Fleet and Elastic Agent 8.14.0

edit

Review important information about the Fleet and Elastic Agent 8.14.0 release.

Security updates

edit
Fleet Server
  • Update Fleet Server Go version to 1.21.10. #3528
Elastic Agent
  • Update Elastic Agent Go version to 1.21.10. #4718
  • Update all opentelemetry-collector-contrib packages. #4572

New features

edit

The 8.14.0 release added the following new and notable features.

Fleet
  • (Technical preview) Kibana administrators can now assign granular subfeature privileges for Fleet, Elastic Agents, agent policies, and settings to user roles. (#179889).
  • The index.mapping.total_fields.limit field on integration index templates is now set to 1000 by default instead of 10000. If an integration data stream includes more than 500 fields, the limit will be increased to 10000. (#178398)
  • index_template.mappings.subobjects: false is now the default for custom integration data streams to avoid subobject and scalar mapping conflicts. (#178397)
  • Fleet no longer sets index.query.default_field on integration component templates, favoring the Elasticsearch default value of index.query.default_field: *. This allows queries without a field specified to be run against all integration fields by default. (#178020)
  • Allow managed content installed by Fleet to be deleted. Note: this content will be recreated when an integration is upgraded or reinstalled. (#179113)
Elastic Agent
  • The Kubernetes secrets provider has been improved to update a Kubernetes secret when the secret value changes. #4371 #4168
  • The OpenTelemetry filterprocessor is now available to users running Elastic Agent in otel mode. #4708
  • The OpenTelemetry elasticsearchexporter is now available to users running Elastic Agent in otel mode. #4707

Enhancements

edit
Fleet
  • Add time_series_dimension: true to dynamic field mappings defined in integrations with dimension: true. (#180023)
  • Allow additional CPU metrics to be collected when requesting diagnostics from an agent. (#179819)
  • Add new "advanced settings" section to agent policy settings page sourced from configuration. (#179795)
  • Add an Elastic Defend advanced policy option for pruning capability arrays. (#179766)
  • The "agent activity" flyout now includes several new features: (#179161)

    • A "review errors" button now appears above the agent listing table when new activity events are loaded that include errors. Clicking the button will open the activity flyout with these errors shown.
    • Agent activity now supports pagination. Click the "show more" button at the bottom of the list to load additional activity events.
    • Agent activity from a given date can now be loaded by clicking the "Go to date" button and selecting a date.
  • Surface unhealthy_reason in agent metrics that indicates which component (input/output/other) is causing an agent to be considered unhealthy. (#178605)
  • Add a warning which is displayed when trying to upgrade agent to version > max Fleet Server version. (#178079)
Fleet Server
  • When running in agent mode, Fleet Server will use the APMConfig settings of the expected input if it’s set over the settings in inputs[0].server.instrumentation. This should make it easier for managed agents to inject APM configuration data. #3277 #2868
  • Allow specification in the Fleet Server settings for whether or not a diagnostics bundle should contain additional CPU metrics. #3333 #3491
  • Allow Fleet to set the trace level for logging. #3350
Elastic Agent
  • The CPU and memory usage of the internal monitoring Beats is now included in the agent CPU and memory usage calculations in Fleet. #4326 #4082
  • Add the optional CPU profile collection to the Fleet diagnostics action handler. #4394 #3491
  • Enable --unprivileged on Mac OS, allowing Elastic Agent to run as an unprivileged user. #4362 #3867
  • Make the enroll command more stable by handling temporary server errors. #4523 #4513
  • Reduce the overall download and on-disk size of Elastic Agent. #4516 #3364

    • Linux: -43% reduction from 1800MB to 1018MB compared to 8.13.4 when extracted
    • MacOS: -44% reduction from 1100MB to 619MB compared to 8.13.4 when extracted
    • Windows: -43% reduction from 891MB to 504MB compared to 8.13.4 when extracted
  • Remove cloud-defend from Linux .tar.gz archives; it now appears only in Docker images where it is required. #4584
  • Reduce the disk usage of Elastic Agent self-monitoring logs shipped to Fleet by 16% by dropping "Non-zero metrics…​" logs automatically. #4633 #4252

Bug fixes

edit
Fleet
  • Add validation to dataset field in input packages to disallow special characters. (#182925)
  • Fix rollback input package install on failure. (#182665)
  • Fix cloudflare template error. (#182645)
  • Fix displaying Config and API reference tabs if they are not needed. (#182518)
  • Allow upgrading an agent to a newer version when that agent is also a Fleet Server. (#181575)
  • Fix flattened inputs in the configuration tab. (#181155)
  • Add callout when editing an output about plain text secrets being re-saved to secret storage. (#180334)
  • Remove unnecessary field definitions for custom integrations. (#178293)
  • Fix secrets UI inputs in forms when secrets storage is disabled server side. (#178045)
  • Fix not being able to preview or download files with special characters. (#176822)
  • Fix overly strict KQL validation being applied in search boxes. (#176806)
Fleet Server
  • Respond with a 429 error, instead of a misleading 401 unauthorized response, when an Elasticsearch API key authentication returns a 429 error. #3278
  • Add an unhealthy_reason value (input/output/other) to Fleet Server metrics published regularly in agent documents. #3338
  • Update endpoints to return a 400 status code instead of 500 for bad requests. #3407 3110
Elastic Agent
  • Use IgnoreCommas in default configuration options to correct parse functions used as part of variable substitutions. #4436
  • Stop logging all 400 errors as Fleet Server API incompatibility errors. #4481 #4477
  • Fix failing upgrade command when the gRPC server connection is interrupted. #4519 #3890
  • Fix an issue where the kubernetes_leaderelection provider would not try to reacquire the lease once lost. #4542 #4543
  • Always select the more recent watcher during the Elastic Agent upgrade/downgrade process. #4491 #4072
  • Reduce the disk usage of Elastic Agent self-monitoring metrics shipped to Fleet by 13% by dropping the Beats state metricset. #4579 #4153