Beats version 8.17.3
edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.
Beats version 8.17.3
editKnown Issues
editFilebeat
-
The Filestream input does not enforce the restrictions documented for the
clean_inactiveoption, thus allowing configurations that can lead to data re-ingestion issues. -
When
clean_inactive: 0, Filestream cleans the state of all files on start up, effectively re-ingesting all files on restart. Setclean_inactive: -1to disable this behavior.
Bugfixes
editAffecting all Beats
- Restored event Meta fields in the elasticsearch output’s error logs. 42559
Filebeat
-
[Journald] Fixes handling of
journalctlrestart. A known symptom was broken multiline messages when there was a restart of journalctl while aggregating the lines. 41331 42595 - Fix entityanalytics activedirectory provider full sync use before initialization bug. 42682
-
In the
http_endpointinput, fix the check for a missing HMAC HTTP header. 42756
Metricbeat
- Fixed panic caused by uninitialized meraki device wifi0 and wifi1 struct pointers in the device WiFi data fetching. 42745 42746
- Only fetch cluster-level index stats summary. 36019 42901
- Fixed an issue in Metricbeat’s Windows module where data collection would fail if the data was unavailable. 42802 42803
Winlogbeat
- Sync missing changes in modules pipelines. 42619