Beats version 8.16.4

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Affecting all Beats

Disk queue filled metrics can underflow after blocked publishes. When a disk queue reaches its configured capacity, inputs can block until the output acknowledges events. The queue then accepts the blocked event without updating its metrics. When the event is later removed, the queue.filled.events, queue.filled.bytes, and queue.filled.pct metrics might report incorrect values. Event delivery is unaffected. Upgrade to 8.19.21 or later to apply the fix.

Filebeat

The Filestream input does not enforce the restrictions documented for the clean_inactive option, thus allowing configurations that can lead to data re-ingestion issues.
When clean_inactive: 0, Filestream cleans the state of all files on start up, effectively re-ingesting all files on restart. Set clean_inactive: -1 to disable this behavior.

Filebeat

Updated websocket retry error code list to allow more scenarios to be retried which could have been missed previously. 42218
In the streaming input, prevent panics on shutdown with a null check and apply a consistent namespace to contextual data in debug logs. 42315
Remove erroneous status reporting to Elastic-Agent from the Filestream input. 42435

Filebeat

Add metrics for number of events and pages published by HTTPJSON input. 42340 42442

Metricbeat

Update beat module with apm-server tail sampling monitoring metrics fields. 42569