Beats version 8.15.1

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Affecting all Beats

Disk queue filled metrics can underflow after blocked publishes. When a disk queue reaches its configured capacity, inputs can block until the output acknowledges events. The queue then accepts the blocked event without updating its metrics. When the event is later removed, the queue.filled.events, queue.filled.bytes, and queue.filled.pct metrics might report incorrect values. Event delivery is unaffected. Upgrade to 8.19.21 or later to apply the fix.
- Beats stop publishing data after a network error unless restarted. Avoid upgrading to 8.15.1. Affected Beats log Get \"https://${ELASTICSEARCH_HOST}:443\": context canceled repeatedly. https://github.com/elastic/beats/issues/40705{40705}

Filebeat

The Filestream input does not enforce the restrictions documented for the clean_inactive option, thus allowing configurations that can lead to data re-ingestion issues.
When clean_inactive: 0, Filestream cleans the state of all files on start up, effectively re-ingesting all files on restart. Set clean_inactive: -1 to disable this behavior.

Affecting all Beats

Auditbeat

Fix segfaults that may happen if user runs multiple instances of the package metricset 40525
Fix incorrect definition of struct utmp for arm64 40541

Filebeat

Relax requirements in Okta entity analytics provider user and device profile data shape. 40359
Fix bug in Okta entity analytics rate limit logic. 40106 40267
Fix order of configuration for EntraID entity analytics provider. 40487
Ensure Entra ID request bodies are not truncated and trace logs are rotated before 100MB. 40494
The Elasticsearch output now correctly logs the event fields to the event log file 40509 40512
Fix the "No such input type exist: azure-eventhub" error on the Windows platform 40608 40609
awss3 input: Fix handling of SQS notifications that don’t contain a region. 40628
Fix credential handling when workload identity is being used in GCS input. 39977 40663
Fix high IO and handling of a corrupted registry log file. 35893
Fix filestream’s registry GC: registry entries will never be removed if clean_inactive is set to "-1". 40258

Metricbeat

Fix first HTTP 401 error when fetching metrics from the Kubelet API caused by a token update 40636
Fix needlessly verbose logging in cgroups setup 40620

Filebeat

Metricbeat

Added back elasticsearch.node.stats.jvm.mem.pools.* to the node_stats metricset 40571