- Beats Platform Reference: other versions:
- What are Beats?
- Community Beats
- Get started with Beats
- Config file format
- Upgrade
- Release notes
- Beats version 8.16.4
- Beats version 8.16.3
- Beats version 8.16.2
- Beats version 8.16.1
- Beats version 8.16.0
- Beats version 8.15.5
- Beats version 8.15.4
- Beats version 8.15.3
- Beats version 8.15.2
- Beats version 8.15.1
- Beats version 8.15.0
- Beats version 8.14.3
- Beats version 8.14.2
- Beats version 8.14.1
- Beats version 8.14.0
- Beats version 8.13.4
- Beats version 8.13.3
- Beats version 8.13.2
- Beats version 8.13.1
- Beats version 8.13.0
- Beats version 8.12.2
- Beats version 8.12.1
- Beats version 8.12.0
- Beats version 8.11.4
- Beats version 8.11.3
- Beats version 8.11.2
- Beats version 8.11.1
- Beats version 8.11.0
- Beats version 8.10.4
- Beats version 8.10.3
- Beats version 8.10.2
- Beats version 8.10.1
- Beats version 8.10.0
- Beats version 8.9.2
- Beats version 8.9.1
- Beats version 8.9.0
- Beats version 8.8.2
- Beats version 8.8.1
- Beats version 8.8.0
- Beats version 8.7.1
- Beats version 8.7.0
- Beats version 8.6.2
- Beats version 8.6.1
- Beats version 8.6.0
- Beats version 8.5.3
- Beats version 8.5.2
- Beats version 8.5.1
- Beats version 8.5.0
- Beats version 8.4.3
- Beats version 8.4.2
- Beats version 8.4.1
- Beats version 8.4.0
- Beats version 8.3.3
- Beats version 8.3.2
- Beats version 8.3.1
- Beats version 8.3.0
- Beats version 8.2.3
- Beats version 8.2.2
- Beats version 8.2.1
- Beats version 8.2.0
- Beats version 8.1.3
- Beats version 8.1.2
- Beats version 8.1.1
- Beats version 8.1.0
- Beats version 8.0.1
- Beats version 8.0.0
- Beats version 7.17.0
- Beats version 7.16.3
- Beats version 7.16.2
- Beats version 7.16.1
- Beats version 7.16.0
- Beats version 7.15.2
- Beats version 7.15.1
- Beats version 7.15.0
- Beats version 7.14.2
- Beats version 7.14.1
- Beats version 7.14.0
- Beats version 7.13.4
- Beats version 7.13.3
- Beats version 7.13.2
- Beats version 7.13.1
- Beats version 7.13.0
- Beats version 7.12.1
- Beats version 7.12.0
- Beats version 7.11.2
- Beats version 7.11.1
- Beats version 7.11.0
- Beats version 7.10.2
- Beats version 7.10.1
- Beats version 7.10.0
- Beats version 7.9.3
- Beats version 7.9.2
- Beats version 7.9.1
- Beats version 7.9.0
- Beats version 7.8.1
- Beats version 7.8.0
- Beats version 7.7.1
- Beats version 7.7.0
- Beats version 7.6.2
- Beats version 7.6.1
- Beats version 7.6.0
- Beats version 7.5.2
- Beats version 7.5.1
- Beats version 7.5.0
- Beats version 7.4.2
- Beats version 7.4.1
- Beats version 7.4.0
- Beats version 7.3.2
- Beats version 7.3.1
- Beats version 7.3.0
- Beats version 7.2.1
- Beats version 7.2.0
- Beats version 7.1.1
- Beats version 7.1.0
- Beats version 7.0.1
- Beats version 7.0.0
- Beats version 7.0.0-GA
- Beats version 7.0.0-rc2
- Beats version 7.0.0-rc1
- Beats version 7.0.0-beta1
- Beats version 7.0.0-alpha2
- Beats version 7.0.0-alpha1
- Beats version 6.8.13
- Beats version 6.8.12
- Beats version 6.8.11
- Beats version 6.8.10
- Beats version 6.8.9
- Beats version 6.8.8
- Beats version 6.8.7
- Beats version 6.8.6
- Beats version 6.8.5
- Beats version 6.8.4
- Beats version 6.8.3
- Beats version 6.8.2
- Beats version 6.8.1
- Beats version 6.8.0
- Beats version 6.7.2
- Beats version 6.7.1
- Beats version 6.7.0
- Beats version 6.6.2
- Beats version 6.6.1
- Beats version 6.6.0
- Beats version 6.5.4
- Beats version 6.5.3
- Beats version 6.5.2
- Beats version 6.5.1
- Beats version 6.5.0
- Beats version 6.4.3
- Beats version 6.4.2
- Beats version 6.4.1
- Beats version 6.4.0
- Beats version 6.3.1
- Beats version 6.3.0
- Beats version 6.2.3
- Beats version 6.2.2
- Beats version 6.2.1
- Beats version 6.2.0
- Beats version 6.1.3
- Beats version 6.1.2
- Beats version 6.1.1
- Beats version 6.1.0
- Beats version 6.0.1
- Beats version 6.0.0
- Beats version 6.0.0-GA
- Beats version 6.0.0-rc2
- Beats version 6.0.0-rc1
- Beats version 6.0.0-beta2
- Beats version 6.0.0-beta1
- Beats version 6.0.0-alpha2
- Beats version 6.0.0-alpha1
- Beats version 5.6.14
- Beats version 5.6.13
- Beats version 5.6.12
- Beats version 5.6.11
- Beats version 5.6.10
- Beats version 5.6.9
- Beats version 5.6.8
- Beats version 5.6.7
- Beats version 5.6.6
- Beats version 5.6.5
- Beats version 5.6.4
- Beats version 5.6.3
- Beats version 5.6.2
- Beats version 5.6.1
- Beats version 5.6.0
- Beats version 5.5.3
- Beats version 5.5.2
- Beats version 5.5.1
- Beats version 5.5.0
- Beats version 5.4.2
- Beats version 5.4.1
- Beats version 5.4.0
- Beats version 5.3.2
- Beats version 5.3.1
- Beats version 5.3.0
- Beats version 5.2.2
- Beats version 5.2.1
- Beats version 5.2.0
- Beats version 5.1.2
- Beats version 5.1.1
- Beats version 5.1.0 (skipped)
- Beats version 5.0.2
- Beats version 5.0.1
- Beats version 5.0.0
- Beats version 5.0.0-GA
- Beats version 5.0.0-rc1
- Beats version 5.0.0-beta1
- Beats version 5.0.0-alpha5
- Beats version 5.0.0-alpha4
- Beats version 5.0.0-alpha3
- Beats version 5.0.0-alpha2
- Beats version 5.0.0-alpha1
- Beats version 1.3.1
- Beats version 1.3.0
- Beats version 1.2.3
- Beats version 1.2.2
- Beats version 1.2.1
- Beats version 1.2.0
- Beats version 1.1.2
- Beats version 1.1.1
- Beats version 1.1.0
- Beats version 1.0.1
- Beats version 1.0.0
- Beats version 1.0.0-rc2
- Beats version 1.0.0-rc1
- Beats version 1.0.0-beta4
- Breaking changes
- Contribute to Beats
Beats version 8.14.0
editBeats version 8.14.0
editBreaking changes
editFilebeat
- Removed deprecated ZScaler from Beats. Use the Zscaler Internet Access Elastic integration instead. 38037
- Removed deprecated Tomcat from Beats. Use the Apache Tomcat Elastic integration instead. 38037
- Removed deprecated Squid from Beats. See Migrate from a deprecated module for migration options. 38037
- Removed deprecated SonicWall from Beats. Use the SonicWall Firewall Elastic integration instead. 38037
- Removed deprecated Snort from Beats. Use the Snort Elastic integration instead. 38037
- Removed deprecated Radware from Beats. See Migrate from a deprecated module for migration options. 38037
- Removed deprecated Proofpoint from Beats. Use the Proofpoint TAP Elastic integration instead. 38037
- Removed deprecated Netscout from Beats. See Migrate from a deprecated module for migration options. 38037
- Removed deprecated Microsoft DHCP from Beats. Use the Microsoft DHCP Elastic integration instead. 38037
- Removed deprecated Juniper Junos from Beats. Use the Juniper SRX Elastic integration instead. 38037
- Removed deprecated Juniper Netscreen from Beats. See Migrate from a deprecated module for migration options. 38037
- Removed deprecated Infoblox from Beats. Use the Infoblox NIOS Elastic integration instead. 38037
- Removed deprecated Impreva from Beats. See Migrate from a deprecated module for migration options. 38037
- Removed deprecated Fortinet Client Endpoint from Beats. Use the Fortinet FortiClient Logs Elastic integration instead. 38037
- Removed deprecated Fortinet Fortimail from Beats. Use the Fortinet FortiMail Elastic integration instead. 38037
- Removed deprecated Fortinet Fortimanager from Beats. Use the Fortinet FortiManager Logs Elastic integration instead. 38037
- Removed deprecated F5 from Beats. Use the F5 BIG-IP Elastic integration instead. 38037
- Removed deprecated Cylance from Beats. See Migrate from a deprecated module for migration options. 38037
- Removed deprecated Cisco Meraki from Beats. Use the Cisco Meraki Elastic integration instead. 38037
- Removed deprecated Cisco Nexus from Beats. Use the Cisco Nexus Elastic integration instead. 38037
- Removed deprecated Bluecoat from Beats. See Migrate from a deprecated module for migration options. 38037
- Removed deprecated Barracuda from Beats. Use the Barracuda Web Application Firewall Elastic integration instead. 38037
- Removed deprecated Sophos UTM from Beats. Use the Sophos Elastic integration instead. 38037
- Introduce input/netmetrics and refactor netflow input metrics. 38055
- Update Salesforce module to use new Salesforce input. 37509
Heartbeat
- Fix monitor state loader to not wait extra seconds for the last attempt. 39621
Bugfixes
editAuditbeat - Set field types to correctly match ECS in sessionmd processor. 38955 38994 - Fix failing to enrich process events in sessionmd processor. 38955 39173 39243 - Fix seccomp policy of FIM kprobes backend on arm64. 39759
Filebeat
- Fix handling of endpoint for custom domains and ensure region, default_region, and region parsed from queue_url are applied in the order specified in the documentation for the awss3 input. 39709
- Prevent HTTPJSON holding response bodies between executions. 35219 38116
- Fix the incorrect values generated by the uri_parts processor. 38216
- Rename activity_guid
to activity_id
in ETW input events to suit other Windows inputs. 38530
- Add missing provider registration and fix published entity for Active Directory entityanalytics provider. 38645
- Fix handling of un-parsed JSON in O365 module. 37800 38709
- Fix filestream’s registry GC: registry entries are now removed from the in-memory and disk store when they’re older than the set TTL. 36761 38488
- Fix handling of truncated files in Filestream 38070 38416
- Fix panic when more than 32767 pipeline clients are active. 38197 38556
- Fix a bug in CloudWatch task allocation that could skip some logs. 38918 38953
- Prevent GCP Pub/Sub input blockage by increasing default value of max_outstanding_messages
. 35029 38985
- entity-analytics input: Improve structured logging. 38990
- Upgrade azure-event-hubs-go
and azure-storage-blob-go
dependencies. 38861
- Fix concurrency/error handling bugs in the AWS S3 input that could drop data and prevent ingestion of large buckets. 39131
- Fix EntraID query handling. 39419 39420
- Expand ID patterns in request trace logger for HTTP Endpoint. 39656
- Fix awscloudwarch input: set startTime to 0
for the first iteration of retrieving log events from CloudWatch. 40079
Heartbeat
- Redact synthexec cmd output. 39535
Metricbeat
-
RabbitMQ/queue - Change the mapping type of
rabbitmq.queue.consumers.utilisation.pct
toscaled_float
fromlong
because the values fall within the range of[0.0, 1.0]
. Previously, conversion to integer resulted in reporting either0
or1
. - Fix timeout caused by the retrival of which indices are hidden. 39165
Winlogbeat
Added
editAffecting all Beats
Auditbeat
-
Add
add_session_metadata
processor, which enables session viewer on Auditbeat data. 37640 -
Add procfs backend to the
add_session_metadata
processor. 38799 -
Add
process.entity_id
,process.group.name
andprocess.group.id
inadd_process_metadata
processor. Make FIM module with Kprobes backend to always add an appropriately configuredadd_process_metadata
processor to enrich file events. 38776
Filebeat
- Add Saved Object name field to Kibana audit logs. 38307
- Add Salesforce input. 37331
- Add logging for cache processor file reads and writes. 38052
- Support VPC endpoint for aws-s3 input SQS queue url. 38189
- Add support for complex event objects in the HTTP Endpoint input. 37910 38193
- Parse more fields from Elasticsearch slowlogs. 38295
- Update CEL mito extensions to v1.10.0 to add keys/values helper. 38504
- Add support for Active Directory an entity analytics provider. 37919
- Add AWS AWSHealth metricset. 38370
- Add debugging breadcrumb to logs when writing request trace log. 38636
- Add benchmark input and discard output. 37437
Libbeat
-
Add support for Linux capabilities in
add_process_metadata
. 38252
Metricbeat
Winlogbeat
On this page