865[10865] -- System module: Fix and unify bucket closing logic. {pull}10897[10897] -- User dataset: Numerous fixes to error handling. {pull}10942[10942] - *Filebeat* -- Fix errors in filebeat Zeek dashboard and README files. Add notice.log support. {pull}10916[10916] -- Fix a bug when converting NetFlow fields to snake_case. {pull}10950[10950] -- Add on_failure handler for Zeek ingest pipelines. Fix one field name error for notice and add an additional test case. {issue}11004[11004] {pull}11105[11105] -- Fix issue preventing docker container events to be stored if the container has a network interface without ip address. {issue}11225[11225] {pull}11247[11247] -- Change URLPATH grok pattern to support brackets. {issue}11135[11135] {pull}11252[11252] -- Add support for iis log with different address format. {issue}11255[11255] {pull}11256[11256] - Don't apply multiline rules in Logstash json logs. {pull}11346[11346] *Heartbeat* -- Fix checks for TCP send/receive data {pull}11118[11118] - *Journalbeat* *Metricbeat* -- Migrate docker autodiscover to ECS. {issue}10757[10757] {pull}10862[10862] -- Fix issue in kubernetes module preventing usage percentages to be properly calculated. {pull}10946[10946] -- Fix for not reusable http client leading to connection leaks in Jolokia module {pull}11014[11014] -- Fix parsing error using GET in Jolokia module. {pull}11075[11075] {issue}11071[11071] -- Add documentation about jolokia autodiscover fields. {issue}10925[10925] {pull}10979[10979] -- Add missing aws.ec2.instance.state.name into fields.yml. {issue}11219[11219] {pull}11221[11221] -- Fix ec2 metricset to collect metrics from Cloudwatch with the same timestamp. {pull}11142[11142] -- Fix potential memory leak in stopped docker metricsets {pull}11294[11294] - *Packetbeat* -- Avoid reporting unknown MongoDB opcodes more than once. {pull}10878[10878] - *Winlogbeat* -- Prevent Winlogbeat from dropping events with invalid XML. {pull}11006{11006} -- Fix Winlogbeat escaping CR, LF and TAB characters. {issue}11328[11328] {pull}11357[11357] - *Functionbeat* ==== Added *Affecting all Beats* -- Add ip fields to default_field in Elasticsearch template. {pull}11035[11035] - *Auditbeat* -- Move System module to beta. {pull}10800[10800] - Login dataset: Add event category and type. {pull}11339[11339] *Filebeat* -- Add ISO8601 timestamp support in syslog metricset. {issue}8716[8716] {pull}10736[10736] -- Add support for loading custom NetFlow and IPFIX field definitions to netflow input. {pull}10945[10945] {pull}11223[11223] -- Added categorization fields for SSH login events in the system/auth fileset. {pull}11334[11334] - Add support for MySQL 8.0, Percona 8.0 and MariaDB 10.3. {pull}11417[11417] *Heartbeat* @@ -135,8 +69,6 @@ https://github.com/elastic/beats/compare/v7.0.0-beta1...master[Check the HEAD di *Metricbeat* -- Add filters and pie chart for AWS EC2 dashboard. {pull}10596[10596] - *Packetbeat* *Functionbeat* @@ -176,6 +108,6 @@ https://github.com/elastic/beats/compare/v7.0.0-beta1...master[Check the HEAD di *Winlogbeat* *Functionbeat* + *Journalbeat* -- Journalbeat requires at least systemd v233 in order to follow entries after journal changes (rotation, vacuum). diff --git a/libbeat/docs/release.asciidoc b/libbeat/docs/release.asciidoc index b3cf80fd1aa..de6ea316b4b 100644 --- a/libbeat/docs/release.asciidoc +++ b/libbeat/docs/release.asciidoc @@ -8,9 +8,14 @@ This section summarizes the changes in each release. Also read <> for more detail about changes that affect upgrade. +* <> * <> * <> * <> +* <> +* <> +* <> +* <> * <> * <> * <>