Beats breaking changes
Breaking changes can impact your Elastic applications, potentially disrupting normal operations. Before you upgrade, carefully review the Beats breaking changes and take the necessary steps to mitigate any issues. To learn how to upgrade, check out Upgrade.
Set default Kafka version to 2.1.0 in Kafka output and Filebeat.
For more information, check #41662.
Replaced default Ubuntu-based images with UBI-minimal-based ones.
For more information, check #42150.
Removed support for a single `-` to precede multi-letter command line arguments. Use `--` instead.
Filebeat fails to start if there is any input with a duplicated ID. It logs the duplicated IDs and the offending inputs configurations.
For more information, check #41731.
Filestream inputs with duplicated IDs will fail to start. An error is logged showing the ID and the full input configuration.
Filestream inputs can define `allow_deprecated_id_duplication: true` to run keep the previous behaviour of running inputs with duplicated IDs.
Filestream inputs now starts ingesting files only if they are 1024 bytes or larger because the default file identity has changed from `native` to `fingerprint`.
At startup Filebeat automatically updates the state from known, active files (i.e: files that are still present on the disk and have not changed path since Filebeat was stopped) to use the new file identity. If Filebeat cannot migrate the state to the new file identity, the file will be re-ingested. To preserve the behaviour from 8.x, set file_identity.native: ~ and prospector.scanner.fingerprint.enabled: false.
Refer to the file identity documentation for more details. You can also check #40197 #41762.
Filebeat fails to start when its configuration contains usage of the deprecated `log` or `container` inputs. However, they can still be used when `allow_deprecated_use: true` is set in their configuration.
For more information, check #42295.
Upgrade osquery version to 5.13.1.
For more information, check #40849.
Use base-16 for reporting `serial_number` value in TLS fields in line with the ECS recommendation.
For more information, check #41542.
Default to use raw API and delete older XML implementation.
For more information, check #42275.
The Beats logger and file output rotate files when necessary. The beat now forces a file rotation when unexpectedly writing to a file through a symbolic link.
Remove kibana.settings metricset since the API was removed in 8.0 in Metricbeat.
Removed support for the Enterprise Search module in Metricbeat.
For more information, check #42915.
Allow faccessat(2) in seccomp.
For more information, check #43322.