Skip to content

Commit ec681c8

Browse files
PavelShilin89github-actions[bot]sanikolaev
authored
Add testing of Filebeat version 9.2 (#3857)
* Added testing of filebeat version 9.2 in test-integrations-support-filebeat-versions.rec * Added configuration section for Filebeat 9.2+ with filestream input type. * For all 9.x versions, used filestream with fingerprint disabled * Replaced skip_filebeat with skip_standard_test * Fix for glibc 2.35+ compatibility (Ubuntu 22.04+) --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Sergey Nikolaev <[email protected]> Co-authored-by: PavelShilin89 <[email protected]>
1 parent 923f014 commit ec681c8

File tree

6 files changed

+104
-484
lines changed

6 files changed

+104
-484
lines changed

manual/chinese/Integration/Filebeat.md

Lines changed: 0 additions & 150 deletions
This file was deleted.

manual/english/Integration/Filebeat.md

100755100644
Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,11 @@ Now, Manticore also supports the use of Filebeat as processing pipelines. This a
1010

1111
Configuration varies depending on which version of Filebeat you're using.
1212

13-
### Configuration for Filebeat 7.17 - 8.0
13+
### Configuration for Filebeat 7.17, 8.0, 8.1
1414

15-
```
15+
> **Important**: Filebeat versions 7.17.0, 8.0.0, and 8.1.0 have a known issue with glibc 2.35+ (used in Ubuntu 22.04 and newer distributions). These versions may crash with "Fatal glibc error: rseq registration failed". To fix this, add the `seccomp` configuration as shown below.
16+
17+
```yaml
1618
filebeat.inputs:
1719
- type: log
1820
enabled: true
@@ -25,13 +27,24 @@ output.elasticsearch:
2527
hosts: ["http://localhost:9308"]
2628
index: "dpkg_log"
2729
compression_level: 0
30+
allow_older_versions: true # Required for 8.1
31+
32+
# Fix for glibc 2.35+ compatibility (Ubuntu 22.04+)
33+
seccomp:
34+
default_action: allow
35+
syscalls:
36+
- action: allow
37+
names:
38+
- rseq
2839

2940
setup.ilm.enabled: false
3041
setup.template.enabled: false
3142
setup.template.name: "dpkg_log"
3243
setup.template.pattern: "dpkg_log"
3344
```
3445
46+
**References**: [Issue #30576](https://github.com/elastic/beats/issues/30576), [PR #30620](https://github.com/elastic/beats/pull/30620)
47+
3548
3649
### Configuration for Filebeat 8.1 - 8.10
3750

manual/russian/Integration/Filebeat.md

Lines changed: 0 additions & 150 deletions
This file was deleted.

0 commit comments

Comments
 (0)