Beats breaking changes
Stack
Breaking changes can impact your Elastic applications, potentially disrupting normal operations. Before you upgrade, carefully review the Beats breaking changes and take the necessary steps to mitigate any issues. To learn how to upgrade, check Upgrade.
Filebeat
Journald input now converts byte-encoded messages to string.
No breaking changes.
Metricbeat
API used by index summary metricset changed.
Changed index summary metricset to use _nodes/stats API instead of _stats API to avoid data gaps.
For more information, check #45049.
No breaking changes.
All Beats
Update user agent used by Beats HTTP clients.
The default user agent was updated to distinguish between all beat modes:
- Standalone indicates that the beat is not running under agent.
- Unmanaged indicates that the beat is running under agent but not managed by Fleet.
- Managed indicates that the beat is running under agent and managed by Fleet.
Users relying on specific user agents could be impacted.
For more information, check #45251.
All Beats
The default data and logs path for the Windows service installation has changed.
The base folder has changed from C:\ProgramData\ to C:\ProgramFiles\ because the latter has stricter permissions. The state and logs are now stored in C:\Program Files\<Beat Name>-Data.
When the installation script runs, it looks for the previous default data path. If the path is found, data is moved to the new path. The installation script accepts the parameter -ForceLegacyPath to force using the legacy data path.
In a PowerShell prompt, use Get-Help install-service-<Beat Name>.ps1 -detailed to get detailed help.
See 'Quick start -> Installation script' from each Beat for more details.
Filebeat
'close.on_state_change.removed' defaults to `true` on Windows and `false` on the rest of the platforms.
To keep the previous behaviour, add close.on_state_change.removed: true on every Filestream input.
Even after the file is removed, the file handles will stay open until it is closed due to inactivity. See close.on_state_change.inactive for more details.
For more information, check #38523
Filebeat
Journald input now converts byte-encoded messages to string.
No breaking changes.
All Beats
The default data and logs path for the Windows service installation has changed.
The base folder has changed from C:\ProgramData\ to C:\ProgramFiles\ because the latter has stricter permissions. The state and logs are now stored in C:\Program Files\<Beat Name>-Data.
When the installation script runs, it looks for the previous default data path. If the path is found, data is moved to the new path. The installation script accepts the parameter -ForceLegacyPath to force using the legacy data path.
In a PowerShell prompt, use Get-Help install-service-<Beat Name>.ps1 -detailed to get detailed help.
See 'Quick start -> Installation script' from each Beat for more details.
Metricbeat
Change index summary metricset to use `_nodes/stats` API instead of `_stats` API to avoid data gaps.
For more information, check #45049.
No breaking changes.
No breaking changes.
No breaking changes.
Set default Kafka version to 2.1.0 in Kafka output and Filebeat.
For more information, check #41662.
Replaced default Ubuntu-based images with UBI-minimal-based ones.
For more information, check #42150.
Removed support for a single "-" to precede multi-letter command line arguments. Use "--" instead.
Filebeat fails to start if there is any input with a duplicated ID. It logs the duplicated IDs and the offending inputs configurations.
For more information, check #41731.
Filestream inputs with duplicated IDs will fail to start. An error is logged showing the ID and the full input configuration.
Filestream inputs can define "allow_deprecated_id_duplication: true" to run keep the previous behaviour of running inputs with duplicated IDs.
Filestream inputs now starts ingesting files only if they are 1024 bytes or larger because the default file identity has changed from native to fingerprint.
At startup Filebeat automatically updates the state from known, active files (i.e: files that are still present on the disk and have not changed path since Filebeat was stopped) to use the new file identity. If Filebeat cannot migrate the state to the new file identity, the file will be re-ingested. To preserve the behaviour from 8.x, set file_identity.native: ~ and prospector.scanner.fingerprint.enabled: false.
Refer to the file identity documentation for more details. You can also check #40197 #41762.
Filebeat fails to start when its configuration contains usage of the deprecated log or container inputs. However, they can still be used when "allow_deprecated_use: true" is set in their configuration.
For more information, check #42295.
Upgrade osquery version to 5.13.1.
For more information, check #40849.
Use base-16 for reporting serial_number value in TLS fields in line with the ECS recommendation.
For more information, check #41542.
Default to use raw API and delete older XML implementation.
For more information, check #42275.
The Beats logger and file output rotate files when necessary. The beat now forces a file rotation when unexpectedly writing to a file through a symbolic link.
Remove kibana.settings metricset since the API was removed in 8.0 in Metricbeat.
Removed support for the Enterprise Search module in Metricbeat.
For more information, check #42915.
Allow faccessat(2) in seccomp.
For more information, check #43322.