Beats breaking changes

edit

This list summarizes the most important breaking changes in Beats. For the complete list, go to Beats breaking changes.

Beats logs are now ECS-compliant

edit

All Elastic Beats now write ECS-compliant logs in JSON format, and the config options for enabling ECS/JSON are removed. The new log name format is {beatname}-{date}(-n)?.ndjson. For example (from oldest to newest): filebeat-20200101.ndjson, filebeat-20200101-1.ndjson, filebeat-20200101-2.ndjson, and so on.

With this change, we now provide a uniform logging scheme across Elastic products, which makes it easier to develop ECS-aware visualizations for behaviors like correlating metrics or events across products.

If you have any monitoring configurations that expect the old log format, you must update them to use the new log format.

Beats now store events in data streams instead of indices

edit

All Beats shippers now store events in data streams in Elasticsearch instead of indices regardless of the Elasticsearch version. This change affects the underlying data storage method used in Elasticsearch; it does not change the naming convention. The name of the data stream follows the format {beatname}-{version}, and the index pattern is {beatname}-{version}. Do not confuse this change with the naming convention we use in Elastic integrations.

As part of this change, some index lifecycle managment (ILM) options (rollover_alias and pattern) are removed because data streams do not require index aliases. Also the setup.template.type option is removed because it no longer makes sense.

If you are loading JSON index templates by specifying a file in setup.template.json.path, make sure you move from the legacy format to composable index templates.

Data streams support create operations only. Thus, there is no way to use operation types like "index" or "delete" when sending events to Elasticsearch.

For more information, refer to the Elasticsearch documentation about data streams.

Homebrew formulae no longer available for Beats

edit

Starting with version 8.0.0, Elastic no longer publishes Homebrew formulae for Beats. You must use a different installation method. See the Beats download pages for available installation methods.

Removal of older platforms from Beats support matrix

edit

Starting with version 8.0.0, the following operating systems are no longer supported by Beats due to lack of vendor support for the operating system. In order to have the best product experience, you are encouraged to move to a vendor-supported version of the operating system.

These platforms are:

  • Centos 6
  • Centos 8
  • RHEL 6
  • Ubuntu 14.04
  • Ubuntu 16.04
  • Debian 8
  • Windows 7 SP1
  • Windows Server 2008 R2
  • MacOS 10.13
  • MacOS 10.14