« Beats version 8.19.21 Beats version 8.19.19 »
Elastic Docs ›Beats Platform Reference [8.19]

Beats version 8.19.20

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Beats version 8.19.20

edit

View commits

Known issues

edit

All

  • Disk queue filled metrics can underflow after blocked publishes. When a disk queue reaches its configured capacity, inputs can block until the output acknowledges events. The queue then accepts the blocked event without updating its metrics. When the event is later removed, the queue.filled.events, queue.filled.bytes, and queue.filled.pct metrics might report incorrect values. Event delivery is unaffected. Upgrade to 8.19.21 or later to apply the fix.

Filebeat

  • Filestream "take over" mode does not work in versions 8.19.0-8.19.20. A fix will ship in the 8.19.21 release.

Security updates

edit

All

  • Upgrade Go to 1.26.5. #52093

Osquerybeat

  • Reject CPIO entries in macOS .pkg payloads whose paths escape the destination directory, preventing path traversal during extraction (CWE-22). #52130

Enhancements

edit

All

  • Use native Go for Linux FIPS builds. #51969

Auditbeat

  • Update quark to 0.6.0. #52063

Filebeat

  • Aggregate SQS mode health status to reduce false Degraded/Healthy transitions. #51997 #51692
  • Add configurable User-Agent header to the CrowdStrike streaming input. #52025
  • Remove Authorization headers from CEL, Entity Analytics, HTTP Endpoint, and HTTP JSON input request trace logs. #52239

Bug fixes

edit

All

  • Update elastic-agent-libs to v0.46.1. #51921

Elastic Agent

  • Fix Beat receiver Shutdown hanging when Start fails before the beater is launched. #52106 #52009

Filebeat

  • Synchronize Filebeat Run and Shutdown functions. #51800
  • Fix offset commits when using multiline in Journald and Kafka inputs. #52345 #51981
  • Fix S3 polling input to exclude same-bucket backup objects from listing. #52169
  • Honor path_style for non-AWS S3 buckets in the aws-s3 input. #52003
  • Use a stable status message for SQS receive errors to prevent update churn during sustained outages. #52172
  • Do not mark the CEL input’s health as degraded when the maximum number of executions is exceeded. #52166
  • Fix the aws-s3 input silently dropping events when a parser clears the message content. #52077
  • Honor the configured language when rendering Windows events. #52113 #7332
  • Fix journald input facility filters on journalctl older than 245. #52250
  • The journald input now reports a Degraded status when journalctl repeatedly exits without delivering any data, instead of staying Healthy while collecting no events. #52287

Heartbeat

  • Fix panic with multiple Heartbeat receivers. #52046
  • Bake Synthetics browser binaries into the Heartbeat Docker image. #52445 #52439

Libbeat

  • Prevent statestore startup failure when meta.json is left empty after an unclean shutdown. #51897
  • Prevent stale autodiscover resources after Kubernetes leadership changes. #52427

Metricbeat

  • Fix Azure module authentication on sovereign clouds (Government, China). #52434
« Beats version 8.19.21 Beats version 8.19.19 »