-
Notifications
You must be signed in to change notification settings - Fork 4.9k
/
CHANGELOG.asciidoc
10606 lines (7294 loc) · 480 KB
/
CHANGELOG.asciidoc
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
// Use these for links to issue and pulls. Note issues and pulls redirect one to
// each other on Github, so don't worry too much on using the right prefix.
:issue: https://github.com/elastic/beats/issues/
:pull: https://github.com/elastic/beats/pull/
[[release-notes-8.13.4]]
=== Beats version 8.13.4
https://github.com/elastic/beats/compare/v8.13.3\...v8.13.4[View commits]
==== Bugfixes
*Auditbeat*
- Prevent scenario of losing children-related file events in a directory for recursive fsnotify backend of auditbeat file integrity module. {pull}39133[39133]
- Allow extra syscalls by auditbeat required in FIM with kprobes back-end. {pull}39361[39361]
- Fix losing events in FIM for MacOS X by allowing always to walk an added directory to monitor. {pull}39362[39362]
*Metricbeat*
- Fix Azure Monitor support for multiple aggregation types. {issue}39192[39192] {pull}39204[39204]
[[release-notes-8.13.3]]
=== Beats version 8.13.3
https://github.com/elastic/beats/compare/v8.13.2\...v8.13.3[View commits]
==== Breaking changes
*Metricbeat*
- Setting period for counter cache for Prometheus `remote_write` to at least to 60 seconds. {pull}38553[38553]
==== Bugfixes
*Affecting all Beats*
- Change cache processor documentation from `write_period` to `write_interval`. {pull}38561[38561]
- Fix cache processor expiries heap cleanup on partial file writes. {pull}38561[38561]
- Fix cache processor expiries infinite growth when large a large TTL is used and recurring keys are cached. {pull}38561[38561]
- Fix parsing of RFC 3164 process IDs in syslog processor. {issue}38947[38947] {pull}38982[38982]
*Filebeat*
- Fix indexing failures by re-enabling event normalisation in netflow input. {issue}38703[38703] {pull}38780[38780]
- Fix config validation for CEL and HTTPJSON inputs when using password grant authentication and `client.id` or `client.secret` are not present. {pull}38962[38962]
- Updated Websocket input title to align with existing inputs. {pull}39006[39006]
- [threatintel] MISP splitting fix for empty responses. {issue}38739[38739] {pull}38917[38917]
- Restore netflow input on Windows. {pull}39024[39024]
==== Added
*Affecting all Beats*
- Update Go version to 1.21.9. {pulk}38727[38727]
- The environment variable `BEATS_ADD_CLOUD_METADATA_PROVIDERS` overrides configured/default `add_cloud_metadata` providers. {pull}38669[38669]
*Auditbeat*
- Add process data to file events (Linux only, eBPF backend). {pull}38199[38199]
- Add container id to file events (Linux only, eBPF backend). {pull}38328[38328]
*Metricbeat*
- Add new fields to configure the lease duration, retry and renew when using leader elector with Kubernetes autodiscover.{pull}38471[38471]
[[release-notes-8.13.2]]
=== Beats version 8.13.2
https://github.com/elastic/beats/compare/v8.13.1\...v8.13.2[View commits]
==== Bugfixes
*Heartbeat*
- Fix reference yaml format. {pull}38584[38584]
[[release-notes-8.13.1]]
=== Beats version 8.13.1
https://github.com/elastic/beats/compare/v8.13.0\...v8.13.1[View commits]
==== Bugfixes
*Filebeat*
- Fix Filebeat GCS input panic. {pull}38407[38407]
*Heartbeat*
- Reset prctl dumpable flag after cap drop. {pull}38269[38269]
[[release-notes-8.13.0]]
=== Beats version 8.13.0
https://github.com/elastic/beats/compare/v8.12.2\...v8.13.0[View commits]
==== Breaking changes
*Affecting all Beats*
- Upgrade Go version to 1.21.8. Removes support for Windows 8.1. See https://tip.golang.org/doc/go1.21#windows. {pull}38209[38209]
- The behavior of `queue.mem.flush.min_events` has been simplified. It now serves as a simple maximum on the size of all event batches. There are no longer performance implications in its relationship to `bulk_max_size`. {pull}37795[37795]
*Auditbeat*
- Add opt-in `KProbes` backend for file_integrity module. {pull}37796[37796]
*Filebeat*
- Convert netflow input to API v2 and disable event normalisation. {pull}37901[37901]
*Winlogbeat*
- Add "keystore.path" configuration settings to $workdir\data\{{.BeatName}}.keystore. {issue}12315[12315] {pull}37237[37237]
==== Bugfixes
*Affecting all Beats*
- Support Elastic Agent control protocol chunking support. {pull}37343[37343]
- Upgrade elastic-agent-libs to v0.7.5. Removes obsolete "Treating the CommonName field on X.509 certificates as a host name..." deprecation warning for 8.0. {pull}37755[37755]
- Fix the paths in the .cmd script added to the path by the Windows MSI to point to the new C:\Program Files installation location. https://github.com/elastic/elastic-stack-installers/pull/238
- Upgrade elastic-agent-system-metrics to v0.9.2. Skips permissions errors when reading /proc/pid/io. {pull}38234[38234].
*Filebeat*
- Fix a race condition that could crash Filebeat with a "negative WaitGroup counter" error. {pull}38094[38094]
- Fix "failed processing S3 event for object key" error on aws-s3 input when key contains the "+" character. {issue}38012[38012] {pull}38125[38125]
- Fix duplicated addition of regexp extension in CEL input. {pull}38181[38181]
- Fix HTTPJSON handling of empty object bodies in POST requests. {issue}33961[33961] {pull}38290[38290]
- Fix PEM key validation for CEL and HTTPJSON inputs. {pull}38405[38405]
*Heartbeat*
- Adjust State loader to only retry when response code status is 5xx. {pull}37981[37981]
*Metricbeat*
- Fix Azure Monitor 429 error by causing Metricbeat to retry the request again. {pull}38294[38294]
- Fix fields not being parsed correctly in postgresql/database. {issue}25301[25301] {pull}37720[37720]
==== Added
*Affecting all Beats*
- Ignore Kubernetes node and namespace update events that do not change pod metadata. {issue}37338[37338] {pull}37431[37431]
- Enhance add_cloud_metadata processor with `orchestrator.cluster.name`, `orchestrator.cluster.id` and `azure.resourcegroup.name` when running inside an AKS cluster. {issue}33081[33081] {pull}37685[37685]
- Upgrade go-sysinfo from 1.12.0 to 1.13.1. {pull}37996[37996]
- Make `range` condition work with numeric values as strings. {pull}38080[38080]
- Allow users to configure number of output workers (for outputs that support workers) with either `worker` or `workers`. {pull}38257[38257]
- Kafka output now validates the `topics` and `topic` configuration values. {pull}38058[38058]
*Auditbeat*
- Add Linux capabilities to processes in the system/process. {pull}37453[37453]
- Add opt-in eBPF backend for file_integrity module. {pull}37223[37223]
*Filebeat*
- Update SQL input documentation regarding Oracle DSNs {pull}37590[37590]
- Add support for complete URL replacement in HTTPJSON chain steps. {pull}37486[37486]
- Add support for user-defined query selection in EntraID entity analytics provider. {pull}37653[37653]
- Update CEL extensions library to v1.8.0 to provide runtime error location reporting. {issue}37304[37304] {pull}37718[37718]
- Add request trace logging for chained API requests. {issue}37551[36551] {pull}37682[37682]
- Add support for PEM-based Okta auth in HTTPJSON. {pull}37772[37772]
- Prevent complete loss of long request trace data. {issue}37826[37826] {pull}37836[37836]
- Added experimental version of the Websocket Input. {pull}37774[37774]
- Add support for PEM-based Okta auth in CEL. {pull}37813[37813]
- Add ETW input. {pull}36915[36915]
- Update CEL mito extensions to v1.9.0 to add keys/values helper. {pull}37971[37971]
- Add parseDateInTZ value template for the HTTPJSON input. {pull}37738[37738]
- Improve rate limit handling by HTTPJSON. {issue}36207[36207] {pull}38161[38161] {pull}38237[38237]
*Libbeat*
- Add watcher that can be used to monitor Linux kernel events. {pull}37833[37833]
- Added support for ETW reader. {pull}36914[36914]
*Heartbeat*
- Upgrade github.com/elastic/go-elasticsearch/v8 to v8.12.0. {pull}37673[37673]
*Metricbeat*
- Fix containerd metrics grouping for TSDB. {pull}37537[37537]
*Packetbeat*
- Bump Windows Npcap version to v1.79. {pull}37733[37733]
- Add support for pipeline loading. {pull}37291[37291]
[[release-notes-8.12.2]]
=== Beats version 8.12.2
https://github.com/elastic/beats/compare/v8.12.1\...v8.12.2[View commits]
==== Bugfixes
*Filebeat*
- [threatintel] MISP pagination fixes. {pull}37898[37898]
- Fix file handle leak when handling errors in filestream. {pull}37973[37973]
*Packetbeat*
- Fix interface device parsing for packetbeat protocols. {pull}37946[37946]
==== Added
*Metricbeat*
- Update `getOpTimestamp` in `replstatus` to fix sort and temp files generation issue in MongoDB. {pull}37688[37688]
[[release-notes-8.12.1]]
=== Beats version 8.12.1
https://github.com/elastic/beats/compare/v8.12.0\...v8.12.1[View commits]
==== Known Issues
*Affecting all Beats*
Performance regression in AWS S3 inputs using SQS notification.
In 8.12 the default memory queue flush interval was raised from 1 second to 10 seconds. In many configurations this improves performance because it allows the output to batch more events per round trip, which improves efficiency. However, the SQS input has an extra bottleneck that interacts badly with the new value. For more details see {issue}37754[37754].
If you are using the Elasticsearch output, and your output configuration uses a performance preset, switch it to `preset: latency`. If you use no preset or use `preset: custom`, then set `queue.mem.flush.timeout: 1s` in your queue or output configuration.
==== Breaking changes
*Affecting all Beats*
- add_cloud_metadata processor: `huawei` provider is now treated as `openstack`. Huawei cloud runs on OpenStack
platform, and when viewed from a metadata API standpoint, it is impossible to differentiate it from OpenStack. If you
know that your deployments run on Huawei Cloud exclusively, and you wish to have `cloud.provider` value as `huawei`,
you can achieve this by overwriting the value using an `add_fields` processor. {pull}35184[35184]
==== Bugfixes
*Affecting all Beats*
- aws: Add credential caching for `AssumeRole` session tokens. {issue}37787[37787]
- Lower logging level to debug when attempting to configure beats with unknown fields from autodiscovered events/environments. {pull}[37816][37816]
*Filebeat*
- Fix nil pointer dereference in the httpjson input. {pull}37591[37591]
- Fix TCP/UDP metric queue length parsing base. {pull}37714[37714]
- Fix m365_defender cursor value and query building. {pull}37116[37116]
- Update github.com/lestrrat-go/jwx dependency. {pull}37799[37799]
*Heartbeat*
- Fix setuid root when running under cgroups v2. {pull}37794[37794]
*Metricbeat*
- Fix Azure Resource Metrics missing metrics (min and max aggregations) after upgrade to 8.11.3. {issue}37642[37642] {pull}37643[37643]
==== Added
*Filebeat*
- Relax TCP/UDP metric polling expectations to improve metric collection. {pull}37714[37714]
[[release-notes-8.12.0]]
=== Beats version 8.12.0
https://github.com/elastic/beats/compare/v8.11.4\...v8.12.0[View commits]
==== Known Issues
*Affecting all Beats*
Performance regression in AWS S3 inputs using SQS notification.
In 8.12 the default memory queue flush interval was raised from 1 second to 10 seconds. In many configurations this improves performance because it allows the output to batch more events per round trip, which improves efficiency. However, the SQS input has an extra bottleneck that interacts badly with the new value. For more details see {issue}37754[37754].
If you are using the Elasticsearch output, and your output configuration uses a performance preset, switch it to `preset: latency`. If you use no preset or use `preset: custom`, then set `queue.mem.flush.timeout: 1s` in your queue or output configuration.
If you are not using the Elasticsearch output, set `queue.mem.flush.timeout: 1s` in your queue or output configuration.
==== Breaking changes
*Affecting all Beats*
- Windows MSI installers now store configuration in C:\Program Files instead of C:\ProgramData. https://github.com/elastic/elastic-stack-installers/pull/209
*Heartbeat*
- Decrease the ES default timeout to 10 for the load monitor state requests.
- Windows MSI installers now store configuration in C:\Program Files instead of C:\ProgramData. https://github.com/elastic/elastic-stack-installers/pull/209
*Osquerybeat*
- Upgrade to osquery 5.10.2. {pull}37115[37115]
==== Bugfixes
*Filebeat*
- Add validation to the `http_endpoint` config for empty URL. {pull}36816[36816] {issue}36772[36772]
- Fix merging of array fields (processors, paths, parsers) in configurations generated from hints and default config. {issue}36838[36838] {pull}36857[36857]
==== Added
*Affecting all Beats*
- Allow `queue` configuration settings to be set under the output. {issue}35615[35615] {pull}36788[36788]
- Raise up logging level to warning when attempting to configure {beats} with unknown fields from autodiscovered events/environments.
- Elasticsearch output now supports `idle_connection_timeout`. {issue}35616[35615] {pull}36843[36843]
- Upgrade to Go 1.20.12. {pull}37350[37350]
- The Elasticsearch output can now configure performance presets with the `preset` configuration field. {pull}37259[37259]
- Upgrade `elastic-agent-system-metrics` to v0.9.1. See https://github.com/elastic/elastic-agent-system-metrics/releases/tag/v0.9.1. {pull}37353[37353]
- Upgrade to elastic-agent-libs v0.7.3 and golang.org/x/crypto v0.17.0. {pull}37544[37544]
*Auditbeat*
- Add `ignore_errors` option to audit module. {issue}15768[15768] {pull}36851[36851]
- Fix copy arguments for strict aligned architectures. {pull}36976[36976]
*Filebeat*
- Allow http_endpoint input to receive PUT and PATCH requests. {pull}36734[36734]
- Avoid unwanted publication of Azure entity records. {pull}36753[36753]
- Avoid unwanted publication of Okta entity records. {pull}36770[36770]
- Add support for Digest Authentication to CEL input. {issue}35514[35514] {pull}36932[36932]
- Use filestream input with `file_identity.fingerprint` as default for hints autodiscover. {issue}35984[35984] {pull}36950[36950]
- Add network processor in addition to interface based direction resolution. {pull}37023[37023]
- Make CEL input log current transaction ID when request tracing is turned on. {pull}37065[37065]
- Make Azure Blob Storage input GA and update docs accordingly. {pull}37128[37128]
- Add request trace logging to http_endpoint input. {issue}36951[36951] {pull}36957[36957]
- Make GCS input GA and update docs accordingly. {pull}37127[37127]
- Suppress and log max HTTP request retry errors in CEL input. {pull}37160[37160]
- Prevent CEL input from re-entering the eval loop when an evaluation failed. {pull}37161[37161]
- Update CEL extensions library to v1.7.0. {pull}37172[37172]
*Auditbeat*
- Upgrade go-libaudit to v2.4.0. {issue}36776[36776] {pull}36964[36964]
- Add a `/inputs/` route to the HTTP monitoring endpoint that exposes metrics for each dataset instance. {pull}36971[36971]
*Heartbeat*
- Capture and log the individual connection metrics for all the lightweight monitors.
*Metricbeat*
- Add metrics grouping by dimensions and time to Azure app insights. {pull}36634[36634]
- Align on the algorithm used to transform Prometheus histograms into Elasticsearch histograms. {pull}36647[36647]
- Enhance GCP billing with detailed tables identification, additional fields, and optimized data handling. {pull}36902[36902]
- Add a `/inputs/` route to the HTTP monitoring endpoint that exposes metrics for each metricset instance. {pull}36971[36971]
- Add Linux IO metrics to system/process. {pull}37213[37213]
- Add new memory/cgroup metrics to Kibana module. {pull}37232[37232]
*Packetbeat*
- Add metrics for TCP flags. {issue}36992[36992] {pull}36975[36975]
*Winlogbeat*
- Make ingest pipeline routing robust to letter case of channel names for forwarded events. {issue}36670[36670] {pull}36899[36899]
- Document minimum permissions required for local user account. {issue}15773[15773] {pull}37176[37176]
==== Deprecated
*Filebeat*
- Deprecate rsa2elk Filebeat modules. {issue}36125[36125] {pull}36887[36887]
[[release-notes-8.11.4]]
=== Beats version 8.11.4
https://github.com/elastic/beats/compare/v8.11.3\...v8.11.4[View commits]
==== Bugfixes
*Heartbeat*
- Added fix for formatting the logs from stateloader properly. {pull}37369[37369]
- Remove duplicated syscall from ARM seccomp profile. {pull}37440[37440]
*Metricbeat*
- Nest the `region` and `availability_zone` ECS fields within the cloud field. {pull}37015[37015]
- Fix CPU and memory metrics collection from privileged process on Windows. {issue}17314[17314]{pull}37027[37027]
- Add memory hard limit from container metadata and remove usage percentage in AWS Fargate. {pull}37194[37194]
- Ignore parser errors from unsupported metrics types on Prometheus client and continue parsing until EOF is reached. {pull}37383[37383]
- Fix the reference time rounding on Azure Metrics. {issue}37204[37204] {pull}37365[37365]
==== Added
*Packetbeat*
- Bump Windows Npcap version to v1.78. {issue}37300[37300] {pull}37370[37370]
[[release-notes-8.11.3]]
=== Beats version 8.11.3
https://github.com/elastic/beats/compare/v8.11.2\...v8.11.3[View commits]
The 8.11.3 patch release contains a fix for a potential security vulnerability. Please see our link:https://discuss.elastic.co/c/announcements/security-announcements/31[security advisory for more details].
==== Breaking changes
*Affecting all Beats*
- `queue.mem.events` is changing from `4096` to `3200`.
- `queue.mem.flush.min_events` is changing from `2048` to `1600`.
- `queue.mem.flush.timeout` is changing from `1s` to `10s`.
- `output.elasticsearch.bulk_max_size` is changing from `50` to `1600`.
- `output.elasticsearch.idle_connection_timeout` is changing from `60s` to `3s`.
[[release-notes-8.11.2]]
=== Beats version 8.11.2
https://github.com/elastic/beats/compare/v8.11.1\...v8.11.2[View commits]
==== Breaking changes
*Affecting all Beats*
- Avoid logging fields values when handling Elasticsearch output errors except at the debug log level. The debug log level must now be used to see detailed errors, for example mapping errors and their cause. {pull}37229[37229]
==== Bugfixes
*Affecting all Beats*
- Fix memqueue producer blocking indefinitely even after being cancelled. {issue}22813[22813] {pull}37077[37077]
*Auditbeat*
- Fix documentation regarding socket type selection. {issue}37174[37174] {pull}37175[37175]
- Fix guess trigger for system/socket credentials on newer kernels. {issue}36905[36905] {pull}37136[37136]
*Filebeat*
- Do not error when Okta API returns no data. {pull}37092[37092]
- Fix request body close behaviour in HTTP_Endpoint when handling GZIP compressed content. {pull}37091[37091]
- Make CEL input `now` global evaluate to a time in UTC. {pull}37159[37159]
*Heartbeat*
- Fix mapping errors with invalid URLs. {pull}37255[37255]
*Metricbeat*
- Fix memory leak on Windows {issue}37142[37142] {pull}37171[37171]
- Enhance Azure Metrics metricset with refined grouping logic and resolved duplication issues for TSDB compatibility. {pull}36823[36823]
- Fix unintended skip in metric collection on Azure Monitor. {issue}37204[37204] {pull}37203[37203]
- Fix the "api-version query parameter (?api-version=) is required for all requests" error in Azure Billing. {pull}37158[37158]
- add_cloud_metadata: fix the `orchestrator` metadata for the aws cloud provider
*Winlogbeat*
- Fix dashboards under Kibana 8.x. {issue}37080[37080] {pull}37085[37085]
==== Added
*Affecting all Beats*
- Upgrade to Go 1.20.11. {pull}37123[37123]
[[release-notes-8.11.1]]
=== Beats version 8.11.1
https://github.com/elastic/beats/compare/v8.11.0\...v8.11.1[View commits]
IMPORTANT: Due to a memory leak issue, Windows users running {agent} are recommended to avoid upgrading to this release and instead use the 8.11.2 release in which the issue is resolved. If you've already upgraded to version 8.11.0 or 8.11.1, we recommend upgrading to 8.11.2 as soon as possible.
==== Added
*Affecting all Beats*
- Setting environmental variable `ELASTIC_NETINFO:false` will disable the `netinfo.enabled` option of add_host_metadata processor.
[[release-notes-8.11.0]]
=== Beats version 8.11.0
https://github.com/elastic/beats/compare/v8.10.4\...v8.11.0[View commits]
IMPORTANT: Due to a memory leak issue, Windows users running {agent} are recommended to avoid upgrading to this release and instead use the 8.11.2 release in which the issue is resolved. If you've already upgraded to version 8.11.0 or 8.11.1, we recommend upgrading to 8.11.2 as soon as possible.
==== Breaking changes
*Affecting all Beats*
- The Elasticsearch output now enables compression by default. This decreases network data usage by an average of 70-80%, in exchange for 20-25% increased CPU use and ~10% increased ingestion time. The previous default can be restored by setting the flag `compression_level: 0` under `output.elasticsearch`. {pull}36681[36681]
- The `elastic-agent-autodiscover` library is updated to version 0.6.4, disabling metadata for deployment and cronjob. Pods that will be created from deployments or cronjobs will not have the extra metadata field for `kubernetes.deployment` or `kubernetes.cronjob`, respectively. {pull}36879[36879]
*Filebeat*
- Switch types of `log.file.device`, `log.file.inode`, `log.file.idxhi`, `log.file.idxlo` and `log.file.vol` fields to strings to better align with ECS and integrations. {pull}36697[36697]
*Metricbeat*
- The System module now collects the number of threads per process. The elastic-agent-system-metrics was updated to v0.7.0 as this version collects the number of threads.
==== Bugfixes
*Affecting all Beats*
- Upgrade `elastic-agent-libs` to v0.6.0, allowing a Beat running as a Windows service to receive more than one change request. {pull}36896[36896]
*Filebeat*
- Added a fix for the Crowdstrike pipeline handling of process arrays. {pull}36496[36496]
- Fix handling of response errors in HTTPJSON and CEL request trace logging. {pull}36956[36956]
*Heartbeat*
- Fix retries to trigger on a down monitor with no previous state. {pull}36842[36842]
- Bump NodeJS minor version to 18.18.2. {pull}36961[36961]
- Fix monitor duration calculation with retries. {pull}36900[36900]
*Metricbeat*
- Fix Azure Monitor empty metricnamespace. {pull}36295[36295]
- Fix GCP compute metadata. {pull}36338[36338]
- Add missing 'TransactionType' dimension for Azure Storage Account. {pull}36413[36413]
- Add log error when statsd server fails to start. {pull}36477[36477]
- Fix CassandraConnectionClosures metric configuration. {pull}34742[34742]
- Fix event mapping implementation for statsd module. {pull}36925[36925]
*Winlogbeat*
- Fix User Account Control Attributes Table values for Security module. {issue}36999[36999] {pull}37009[37009]
==== Added
*Affecting all Beats*
- Upgrade to Go 1.20.10. {pull}36846[36846]
- Add support for forward lookups (`A`, `AAAA`, and `TXT`) in DNS processor. {issue}11416[11416] {pull}36394[36394]
- Mark `syslog` processor as GA, improve docs about how processor handles syslog messages. {issue}36416[36416] {pull}36417[36417]
- Add support for AWS external IDs. {issue}36321[36321] {pull}36322[36322]
- Disable `netinfo.enabled` option of `add-host-metadata processor`to enhance `host.ip` and `host.mac`. {pull}36506[36506]
- {Beats} will now connect to older {es} instances by default. {pull}36884[36884]
- Upgrade golang/x/net to v0.17.0. Updates the publicsuffix table used by the registered_domain processor. {pull}36969[36969]
*Filebeat*
- Reduce HTTPJSON metrics allocations. {pull}36282[36282]
- Add support for a simplified input configuraton when running under {agent}. {pull}36390[36390]
- Make HTTPJSON response body decoding errors more informative. {pull}36481[36481]
- Allow fine-grained control of entity analytics API requests for Okta provider. {issue}36440[36440] {pull}36492[36492]
- Add support for expanding `journald.process.capabilities` into the human-readable effective capabilities in the ECS `process.thread.capabilities.effective` field. {issue}36454[36454] {pull}36470[36470]
- Allow fine-grained control of entity analytics API requests for AzureAD provider. {issue}36440[36440] {pull}36441[36441]
- For request tracer logging in CEL and httpjson the request and response body are no longer included in `event.original`. The body is still present in `http.{request,response}.body.content`. {pull}36531[36531]
- Add support for Okta OAuth2 provider in the CEL input. {issue}36336[36336] {pull}36521[36521]
- Improve error logging in HTTPJSON input. {pull}36529[36529]
- Disable warning message about ingest pipeline loading when running under Elastic Agent. {pull}36659[36659]
- Add input metrics to http_endpoint input. {issue}36402[36402] {pull}36427[36427]
- Remove Event Normalization from GCP PubSub Input. {pull}36716[36716]
- Add support for new features & removed partial save mechanism in the Azure Blob Storage input. {issue}35126[35126] {pull}36690[36690]
- Improve template evaluation logging for HTTPJSON input. {pull}36668[36668]
- Add CEL partial value debug function. {pull}36652[36652]
- Add support for new features and remove partial save mechanism in the GCS input. {issue}35847[35847] {pull}36713[36713]
- Add cache processor. {pull}36786[36786]
*Packetbeat*
- Bump Windows Npcap version to v1.76. {issue}36539[36539] {pull}36549[36549]
[[release-notes-8.10.4]]
=== Beats version 8.10.4
https://github.com/elastic/beats/compare/v8.10.3\...v8.10.4[View commits]
[[release-notes-8.10.3]]
=== Beats version 8.10.3
https://github.com/elastic/beats/compare/v8.10.2\...v8.10.3[View commits]
==== Bugfixes
*Affecting all Beats*
- syslog processor - Fix the ability to use `when` conditions on the processor. {issue}36762[36762]
*Packetbeat*
- Fix default cache size calculation. {pull}36723[36723]
==== Added
*Filebeat*
- Update mito CEL extension library to v1.6.0. {pull}36651[36651]
- Re-use buffers to optimise memory allocation in fingerprint mode of filestream {pull}36736[36736]
*Packetbeat*
- Improve efficiency of sniffers by deduplicating interface configurations. {issue}36574[36574] {pull}36576[36576]
[[release-notes-8.10.2]]
=== Beats version 8.10.2
https://github.com/elastic/beats/compare/v8.10.1\...v8.10.2[View commits]
==== Bugfixes
*Packetbeat*
- Prevent panic when more than one interface is configured in Fleet. {issue}36574[36574] {pull}36575[36575]
==== Added
*Affecting all Beats*
- Upgrade Go to 1.20.8 {pull}36597[36597]
[[release-notes-8.10.1]]
=== Beats version 8.10.1
https://github.com/elastic/beats/compare/v8.10.0\...v8.10.1[View commits]
==== Bugfixes
*Filebeat*
- Revert error introduced in {pull}35734[35734] when symlinks can't be resolved in filestream. {pull}36557[36557]
- Fix ignoring external input configuration in `take_over: true` mode {issue}36378[36378] {pull}36395[36395]
[[release-notes-8.10.0]]
=== Beats version 8.10.0
https://github.com/elastic/beats/compare/v8.9.2\...v8.10.0[View commits]
==== Bugfixes
*Affecting all Beats*
- Improve StreamBuf append to improve performance when reading long lines from files. {pull}35928[35928]
- Eliminate cloning of event in deepUpdate {pull}35945[35945]
- Fix ndjson parser to store JSON fields correctly under `target` {issue}29395[29395]
- Add default cgroup regex for `add_process_metadata` processor {pull}36484[36484] {issue}32961[32961]
- Fix environment capture by `add_process_metadata` processor. {issue}36469[36469] {pull}36471[36471]
- Fix status reporting to {agent} when output configuration is invalid running under Elastic-Agent {pull}35719[35719]
*Filebeat*
- Fix error message formatting from filestream input. {pull}35658[35658]
- Fixed concurrency and flaky tests issue in Azure Blob Storage input. {issue}35983[35983] {pull}36124[36124]
- Filter out duplicate paths resolved from matching globs. {issue}36253[36253] {pull}36256[36256]
- Remove 'onFilteredOut' and 'onDroppedOnPublish' callback logs {issue}36299[36299] {pull}36399[36399]
- Ensure winlog input retains metric collection when handling recoverable errors. {issue}36479[36479] {pull}36483[36483]
*Metricbeat*
- Fix the gap in fetching forecast API metrics at the end of each month for Azure billing module {pull}36142[36142]
- Add option in SQL module to execute queries for all databases. {pull}35688[35688]
- Add support for api_key authentication in elasticsearch module {pull}36274[36274]
- Add remaining dimensions for Azure storage account to make them available for TSDB enablement. {pull}36331[36331]
*Packetbeat*
- Fix panic in HTTP protocol parsing when host header has empty host part. {issue}36497[36497] {issue}36518[36518]
*Winlogbeat*
- Ensure event loggers retains metric collection when handling recoverable errors. {issue}36479[36479] {pull}36483[36483]
- Fix the ability to use filtering features (e.g. `ignore_older`, `event_id`, `provider`, `level`) while reading `.evtx` files. {issue}16826[16826] {pull}36173[36173]
==== Added
*Affecting all Beats*
- When running under Elastic-Agent the status is now reported per Unit instead of the whole Beat {issue}35874[35874] {pull}36183[36183]
- Mark `translate_sid` processor is GA. {issue}36279[36279] {pull}36280[36280]
- Upgrade Go to 1.20.7 {pull}36241[36241]
*Auditbeat*
- Add support for `security.selinux` and `system.posix_acl_access` extended attributes to FIM. {issue}36265[36265] {pull}36310[36310]
*Filebeat*
- Adding filename details from zip to response for httpjson {issue}33952[33952] {pull}34044[34044]
- Allow specifying since when to read journald entries. {pull}35408[35408]
- Under elastic-agent the input metrics will now be included in agent diagnostics dumps. {pull}35798[35798]
- Improve CEL input performance. {pull}35915[35915]
- Added support for min/max template functions in httpjson input. {issue}36094[36094] {pull}36036[36036]
- Add `clean_session` configuration setting for MQTT input. {pull}35806[35806]
- Add fingerprint mode for the filestream scanner and new file identity based on it {issue}34419[34419] {pull}35734[35734]
- Add file system metadata to events ingested via filestream {issue}35801[35801] {pull}36065[36065]
- Add support for localstack based input integration testing {pull}35727[35727]
- Allow parsing bytes in and bytes out as long integer in CEF processor. {issue}36100[36100] {pull}36108[36108]
- Add support for registered owners and users to AzureAD entity analytics provider. {pull}36092[36092]
- Added support for Okta OAuth2 provider in the httpjson input. {pull}36273[36273]
- Add support of the interval parameter in Salesforce setupaudittrail-rest fileset. {issue}35917[35917] {pull}35938[35938]
- Add device handling to Okta input package for entity analytics. {pull}36049[36049]
- Add setup option `--force-enable-module-filesets`, that will act as if all filesets have been enabled in a module during setup. {issue}30915[30915] {pull}36286[36286]
- [Azure] Add input metrics to the azure-eventhub input. {pull}35739[35739]
*Metricbeat*
- Add support for multiple regions in GCP {pull}32964[32964]
- Add kubernetes.deployment.status.* fields for Kubernetes module {pull}35999[35999]
*Packetbeat*
- Under elastic-agent the input metrics will now be included in agent diagnostics dumps. {pull}35798[35798]
- Add support for multiple regions in GCP {pull}32964[32964]
*Winlogbeat*
- Under elastic-agent the input metrics will now be included in agent diagnostics dumps. {pull}35798[35798]
==== Deprecated
*Heartbeat*
- Deprecate aws_elb autodiscover provider. {pull}36191[36191]
[[release-notes-8.9.2]]
=== Beats version 8.9.2
https://github.com/elastic/beats/compare/v8.9.1\...v8.9.2[View commits]
==== Bugfixes
*Filebeat*
- Fix panic when redact option is not provided to CEL input. {issue}36387[36387] {pull}36388[36388]
- Update mito CEL extension library to v1.5.0. {pull}36146[36146]
==== Added
*Metricbeat*
- Add Azure resource tags support to Azure Billing module {pull}36428[36428]
[[release-notes-8.9.1]]
=== Beats version 8.9.1
https://github.com/elastic/beats/compare/v8.9.0\...v8.9.1[View commits]
==== Bugfixes
*Auditbeat*
- auditd: Expanded the bitmask applied to ECS file.mode so that the SUID, SGID, and sticky bits can be represented. {pull}36294[36294]
*Filebeat*
- Fix panic when SQS input metrics getter is invoked. {pull}36101[36101] {issue}36077[36077]
- Make CEL input's `now` global variable static for evaluation lifetime. {pull}36107[36107]
- Fix handling of TCP/UDP address resolution during metric initialization. {issue}35064[35064] {pull}36287[36287]
- Fix handling of Juniper SRX structured data when there is no leading Junos element. {issue}36270[36270] {pull}36308[36308]
- Remove erroneous error log in GCPPubSub input. {pull}36296[36296]
- Fix Filebeat Cisco module with missing escape character. {issue}36325[36325] {pull}36326[36326]
*Heartbeat*
- Enable heartbeat-wide publish timeout setting with run_once. {pull}35721[35721]
- Added default timezone UTC to heartbeat docker images to fix synthetics journeys navigation errors. {pull}36193[36193]
*Packetbeat*
- Fix handling of Npcap installation options from Fleet. {pull}35541[35541] {pull}35935[35935]
*Winlogbeat*
- Fix powershell details regexp to prevent excessive backtracking when processing command invocations. {pull}36178[36178]
==== Added
*Affecting all Beats*
- Upgrade Go to 1.19.12 {pull}36246[36246]
- Add warning message to SysV init scripts for RPM-based systems that lack `/etc/rc.d/init.d/functions`. {issue}35708[35708] {pull}36188[36188]
*Filebeat*
- Add support for endpoint resolver in AWS config {pull}36208[36208]
[[release-notes-8.9.0]]
=== Beats version 8.9.0
https://github.com/elastic/beats/compare/v8.8.2\...v8.9.0[View commits]
==== Bugfixes
*Affecting all Beats*
- Do not print context cancelled error message when running under agent {pull}36006[36006]
- Fix recovering from invalid output configuration when running under Elastic-Agent {pull}36016[36016]
*Filebeat*
- Add support in s3 input for JSON with array of objects. {pull}35475[35475]
- RFC5424 syslog timestamps with offset 'Z' will be treated as UTC rather than using the default timezone. {pull}35360[35360]
- Fixed a minor code error in the GCS input scheduler where a config value was being used directly instead of the source struct. {pull}35729[35729]
- Fix CEL input JSON marshalling of nested objects. {issue}35763[35763] {pull}35774[35774]
- Fix metric collection in GCPPubSub input. {pull}35773[35773]
- Fix end point deregistration in http_endpoint input. {issue}35899[35899] {pull}35903[35903]
- Fix duplicate ID panic in filestream metrics. {issue}35964[35964] {pull}35972[35972]
- Improve error reporting and fix IPv6 handling of TCP and UDP metric collection. {pull}35996[35996]
- Fix handling of NUL-terminated log lines in Fortinet Firewall module. {issue}36026[36026] {pull}36027[36027]
- Make redact field configuration recommended in CEL input and log warning if missing. {pull}36008[36008]
- Fix handling of region name configuration in awss3 input {pull}36034[36034]
*Heartbeat*
- Update gval version. {pull}35636[35636]
- Filter dev flags for ui monitors inside synthetics_args. {pull}35788[35788]
- Fix temp dir running out of space with project monitors. {issue}35843[35843]
*Metricbeat*
- Fix no error logs displayed in CloudWatch EC2, RDS and SQS metadata {issue}34985[34985] {pull}35035[35035]
- Remove Beta warning from IIS application_pool metricset {pull}35480[35480]
- Improve documentation for ActiveMQ module {issue}35113[35113] {pull}35558[35558]
- Resolve statsd module's prematurely halting of metrics parsing upon encountering an invalid packet. {pull}35075[35075]
*Packetbeat*
- Fix double channel close panic when reloading. {pull}35324[35324]
*Winlogbeat*
- Prevent panic on closing iterators on empty channels in experimental API. {issue}33966[33966] {pull}35423[35423]
==== Added
*Affecting all Beats*
- Add Hetzner Cloud as a provider for `add_cloud_metadata`. {pull}35456[35456]
- Upgrade version of elastic-agent-autodiscover to v0.6.1 for improved memory consumption on k8s. {pull}35483[35483]
- Added `orchestrator.cluster.id` and `orchestrator.cluster.name` fields to the add_cloud_metadata processor, AWS cloud provider. {pull}35182[35182]
- Lowercase reported hostnames per Elastic Common Schema (ECS) guidelines for the host.name field. Upgraded github.com/elastic/go-sysinfo to 1.11.0. {pull}35652[35652]
*Filebeat*
- Added support for decoding apache parquet files in awss3 input. {issue}34662[34662] {pull}35578[35578]
- Add support for CRC validation in Filebeat's HTTP endpoint input. {pull}35204[35204]
- Add support for CRC validation in Zoom module. {pull}35604[35604]
- Add execution budget to CEL input. {pull}35409[35409]
- Add XML decoding support to HTTPJSON. {issue}34438[34438] {pull}35235[35235]
- Add delegated account support when using Google ADC in `httpjson` input. {pull}35507[35507]
- Add metrics for filestream input. {pull}35529[35529]
- Add support for collecting `httpjson` metrics. {pull}35392[35392]
- Add XML decoding support to CEL. {issue}34438[34438] {pull}35372[35372]
- Mark CEL input as GA. {pull}35559[35559]
- Add metrics for gcp-pubsub input. {pull}35614[35614]
- Allow non-AWS endpoints for awss3 input. {issue}35496[35496] {pull}35520[35520]
- Add Okta input package for entity analytics. {pull}35611[35611]
- Expose harvester metrics from filestream input {pull}35835[35835] {issue}33771[33771]
- Add device support for Azure AD entity analytics. {pull}35807[35807]
*Libbeat*
- Added support for Apache Parquet file reader. {issue}34662[34662] {pull}35183[35183]
*Metricbeat*
- Add GCP Redis metadata {pull}33701[33701]
- Migrate Azure Billing, Monitor, and Storage metricsets to the newer SDK. {pull}33585[33585]
- Add support for float64 values parsing for statsd metrics of counter type. {pull}35099[35099]
*Packetbeat*
- Added `packetbeat.interfaces.fanout_group` to allow a Packetbeat sniffer to join an AF_PACKET fanout group. {issue}35451[35451] {pull}35453[35453]
*Winlogbeat*
- Set `host.os.type` and `host.os.family` to "windows" if not already set. {pull}35435[35435]
- Handle empty DNS answer data in QueryResults for the Sysmon Pipeline {pull}35207[35207]
[[release-notes-8.8.2]]
=== Beats version 8.8.2
https://github.com/elastic/beats/compare/v8.8.1\...v8.8.2[View commits]
==== Bugfixes
*Affecting all Beats*
- Make sure k8s watchers are closed when closing k8s meta processor. {pull}35630[35630]
- Upgraded Apache Arrow library used in `x-pack/libbeat/reader/parquet` from v11 to v12.0.1 in order to fix cross-compilation issues. {pull}35640[35640]
- Fix panic when the disk queue's MaxRetryInterval configuration is specified, but RetryInterval is not. {pull}35820[35820]
*Filebeat*
- Fix syslog message parsing for fortinet.firewall to take into account quoted values. {pull}35522[35522]
- [Filebeat GCS input] Fixed an issue where `bucket_timeout` was being applied to the entire bucket poll interval and not individual bucket object read operations. Fixed a map write concurrency issue arising from data races when using a high number of workers. Fixed the flaky tests that were present in the GCS test suit. {pull}35605[35605]
- Fix handling of IPv6 unspecified addresses in TCP input. {issue}35064[35064] {pull}35637[35637]
- Improve error reporting and fix IPv6 handling of TCP and UDP metric collection. {pull}35772[35772]
- Fix input reload on autodiscover. {issue}34388[34388] {pull}35645[35645]
*Heartbeat*
- Fix serialization of processors when running diagnostics. {pull}35698[35698]
*Metricbeat*
- Fix calculation of the `host.cpu.usage` metric for EC2. {pull}35717[35717]
==== Added
*Affecting all Beats*
- Update Go version to 1.19.10. {pull}35751[35751]
*Filebeat*
- [GCS] Added scheduler debug logs and improved the context passing mechanism by removing them from struct params and passing them as function arguments. {pull}35674[35674]
*Packetbeat*
- Add AF_PACKET metrics. {issue}35428[35428] {pull}35489[35489]
==== Deprecated
*Heartbeat*
- Removed support for `zip_url` and `local` browser sources. {pull}35429[35429]
[[release-notes-8.8.1]]
=== Beats version 8.8.1
https://github.com/elastic/beats/compare/v8.8.0\...v8.8.1[View commits]
==== Bugfixes
*Affecting all Beats*
- 'add_cloud_metadata' processor: add `cloud.region` field for GCE cloud provider
- 'add_cloud_metadata' processor: update Azure metadata API version to get missing `cloud.account.id` field
*Filebeat*
- Fix "Can only start an input when all related states are finished" error when running under Elastic Agent {pull}35250[35250] {issue}33653[33653]
- [system] Sync system/auth dataset with system integration 1.29.0. {pull}35581[35581]
- Fix filestream false positive log error "filestream input with ID 'xyz' already exists" {issue}31767[31767]
- Fix error when trying to use `include_message` parser {issue}35440[35440]
==== Added
*Filebeat*
- Add sanitization capabilities to azure-eventhub input {pull}34874[34874]
*Auditbeat*
- Migration of system/package module storage from gob encoding to flatbuffer encoding in bolt db. {pull}34817[34817]
*Metricbeat*
- Support collecting metrics from both the monitoring account and linked accounts from AWS CloudWatch. {pull}35540[35540]
- Add new parameter `include_linked_accounts` to enable/disable metrics collection from multiple linked AWS Accounts {pull}35648[35648]
[[release-notes-8.8.0]]
=== Beats version 8.8.0
https://github.com/elastic/beats/compare/v8.7.1...v8.8.0[View commits]
==== Bugfixes
*Affecting all Beats*
- Fix race condition when stopping runners {pull}32433[32433]
- Fix concurrent map writes when system/process code called from reporter code {pull}32491[32491]
- The Elasticsearch output now splits large requests instead of dropping them when it receives a StatusRequestEntityTooLarge error. {pull}34911[34911]
- In cases where the matcher detects a non-string type in a match statement, report the error as a debug statement, and not a warning statement. {pull}35119[35119]
- `add_cloud_metadata` processor: Add `cloud.region` field for GCE cloud provider.
- `add_cloud_metadata` processor: Update Azure metadata API version to get missing `cloud.account.id` field.
*Filebeat*
- [GCS Input] Added missing locks for safe concurrency. {pull}34914[34914]
- Fix the `ignore_inactive` option being ignored in Filebeat's filestream input. {pull}34770[34770]
- Add input instance ID to request trace filename for httpjson and cel inputs. {pull}35024[35024]
- Sanitize filenames for request tracer in httpjson input. {pull}35143[35143]
- Sanitize filenames for request tracer in cel input. {pull}35154[35154]
- Fix the grok expression outputs of log files. {pull}35221[35221]
- Move repeated Windows event channel not found errors in winlog input to debug level. {issue}35314[35314] {pull}35317[35317]
- Fix crash when processing forwarded logs missing a message. {issue}34705[34705] {pull}34865[34865]
- Fix crash when loading azurewebstorage cursor with no partially processed data. {pull}35433[35433]
*Heartbeat*
- Fix panics when parsing when HTTP URL is not parseable. {pull}34702[34702]
- Fix broken state ID location naming. {pull}35336[35336]
- Fix project monitor temp directories permission to include group access. {pull}35398[35398]
- Fix output pipeline exit on `run_once`. {pull}35376[35376]
- Fix formatting issue with socket trace timeout. {pull}35434[35434]
*Metricbeat*
- Make generic SQL GA. {pull}34637[34637]
- Collect missing `remote_cluster` in Elasticsearch CCR metricset. {pull}34957[34957]
- Add context with timeout in AWS API calls. {pull}35425[35425]
*Osquerybeat*
- Adds the `elastic_file_analysis` table to the Osquery extension for macOS builds. {pull}35056[35056]
*Packetbeat*
- Fix BPF filter setting not being applied to sniffers. {issue}35363[35363] {pull}35484[35484]
*Winlogbeat*
- Move repeated channel not found errors to debug level. {issue}35314[35314] {pull}35317[35317]
- Fix panic due to misrepresented buffer use. {pull}35437[35437]
- Allow program termination when attempting to open an absent channel. {pull}35474[35474]
==== Added
*Filebeat*