- Beats Platform Reference: other versions:
- What are Beats?
- What’s new in 7.9
- Community Beats
- Get started with Beats
- Config file format
- Upgrade
- Breaking changes
- Release notes
- Beats version 7.9.3
- Beats version 7.9.2
- Beats version 7.9.1
- Beats version 7.9.0
- Beats version 7.8.1
- Beats version 7.8.0
- Beats version 7.7.1
- Beats version 7.7.0
- Beats version 7.6.2
- Beats version 7.6.1
- Beats version 7.6.0
- Beats version 7.5.2
- Beats version 7.5.1
- Beats version 7.5.0
- Beats version 7.4.2
- Beats version 7.4.1
- Beats version 7.4.0
- Beats version 7.3.2
- Beats version 7.3.1
- Beats version 7.3.0
- Beats version 7.2.1
- Beats version 7.2.0
- Beats version 7.1.1
- Beats version 7.1.0
- Beats version 7.0.1
- Beats version 7.0.0
- Beats version 7.0.0-GA
- Beats version 7.0.0-rc2
- Beats version 7.0.0-rc1
- Beats version 7.0.0-beta1
- Beats version 7.0.0-alpha2
- Beats version 7.0.0-alpha1
- Beats version 6.8.9
- Beats version 6.8.8
- Beats version 6.8.7
- Beats version 6.8.6
- Beats version 6.8.5
- Beats version 6.8.4
- Beats version 6.8.3
- Beats version 6.8.2
- Beats version 6.8.1
- Beats version 6.7.2
- Beats version 6.7.1
- Beats version 6.7.0
- Beats version 6.6.2
- Beats version 6.6.1
- Beats version 6.6.0
- Beats version 6.5.4
- Beats version 6.5.3
- Beats version 6.5.2
- Beats version 6.5.1
- Beats version 6.5.0
- Beats version 6.4.3
- Beats version 6.4.2
- Beats version 6.4.1
- Beats version 6.4.0
- Beats version 6.3.1
- Beats version 6.3.0
- Beats version 6.2.3
- Beats version 6.2.2
- Beats version 6.2.1
- Beats version 6.2.0
- Beats version 6.1.3
- Beats version 6.1.2
- Beats version 6.1.1
- Beats version 6.1.0
- Beats version 6.0.1
- Beats version 6.0.0
- Beats version 6.0.0-GA
- Beats version 6.0.0-rc2
- Beats version 6.0.0-rc1
- Beats version 6.0.0-beta2
- Beats version 6.0.0-beta1
- Beats version 6.0.0-alpha2
- Beats version 6.0.0-alpha1
- Beats version 5.6.14
- Beats version 5.6.13
- Beats version 5.6.12
- Beats version 5.6.11
- Beats version 5.6.10
- Beats version 5.6.9
- Beats version 5.6.8
- Beats version 5.6.7
- Beats version 5.6.6
- Beats version 5.6.5
- Beats version 5.6.4
- Beats version 5.6.3
- Beats version 5.6.2
- Beats version 5.6.1
- Beats version 5.6.0
- Beats version 5.5.3
- Beats version 5.5.2
- Beats version 5.5.1
- Beats version 5.5.0
- Beats version 5.4.2
- Beats version 5.4.1
- Beats version 5.4.0
- Beats version 5.3.2
- Beats version 5.3.1
- Beats version 5.3.0
- Beats version 5.2.2
- Beats version 5.2.1
- Beats version 5.2.0
- Beats version 5.1.2
- Beats version 5.1.1
- Beats version 5.1.0 (skipped)
- Beats version 5.0.2
- Beats version 5.0.1
- Beats version 5.0.0
- Beats version 5.0.0-GA
- Beats version 5.0.0-rc1
- Beats version 5.0.0-beta1
- Beats version 5.0.0-alpha5
- Beats version 5.0.0-alpha4
- Beats version 5.0.0-alpha3
- Beats version 5.0.0-alpha2
- Beats version 5.0.0-alpha1
- Beats version 1.3.1
- Beats version 1.3.0
- Beats version 1.2.3
- Beats version 1.2.2
- Beats version 1.2.1
- Beats version 1.2.0
- Beats version 1.1.2
- Beats version 1.1.1
- Beats version 1.1.0
- Beats version 1.0.1
- Beats version 1.0.0
- Beats version 1.0.0-rc2
- Beats version 1.0.0-rc1
- Beats version 1.0.0-beta4
- Contribute to Beats
Breaking changes in 7.0
editBreaking changes in 7.0
editThis section discusses the main changes that you need to be aware of to migrate Beats to version 7.0. See the release notes for a complete list of breaking changes, including changes to beta or experimental functionality.
HTML escaping is disabled by default
editStarting with verion 7.0, embedded HTML or special symbols like <
and >
are
no longer escaped by default when publishing events.
To configure the old behavior of escaping HTML, set escape_html:
true
in the output configuration.
Filebeat registry
editStarting with version 7.0, Filebeat stores the registry in a sub-directory.
The directory is configured using the filebeat.registry.path
setting.
If Filebeat finds an old registry file at the configured location, it will
automatically migrate the registry file to the new format.
The settings filebeat.registry_flush
and filebeat.registry_file_permission
have been renamed to filebeat.registry.flush
and
filebeat.registry.file_permission
.
ILM support
editSupport for Index Lifecycle Management is GA with Beats version 7.0. This
release moved most ILM settings from the output.elasticsearch.ilm
namespace to
the setup.ilm
namespace.
Filebeat apache2 module renamed
editThe Filebeat apache2
module is renamed to apache
in 7.0.
Field name changes
editTable 1. Auditbeat renamed fields in 7.0
Old Field | New Field |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Table 2. Filebeat renamed fields in 7.0
Old Field | New Field |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Table 3. Heartbeat renamed fields in 7.0
Old Field | New Field |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Table 4. Journalbeat renamed fields in 7.0
Old Field | New Field |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Table 5. Metricbeat renamed fields in 7.0
Old Field | New Field |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Table 6. Packetbeat renamed fields in 7.0
Old Field | New Field |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Table 7. Winlogbeat renamed fields in 7.0
Old Field | New Field |
---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Auditbeat type changes
editThe Auditbeat JSON data types produced by the output have been changed to align with the data types used in the Elasticsearch index template.
Table 8. Auditbeat Type Changes in 7.0
Field | Old Type | New Type |
---|---|---|
|
number |
string |
|
number |
string |
|
string |
number |
|
string |
number |
On this page