Beats version 8.16.2

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Affecting all Beats

Disk queue filled metrics can underflow after blocked publishes. When a disk queue reaches its configured capacity, inputs can block until the output acknowledges events. The queue then accepts the blocked event without updating its metrics. When the event is later removed, the queue.filled.events, queue.filled.bytes, and queue.filled.pct metrics might report incorrect values. Event delivery is unaffected. Upgrade to 8.19.21 or later to apply the fix.

Filebeat

The Filestream input does not enforce the restrictions documented for the clean_inactive option, thus allowing configurations that can lead to data re-ingestion issues.
When clean_inactive: 0, Filestream cleans the state of all files on start up, effectively re-ingesting all files on restart. Set clean_inactive: -1 to disable this behavior.

Affecting all Beats

Remove unnecessary reload for Elastic Agent managed beats when apm tracing config changes from nil to nil. 41794
Fix incorrect cloud provider identification in add_cloud_metadata processor using provider priority mechanism. 41636

Auditbeat

auditd: Use ECS event.type: end instead of stop for SERVICE_STOP, DAEMON_ABORT, and DAEMON_END messages. 41558
auditd: Update syscall names for Linux 6.11. 41558
hasher: Geneneral improvements and fixes. 41863

Filebeat

Fix missing key in streaming input logging. 41600
Fix the "No such input type exist: salesforce" error on the Windows/AIX platform. 41664
Add support for Access Points in the aws-s3 input. 41495
Improve S3 object size metric calculation to support situations where Content-Length is not available. 41755
Fix handling of http_endpoint request exceeding memory limits. 41764 41765
Rate limiting fixes in the Okta provider of the Entity Analytics input. 40106 41583
Fixes filestream logging the error "filestream input with ID ID already exists, this will lead to data duplication[…]" on Kubernetes when using autodiscover. 41585

Metricbeat

Affecting all Beats

In this release we’ve introduced an image based on the hardened Wolfi image to provide secure containers to our self-managed customers, help with compliance regulations, and improve our supply chain security posture.

Auditbeat

Filebeat

Improve S3 polling mode states registry when using list prefix option. 41869
Add support for SSL and Proxy configurations for websoket type in streaming input. 41934
AWS S3 input registry cleanup for untracked s3 objects. 41694
The environment variable BEATS_AZURE_EVENTHUB_INPUT_TRACING_ENABLED: true enables internal logs tracer for the azure-eventhub input. 41931 41932
Added default values in the streaming input for websocket retries and put a cap on retry wait time to be lesser than equal to the maximum defined wait time. 42012

Metricbeat