Beats version 6.2.0

edit

View commits

Breaking changes

edit

Affecting all Beats

  • The log format may differ due to logging library changes. 5901
  • The default value for pipelining is reduced to 2 to avoid high memory in the Logstash beats input. 6250

Auditbeat

  • Split the audit.kernel and audit.file metricsets into their own modules named auditd and file_integrity, respectively. This change requires existing users to update their config. 5422
  • Renamed file_integrity module fields. 5423 5995
  • Renamed auditd module fields. 5423 6080

Metricbeat

  • Rename golang.heap.system.optained field to golang.heap.system.obtained. 5703
  • De dot keys in jolokia/jmx metricset to prevent collisions. 5957

Bugfixes

edit

Auditbeat

  • Fixed an issue where the proctitle value was being truncated. 6080
  • Fixed an issue where values were incorrectly interpretted as hex data. 6080
  • Fixed parsing of the key value when multiple keys are present. 6080
  • Fix possible resource leak if file_integrity module is used with config reloading on Windows or Linux. 6198

Filebeat

  • Fix variable name for convert_timezone in the system module. 5936

Metricbeat

  • Fix error datastore '*' not found in Vsphere module. 4879
  • Fix error NotAuthenticated in Vsphere module. 4673
  • Fix mongodb session consistency mode to allow command execution on secondary nodes. 4689
  • Fix kubernetes state_pod status.phase so that the active phase is returned instead of unknown. 5980
  • Fix error collecting network_names in Vsphere module. 5962
  • Fix process cgroup memory metrics for memsw, kmem, and kmem_tcp. 6033
  • Fix kafka OffsetFetch request missing topic and partition parameters. 5880

Packetbeat

  • Fix mysql SQL parser to trim \r from Windows Server SELECT\r\n\t1. 5572

Added

edit

Affecting all Beats

  • Adding a local keystore to allow user to obfuscate password 5687
  • Add autodiscover for kubernetes. 6055
  • Add Beats metrics reporting to Xpack. 3422
  • Update the command line library cobra and add support for zsh completion 5761
  • Update to Golang 1.9.2
  • Moved ip_port indexer for add_kubernetes_metadata to all beats. 5707
  • ip_port indexer now index both IP and IP:port pairs. 5721
  • Add the ability to write structured logs. 5901
  • Use structured logging for the metrics that are periodically logged via the logging.metrics feature. 5915
  • Improve Elasticsearch output metrics to count number of dropped and duplicate (if event ID is given) events. 5811
  • Add the abilility for the add_docker_metadata process to enrich based on process ID. 6100
  • The add_docker_metadata and add_kubernetes_metadata processors are now GA, instead of Beta. 6105
  • Update go-ucfg library to support top level key reference and cyclic key reference for the keystore 6098

Auditbeat

  • Auditbeat is marked as GA, no longer Beta. 5432
  • Add support for BLAKE2b hash algorithms to the file integrity module. 5926
  • Add support for recursive file watches. 5575 5833

Filebeat

  • Add Osquery module. 5971
  • Add stream filtering when using docker prospector. 6057

Metricbeat

  • Add ceph osd_df to metricbeat 5606
  • Add field network_names of hosts and virtual machines. 5646
  • Add experimental system/raid metricset. 5642
  • Add a dashboard for the Nginx module. 5991
  • Add experimental mongodb/collstats metricset. 5852
  • Update the MySQL dashboard to use the Time Series Visual Builder. 5996
  • Add experimental uwsgi module. 6006
  • Docker and Kubernetes modules are now GA, instead of Beta. 6105
  • Support haproxy stats gathering using http (additionaly to tcp socket). 5819
  • Support to optionally de dot keys in http/json metricset to prevent collisions. 5957
  • Fix dealing with new process status codes in Linux kernel 4.14+. 6306

Packetbeat

  • Configure good defaults for add_kubernetes_metadata. 5707