Beats version 8.17.5

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Affecting all Beats

Disk queue filled metrics can underflow after blocked publishes. When a disk queue reaches its configured capacity, inputs can block until the output acknowledges events. The queue then accepts the blocked event without updating its metrics. When the event is later removed, the queue.filled.events, queue.filled.bytes, and queue.filled.pct metrics might report incorrect values. Event delivery is unaffected. Upgrade to 8.19.21 or later to apply the fix.

Filebeat

The Filestream input does not enforce the restrictions documented for the clean_inactive option, thus allowing configurations that can lead to data re-ingestion issues.
When clean_inactive: 0, Filestream cleans the state of all files on start up, effectively re-ingesting all files on restart. Set clean_inactive: -1 to disable this behavior.

Metricbeat

Handle permission errors while collecting data from Windows services and don’t interrupt the overall collection by skipping affected service. 40765 43665

Affecting all Beats

Metricbeat

Fix the function to determine CPU cores on windows. 42593 43409
Changed tier_preference, creation_date and version fields to be omitted from the resulting documents when not pulled from source indices. 43637

Filebeat

Allow a grace time for awss3 input shutdown to enable incomplete SQS message processing to be completed. 43369

Heartbeat

Metricbeat

Add a warning log to metricbeat.vsphere in case vSphere connection has been configured as insecure. 43104
Updated Meraki API endpoint for Channel Utilization data. Switched to GetOrganizationWirelessDevicesChannelUtilizationByDevice. 43485

Packetbeat - Add tls.server.ja3s tls fingerprint. 43284