Beats version 5.4.0

edit

View commits

Bugfixes

edit

Affecting all Beats

  • Improve error message when downloading the dashboards fails. 3805
  • Fix potential Elasticsearch output URL parsing error if protocol scheme is missing. 3671
  • Downgrade Elasticsearch per batch item failure log to debug level. 3953
  • Make @timestamp accessible from format strings. 3721

Filebeat

  • Allow log lines without a program name in the Syslog fileset. 3944
  • Don’t stop Filebeat when modules are used with the Logstash output. 3929
  • Properly shut down crawler in case one prospector is misconfigured. 4037

Metricbeat

  • Fixing panic on the Prometheus collector when label has a comma. 3947
  • Make system process metricset honor the cpu_ticks config option. 3590

Winlogbeat

  • Fix null terminators include in raw XML string when include_xml is enabled. 3943

Added

edit

Affecting all Beats

  • Update index mappings to support future Elasticsearch 6.X. 3778

Filebeat

  • Add auditd module for reading audit logs on Linux. 3750 3941
  • Add fileset for the Linux authorization logs. 3669

Heartbeat

  • Add default ports in HTTP monitor. 3924

Metricbeat

  • Add beta Jolokia module. 3844
  • Add dashboard for the MySQL module. 3716
  • Module configuration reloading is now beta instead of experimental. 3841
  • Marked http fields from the HAProxy module optional to improve compatibility with 1.5. 3788
  • Add support for custom HTTP headers and TLS for the Metricbeat modules. 3945

Packetbeat

  • Add DNS dashboard for an overview the DNS traffic. 3883
  • Add DNS Tunneling dashboard to highlight domains with large numbers of subdomains or high data volume. 3884