Beats version 8.17.2

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Affecting all Beats

Disk queue filled metrics can underflow after blocked publishes. When a disk queue reaches its configured capacity, inputs can block until the output acknowledges events. The queue then accepts the blocked event without updating its metrics. When the event is later removed, the queue.filled.events, queue.filled.bytes, and queue.filled.pct metrics might report incorrect values. Event delivery is unaffected. Upgrade to 8.19.21 or later to apply the fix.

Filebeat

The Filestream input does not enforce the restrictions documented for the clean_inactive option, thus allowing configurations that can lead to data re-ingestion issues.
When clean_inactive: 0, Filestream cleans the state of all files on start up, effectively re-ingesting all files on restart. Set clean_inactive: -1 to disable this behavior.

Affecting all Beats

Fix incorrect cloud provider identification in add_cloud_metadata processor using provider priority mechanism. 41636
Prevent panic if Libbeat processors are loaded more than once. 41475 51857
Allow network condition to handle field values that are arrays of IP addresses. 41918
Fix a bug where log files are rotated on startup when interval is configured and rotateonstartup is disabled. 41894 41895
Fix setting unique registry for non Beat receivers. 42288 42292
The Kafka output now drops events when there is an authorization error. 42343 42401
Fix autodiscovery memory leak related to metadata of start events. 41748
All standard queue metrics are now included in metrics monitoring, including: added.{events, bytes}, consumed.{events, bytes}, removed.{events, bytes}, and filled.{events, bytes, pct}. 42439
The following output latency metrics are now included in metrics monitoring: output.latency.{count, max, median, p99}. 42439

Filebeat

Updated websocket retry error code list to allow more scenarios to be retried which could have been missed previously. 42218
In the streaming input, prevent panics on shutdown with a null check and apply a consistent namespace to contextual data in debug logs. 42315
Remove erroneous status reporting to Elastic-Agent from the Filestream input. 42435

Metricbeat

Continue collecting metrics even if the Cisco Meraki getDeviceLicenses operation fails. 42397
Fixed errors in the elasticsearch.index metricset when index settings are missing. 42424 42426

Metricbeat

Collect .NET CLR (IIS) Memory, Exceptions and LocksAndThreads metrics 41929
Add support of additional collstats metrics in mongodb module. 42171
Update beat module with apm-server tail sampling monitoring metrics fields 42569