Beats version 8.15.4

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Filebeat

The Filestream input does not enforce the restrictions documented for the clean_inactive option, thus allowing configurations that can lead to data re-ingestion issues.
When clean_inactive: 0, Filestream cleans the state of all files on start up, effectively re-ingesting all files on restart. Set clean_inactive to a very large value. For example, use clean_inactive: 43800h0m0s, which is 5 years.

Osquerybeat

Affecting all Beats

Fix issue where old data could be saved in the memory queue after acknowledgment, increasing memory use. 41356

Filebeat

Log bad handshake details when websocket connection fails. 41300
Improve modification time handling for entities and entity deletion logic in the Active Directory entityanalytics input. 41179
Fix double encoding of client_secret in the Entity Analytics input’s Azure Active Directory provider. 41393
The azure-eventhub input now correctly reports its status to the Elastic Agent on fatal errors. 41469

Metricbeat

Winlogbeat

Affecting all Beats

Replace Ubuntu 20.04 with 24.04 for Docker base images. 40743 40942
Reduce memory consumption of k8s autodiscovery and the add_kubernetes_metadata processor when Deployment metadata is enabled.

Heartbeat

Metricbeat