Beats version 8.18.2

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Affecting all Beats

Disk queue filled metrics can underflow after blocked publishes. When a disk queue reaches its configured capacity, inputs can block until the output acknowledges events. The queue then accepts the blocked event without updating its metrics. When the event is later removed, the queue.filled.events, queue.filled.bytes, and queue.filled.pct metrics might report incorrect values. Event delivery is unaffected. Upgrade to 8.19.21 or later to apply the fix.

Filebeat

The Filestream input does not enforce the restrictions documented for the clean_inactive option, thus allowing configurations that can lead to data re-ingestion issues.
When clean_inactive: 0, Filestream cleans the state of all files on start up, effectively re-ingesting all files on restart. Set clean_inactive: -1 to disable this behavior.

Affecting all Beats

Fix the add_cloud_metadata processor to better support custom certificate bundles by improving how the AWS provider HTTP client is overridden. 44189

Auditbeat

Fix a potential error in the system/package component that could occur during internal package database schema migration. 44294 44296

Filebeat

Fix endpoint path typo in the Okta entity analytics provider. 44147
Fix a WebSocket panic scenario that occured after exhausting the maximum number of retries. 44342

Osquerybeat

Affecting all Beats

Metricbeat

Add checks for the Resty response object in all Meraki module API calls to ensure proper handling of nil responses. 44193
Add enable_batch_api option in the Azure monitor module to allow metrics collection of multiple resources using Azure batch API. 41790
Add support for _nodes/stats URIs compatible with legacy Elasticsearch versions. 44307
Add a latency configuration option to the Azure Monitor module. 44366

Osquerybeat