Beats version 8.19.8

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

All

Disk queue filled metrics can underflow after blocked publishes. When a disk queue reaches its configured capacity, inputs can block until the output acknowledges events. The queue then accepts the blocked event without updating its metrics. When the event is later removed, the queue.filled.events, queue.filled.bytes, and queue.filled.pct metrics might report incorrect values. Event delivery is unaffected. Upgrade to 8.19.21 or later to apply the fix.

Filebeat

Filestream "take over" mode does not work in versions 8.19.0-8.19.20. A fix will ship in the 8.19.21 release.

All

Fix a fatal startup error in Beats Receivers caused by truncation of long UTF-8 hostnames. #47713
Not being able to start the add_docker_metadata processor is now consistently a non-fatal error when Docker is not available. #47760

Filebeat

Handle and remove BOM during JSON parsing in azureblobstorage and gcs inputs. #47508
Fixed an issue where filebeat could hang during shutdown when using the filestream input. #47518
Fix double locking in translate_ldap_attribute processor and improve logging. #47585
Fix possible data corruption in tcp, syslog and unix inputs. #47618
Skip s3 test events in filebeat s3 input. #47635