IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Beats version 8.19.19

edit

View commits

Known issues

edit

All

  • Disk queue filled metrics can underflow after blocked publishes. When a disk queue reaches its configured capacity, inputs can block until the output acknowledges events. The queue then accepts the blocked event without updating its metrics. When the event is later removed, the queue.filled.events, queue.filled.bytes, and queue.filled.pct metrics might report incorrect values. Event delivery is unaffected. Upgrade to 8.19.21 or later to apply the fix.

Filebeat

  • Filestream "take over" mode does not work in versions 8.19.0-8.19.20. A fix will ship in the 8.19.21 release.

Enhancements

edit

Filebeat

  • Optimize filestream logger performance. #51444
  • Add a configurable retry policy to the Azure Blob Storage input. #51787 #44629

Bug fixes

edit

All

  • Fix goroutine leak when processor construction fails. #51727
  • Fix data races in the add_docker_metadata cache initialization. #51844
  • Close Beat processors on Beat OTel processor shutdown to avoid leaking resources on collector reloads. #51753

Auditbeat

  • Fix data races in the backoff accounting of the add_session_metadata processor’s kernel_tracing provider. #51762

Elastic agent

  • Fix registry corruption issue with multiple Metricbeat receivers. #51591 #15154

Filebeat

  • Filestream now defers shutdown until it reaches EOF or a configurable timeout. The new read_until_eof option (enabled by default) lets you opt out. #51206 #40447
  • Validate that HTTPJSON pagination URLs share the configured request URL origin. #51551
  • Fix Filebeat duplicating events after a normal shutdown caused by a race in the registrar. #51613
  • Avoid slice-bounds panic when sorting copytruncate rotated files by date. #51606
  • Fix type loss in HTTP JSON template transform handling. #51756
  • Fix filestream data loss when a harvester closes before ingesting any data. #51697
  • Fix CrowdStrike streaming input retry cap so max_attempts and infinite_retries are honored. #51729
  • Make the CrowdStrike streaming input self-heal from transient discover failures. #51763
  • Prevent Filebeat startup failure when meta.json is left empty after migration. #51791
  • Fix aws-s3 input not performing backup_to_bucket and delete_after_backup in polling mode. #51884 #46672
  • Fix goroutine leak in request trace logging infrastructure. #51955

Libbeat

  • Fix a data race in the rate_limit processor when configured with fields and run concurrently. #51742
  • Fix a startup data race in the add_kubernetes_metadata processor. #51750

Metricbeat

  • Fix a race condition during metricset closure. #51709

Osquerybeat

  • Fix a rare crash when Osquery restarts after a configuration change. #51564