Beats version 8.19.19
edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.
Beats version 8.19.19
editKnown issues
editAll
-
Disk queue filled metrics can underflow after blocked publishes. When a disk queue reaches its configured capacity, inputs can block until the output acknowledges events. The queue then accepts the blocked event without updating its metrics. When the event is later removed, the
queue.filled.events,queue.filled.bytes, andqueue.filled.pctmetrics might report incorrect values. Event delivery is unaffected. Upgrade to 8.19.21 or later to apply the fix.
Filebeat
- Filestream "take over" mode does not work in versions 8.19.0-8.19.20. A fix will ship in the 8.19.21 release.
Enhancements
editFilebeat
Bug fixes
editAll
Auditbeat
-
Fix data races in the backoff accounting of the
add_session_metadataprocessor’skernel_tracingprovider. #51762
Elastic agent
Filebeat
-
Filestream now defers shutdown until it reaches EOF or a configurable timeout. The new
read_until_eofoption (enabled by default) lets you opt out. #51206 #40447 - Validate that HTTPJSON pagination URLs share the configured request URL origin. #51551
- Fix Filebeat duplicating events after a normal shutdown caused by a race in the registrar. #51613
- Avoid slice-bounds panic when sorting copytruncate rotated files by date. #51606
- Fix type loss in HTTP JSON template transform handling. #51756
- Fix filestream data loss when a harvester closes before ingesting any data. #51697
-
Fix CrowdStrike streaming input retry cap so
max_attemptsandinfinite_retriesare honored. #51729 - Make the CrowdStrike streaming input self-heal from transient discover failures. #51763
-
Prevent Filebeat startup failure when
meta.jsonis left empty after migration. #51791 -
Fix
aws-s3input not performingbackup_to_bucketanddelete_after_backupin polling mode. #51884 #46672 - Fix goroutine leak in request trace logging infrastructure. #51955
Libbeat
Metricbeat
- Fix a race condition during metricset closure. #51709
Osquerybeat
- Fix a rare crash when Osquery restarts after a configuration change. #51564