Logstash 8.16.0 Release Notes

Logstash 8.16.0 Release Notes

Known issue

Logstash may fail to shut down under some circumstances when you are using Pipeline-to-pipeline communication. Check out issue #16657 for details.

Workaround: Add -Dlogstash.pipelinebus.implementation=v1 to config/jvm.options. This change reverts the PipelineBus to v1, a version that does not exhibit this issue, but may impact performance in pipeline-to-pipeline scenarios.

Announcing the new Logstash Health Report API

The new Health Report API (GET /_health_report) is available starting with Logstash 8.16.0. This API uses indicators capable of detecting the degraded status of pipelines and providing actionable insights #16520, #16532.

Upgrading from earlier versions. If your existing automation relies on liveliness scripts that expect the Logstash API status to be unavailable or to return a hardcoded green status, you can set a property to preserve pre-8.16.0. To maintain existing behavior for API responses, add the -Dlogstash.forceApiStatus=green property to your config/jvm.options file.

This setting prevents the new Health API status from affecting the top-level status field of existing Logstash API responses, forcing other APIs to return the previous hard-coded green value. #16535

Check out the Health report API docs more for info.

New features and enhancements

  • Logstash now gracefully handles if conditionals in pipeline definitions that can’t be evaluated (#16322), either by dropping the event or by sending it to the pipeline’s DLQ if enabled. #16423

Other changes to Logstash core

  • Added deprecation logs for modules netflow, fb_apache and azure. #16548
  • Added deprecation logs for users that doesn’t explicitly select a value for pipeline.buffer.type forcing them to proactively make a choice before version 9.0 when this setting will default to heap. #16498
  • The flag --event_api.tags.illegal was deprecated and will be removed in version 9. This flag remains available throughout all version 8.x releases. Users who rely on this flag to allow non strings assignment to tags field should update their pipeline. #16507

Updates to dependencies

  • Updated JRuby to 9.4.9.0 #16638

Plugins

Cef Codec - 6.2.8

  • [DOC] Added missing documentation of the raw_data_field option #105

Json_lines Codec - 3.2.2

  • Raised the default value of the decode_size_limit_bytes option to 512 MB #46
  • Added the decode_size_limit_bytes option to limit the maximum size of JSON lines that can be parsed. #43

Elastic_integration Filter - 0.1.15

  • Use Elasticsearch code from its 8.16 branch and adapt to changes in Elasticsearch GeoIP processor #170

Geoip Filter - 7.3.1

  • Fixed a pipeline crash when looking up a database with customised fields #225

Azure_event_hubs Input - 1.5.0

  • Updated Azure Event Hub client library to version 3.3.0 #96

Beats Input - 6.9.0

  • Improved plugin’s shutdown process and fixed a crash when a connection is terminated while processing messages #500

Http Input - 3.9.1

  • Fixed an issue where the value of ssl_enabled during run wasn’t correctly logged #180
  • Separated Netty boss and worker groups to improve the graceful shutdown #178

Tcp Input - 6.4.3

  • Updated dependencies for TCP input #224

Jdbc Integration - 5.5.0

  • Added support for SQL DATE columns to jdbc static and streaming filters #171

Rabbitmq Integration - 7.4.0

  • Removed obsolete verify_ssl and debug options #60