Beats version 8.17.0

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Affecting all Beats

Disk queue filled metrics can underflow after blocked publishes. When a disk queue reaches its configured capacity, inputs can block until the output acknowledges events. The queue then accepts the blocked event without updating its metrics. When the event is later removed, the queue.filled.events, queue.filled.bytes, and queue.filled.pct metrics might report incorrect values. Event delivery is unaffected. Upgrade to 8.19.21 or later to apply the fix.

Filebeat

The Filestream input does not enforce the restrictions documented for the clean_inactive option, thus allowing configurations that can lead to data re-ingestion issues.
When clean_inactive: 0, Filestream cleans the state of all files on start up, effectively re-ingesting all files on restart. Set clean_inactive: -1 to disable this behavior.

Affecting all Beats

Drop support for Debian 10 and upgrade statically linked glibc from 2.28 to 2.31. 41402

Affecting all Beats

Ensure Elasticsearch output can always recover from network errors. 40794
Add translate_ldap_attribute processor. 41472
Remove unnecessary debug logs during idle connection teardown. 40824
Remove unnecessary reload for Elastic Agent managed beats when APM tracing config changes from nil to nil. 41794

Auditbeat

auditd: Use ECS event.type: end instead of stop for SERVICE_STOP, DAEMON_ABORT, and DAEMON_END messages. 41558
auditd: Update syscall names for Linux 6.11. 41558
hasher: Geneneral improvements and fixes. 41863

Filebeat

Fix double encoding of client_secret in the Entity Analytics input’s Azure Active Directory provider. 41393
Add support for Access Points in the aws-s3 input. 41495
Fix the "No such input type exist: salesforce" error on the Windows/AIX platform. 41664
Fix handling of http_endpoint request exceeding memory limits. 41764 41765
Fixes filestream logging the error "filestream input with ID ID already exists, this will lead to data duplication[…]" on Kubernetes when using autodiscover. 41585

Metricbeat

Log Cisco Meraki getDevicePerformanceScores errors without stopping metrics collection. 41622
Fix incorrect handling of types in SQL module. 40090 41607

Winlogbeat

Affecting all Beats

Add lowercase processor. 22254 41424
Add uppercase processor. 22254 41535
Replace compress/gzip with https://github.com/klauspost/compress/gzip library for gzip compression. 41584

Auditbeat

Filebeat

Improved Azure Blob Storage input documentation. 41252
Make ETW input GA. 41389
Added input metrics to GCS input. 36640 41505
Add support for Okta entity analytics provider to collect role and factor data for users. 41460
Add support for Journald in the System module. 41555
Improve S3 polling mode states registry when using list prefix option. 41869
AWS S3 input registry cleanup for untracked s3 objects. 41694
The environment variable BEATS_AZURE_EVENTHUB_INPUT_TRACING_ENABLED: true enables internal logs tracer for the azure-eventhub input. 41931 41932

Libbeat

Metricbeat

Add id field to all the vSphere metricsets. 41097
Bump aerospike-client-go to version v7.7.1 and add support for basic auth in Aerospike module. 41233
Add support for region/zone for Vertex AI service in GCP module. 41551
Add support for location label as an optional configuration parameter in GCP metrics metricset. 41550 41626

Winlogbeat