Skip to content

Commit 0cc29ef

Browse files
lcawllcawl
authored
Add Beats release notes (#2971)
1 parent 6b15433 commit 0cc29ef

File tree

3 files changed

+123
-2
lines changed

3 files changed

+123
-2
lines changed

‎docs/en/install-upgrade/index.asciidoc‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,14 +20,16 @@ include::breaking.asciidoc[]
2020

2121
include::release-notes/release-notes.asciidoc[leveloffset=+1]
2222

23+
include::release-notes/release-notes-beats.asciidoc[leveloffset=+2]
24+
25+
include::release-notes/release-notes-security.asciidoc[leveloffset=+2]
26+
2327
include::release-notes/release-notes-elasticsearch.asciidoc[leveloffset=+2]
2428

2529
include::release-notes/release-notes-kibana.asciidoc[leveloffset=+2]
2630

2731
include::release-notes/release-notes-logstash.asciidoc[leveloffset=+2]
2832

29-
include::release-notes/release-notes-security.asciidoc[leveloffset=+2]
30-
3133
include::upgrading-stack.asciidoc[]
3234

3335
include::upgrade-orchestrator.asciidoc[]

‎docs/en/install-upgrade/release-notes/release-notes-beats.asciidoc‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
// Use these for links to issue and pulls. Note issues and pulls redirect one to
2+
// each other on Github, so don't worry too much on using the right prefix.
3+
:issue: https://github.com/elastic/beats/issues/
4+
:pull: https://github.com/elastic/beats/pull/
5+
6+
[[release-notes-beats-9.0.0]]
7+
= Beats version 9.0.0-beta1
8+
++++
9+
<titleabbrev>Beats</titleabbrev>
10+
++++
11+
12+
https://github.com/elastic/beats/compare/v8.17.2\...v9.0.0-beta1[View commits]
13+
14+
== Breaking changes
15+
16+
*Affecting all Beats*
17+
18+
- Set default Kafka version to 2.1.0 in Kafka output and Filebeat. {pull}41662[41662]
19+
- Replace default Ubuntu-based images with UBI-minimal-based ones. {pull}42150[42150]
20+
- removed support for a single `-` to precede multi-letter command line arguments. Use `--` instead. {issue}42117[42117] {pull}42209[42209]
21+
22+
*Filebeat*
23+
24+
- Filebeat fails to start if there is any input with a duplicated ID. It logs the duplicated IDs and the offending inputs configurations. {pull}41731[41731]
25+
- Filestream inputs with duplicated IDs will fail to start. An error is logged showing the ID and the full input configuration. {issue}41938[41938] {pull}41954[41954]
26+
- Filestream inputs can define `allow_deprecated_id_duplication: true` to run keep the previous behaviour of running inputs with duplicated IDs. {issue}41938[41938] {pull}41954[41954]
27+
- The Filestream input only starts to ingest a file when it is >= 1024 bytes in size. This happens because the fingerprint is the default file identity now. To restore the previous behaviour, set `file_identity.native: ~` and `prospector.scanner.fingerprint.enabled: false`. {issue}40197[40197] {pull}41762[41762]
28+
- Filebeat fails to start when its configuration contains usage of the deprecated `log` or `container` inputs. However, they can still be used when `allow_deprecated_use: true` is set in their configuration. {pull}42295[42295]
29+
30+
*Osquerybeat*
31+
32+
- Upgrade osquery version to 5.13.1. {pull}40849[40849]
33+
34+
*Packetbeat*
35+
36+
- Use base-16 for reporting `serial_number` value in TLS fields in line with the ECS recommendation. {pull}41542[41542]
37+
38+
*Winlogbeat*
39+
40+
- Default to use raw API and delete older XML implementation. {pull}42275[42275]
41+
42+
== Bug fixes
43+
44+
*Auditbeat*
45+
46+
- hasher: Add a cached hasher for upcoming backend. {pull}41952[41952]
47+
- Split common tty definitions. {pull}42004[42004]
48+
49+
*Filebeat*
50+
51+
- Redact authorization headers in HTTPJSON debug logs. {pull}41920[41920]
52+
- Further rate limiting fix in the Okta provider of the Entity Analytics input. {issue}40106[40106] {pull}41977[41977]
53+
- The `_id` generation process for S3 events has been updated to incorporate the LastModified field. This enhancement ensures that the `_id` is unique. {pull}42078[42078]
54+
- Fix truncation of bodies in request tracing by limiting bodies to 10% of the maximum file size. {pull}42327[42327]
55+
- [Journald] Fixes handling of `journalctl` restart. A known symptom was broken multiline messages when there was a restart of journalctl while aggregating the lines. {issue}41331[41331] {pull}42595[42595]
56+
57+
*Metricbeat*
58+
59+
- Fix bug where Metricbeat unintentionally triggers Windows ASR. {pull}42177[42177]
60+
- Remove `hostname` field from ZooKeeper's `mntr` data stream. {pull}41887[41887]
61+
62+
*Packetbeat*
63+
64+
- Properly marshal nested structs in ECS fields, fixing issues with mixed cases in field names. {pull}42116[42116]
65+
66+
== Added
67+
68+
*Auditbeat*
69+
70+
- Improve logging in system/socket. {pull}41571[41571]
71+
72+
*Filebeat*
73+
74+
- Added out of the box support for Amazon EventBridge notifications over SQS to S3 input. {pull}40006[40006]
75+
- Update CEL mito extensions to v1.16.0. {pull}41727[41727]
76+
- Filebeat's registry is now added to the Elastic-Agent diagnostics bundle. {issue}33238[33238] {pull}41795[41795]
77+
- Add `unifiedlogs` input for MacOS. {pull}41791[41791]
78+
- Add evaluation state dump debugging option to CEL input. {pull}41335[41335]
79+
- Rate limiting operability improvements in the Okta provider of the Entity Analytics input. {issue}40106[40106] {pull}41977[41977]
80+
- Rate limiting fault tolerance improvements in the Okta provider of the Entity Analytics input. {issue}40106[40106] {pull}42094[42094]
81+
- Introduce ignore older and start timestamp filters for AWS S3 input. {pull}41804[41804]
82+
- Journald input now can report its status to Elastic-Agent. {issue}39791[39791] {pull}42462[42462]
83+
- Publish events progressively in the Okta provider of the Entity Analytics input. {issue}40106[40106] {pull}42567[42567]
84+
- Journald `include_matches.match` now accepts `+` to represent a logical disjunction (OR). {issue}40185[40185] {pull}42517[42517]
85+
- The journald input is now generally available. {pull}42107[42107]
86+
87+
*Heartbeat*
88+
89+
- Add support for RFC7231 methods to HTTP monitors. {pull}41975[41975]
90+
91+
*Metricbeat*
92+
93+
- Add `use_kubeadm` config option in kubernetes module in order to toggle kubeadm-config API requests. {pull}40086[40086]
94+
- Preserve queries for debugging when `merge_results: true` in SQL module. {pull}42271[42271]
95+
- Collect more fields from ES node/stats metrics and only those that are necessary. {pull}42421[42421]
96+
97+
*Metricbeat*
98+
- Add benchmark module. {pull}41801[41801]
99+
100+
*Osquerybeat*
101+
102+
- Increase maximum query timeout to 24 hours. {pull}42356[42356]
103+
104+
*Winlogbeat*
105+
106+
- Properly set events `UserData` when experimental API is used. {pull}41525[41525]
107+
- Include XML is respected for experimental API. {pull}41525[41525]
108+
- Forwarded events use renderedtext info for experimental API. {pull}41525[41525]
109+
- Language setting is respected for experimental API. {pull}41525[41525]
110+
- Language setting also added to decode XML wineventlog processor. {pull}41525[41525]
111+
- Format embedded messages in the experimental API. {pull}41525[41525]
112+
- Make the experimental API GA and rename it to winlogbeat-raw. {issue}39580[39580] {pull}41770[41770]
113+
- Remove 22 clause limitation. {issue}35047[35047] {pull}42187[42187]
114+
- Add handling for recoverable publisher disabled errors. {issue}35316[35316] {pull}42187[42187]
115+
116+
*Functionbeat*
117+
118+
- Remove Functionbeat binaries from CI pipelines. {issue}40745[40745] {pull}41506[41506]

‎docs/en/install-upgrade/release-notes/release-notes.asciidoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33

44
This section summarizes the changes in the {stack} releases.
55

6+
* <<release-notes-beats-9.0.0>>
67
* <<release-notes-security-9.0.0-beta1>>
78
* <<release-notes-elasticsearch-9.0.0-beta1>>
89
* <<release-notes-kibana-9.0.0-beta1>>

0 commit comments

Comments
 (0)