Beats version 8.17.3
edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.
Beats version 8.17.3
editKnown Issues
editAffecting all Beats
-
Disk queue filled metrics can underflow after blocked publishes. When a disk queue reaches its configured capacity, inputs can block until the output acknowledges events. The queue then accepts the blocked event without updating its metrics. When the event is later removed, the
queue.filled.events,queue.filled.bytes, andqueue.filled.pctmetrics might report incorrect values. Event delivery is unaffected. Upgrade to 8.19.21 or later to apply the fix.
Filebeat
-
The Filestream input does not enforce the restrictions documented for the
clean_inactiveoption, thus allowing configurations that can lead to data re-ingestion issues. -
When
clean_inactive: 0, Filestream cleans the state of all files on start up, effectively re-ingesting all files on restart. Setclean_inactive: -1to disable this behavior.
Bugfixes
editAffecting all Beats
- Restored event Meta fields in the Elasticsearch output’s error logs. 42559
Filebeat
-
[Journald] Fixes handling of
journalctlrestart. A known symptom was broken multiline messages when there was a restart of journalctl while aggregating the lines. 41331 42595 - Fix entityanalytics activedirectory provider full sync use before initialization bug. 42682
-
In the
http_endpointinput, fix the check for a missing HMAC HTTP header. 42756
Metricbeat
- Fixed panic caused by uninitialized meraki device wifi0 and wifi1 struct pointers in the device WiFi data fetching. 42745 42746
- Only fetch cluster-level index stats summary. 36019 42901
- Fixed an issue in Metricbeat’s Windows module where data collection would fail if the data was unavailable. 42802 42803
Winlogbeat
- Sync missing changes in modules pipelines. 42619