IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Beats version 8.17.8

edit

View commits

Known Issues

edit

Affecting all Beats

  • Disk queue filled metrics can underflow after blocked publishes. When a disk queue reaches its configured capacity, inputs can block until the output acknowledges events. The queue then accepts the blocked event without updating its metrics. When the event is later removed, the queue.filled.events, queue.filled.bytes, and queue.filled.pct metrics might report incorrect values. Event delivery is unaffected. Upgrade to 8.19.21 or later to apply the fix.

Filebeat

  • The Filestream input does not enforce the restrictions documented for the clean_inactive option, thus allowing configurations that can lead to data re-ingestion issues.
  • When clean_inactive: 0, Filestream cleans the state of all files on start up, effectively re-ingesting all files on restart. Set clean_inactive: -1 to disable this behavior.

Bugfixes

edit

Affecting all Beats

  • Fix dns processor to handle IPv6 server addresses properly. 44526
  • Use Debian 11 to build linux/arm to match linux/amd64. Upgrades linux/arm64’s statically linked glibc from 2.28 to 2.31. 44816

Filebeat

  • If a Filestream input fails to be created, its ID is removed from the list of running input IDs 44697
  • Ensure DEPROVISIONED Okta entities are published by Okta entityanalytics provider. 12658 44719
  • Added missing "text/csv" content-type filter support in azureblobsortorage input. 44596 44824
  • Fix unexpected EOF detection and improve memory usage. 44813
  • Fix handling of ADC (Application Default Credentials) metadata server credentials in HTTPJSON input. 44349 44436
  • Fix handling of ADC (Application Default Credentials) metadata server credentials in CEL input. 44349 44571

Metricbeat

  • Upgrade go.mongodb.org/mongo-driver version from v1.14.0 to v1.17.4 to fix connection leaks in MongoDB module. 44769
  • Fixed a bug where event.duration could be missing from an event on Windows systems due to low-resolution clock. 44440

Added

edit

Affecting all Beats

  • Update Go version to 1.24.4. 44696

Filebeat

  • Filestream now logs at level warn the number of files that are too small to be ingested. 44751

Metricbeat

  • Add check for HTTP error codes in the Metricbeat’s Prometheus query submodule. 44493
  • Sanitize error messages in Fetch method of SQL module. 44577