This is a cache of https://www.elastic.co/guide/en/beats/libbeat/8.19/release-notes-6.3.1.html. It is a snapshot of the page as it appeared on 2025-12-15T03:28:53.772+0000.

Beats version 6.3.1 | Beats Platform Reference [8.19] | Elastic

« Beats version 6.4.0 Beats version 6.3.0 »

› ›

Beats version 6.3.1

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Beats version 6.3.1

Bugfixes

Affecting all Beats

Allow index-pattern only setup when setup.dashboards.only_index=true. 7285
Preserve the event when source matching fails in add_docker_metadata. 7133
Negotiate docker API version from our client instead of using a hardcoded one. 7165
Fix duplicating dynamic_fields in template when overwriting the template. 7352

Auditbeat

Fixed parsing of AppArmor audit messages. 6978

Filebeat

Comply with PostgreSQL database name format 7198
Optimize PostgreSQL ingest pipeline to use anchored regexp and merge multiple regexp into a single expression. 7269
Keep different registry entry per container stream to avoid wrong offsets. 7281
Fix offset field pointing at end of a line. 6514
Commit registry writes to stable storage to avoid corrupt registry files. 6792

Metricbeat

Fix field mapping for the system process CPU ticks fields. 7230
Ensure canonical naming for JMX beans is disabled in Jolokia module. 7047
Fix Jolokia attribute mapping when using wildcards and MBean names with multiple properties. 7321

Packetbeat

Fix an out of bounds access in HTTP parser caused by malformed request. 6997
Fix missing type for http.response.body field. 7169

Added

Auditbeat

Added caching of UID and GID values to auditd module. 6978
Updated syscall tables for Linux 4.16. 6978
Added better error messages for when the auditd module fails due to the Linux kernel not supporting auditing (CONFIG_AUDIT=n). 7012

Metricbeat

Collect accumulated docker network metrics and mark old ones as deprecated. 7253

« Beats version 6.4.0 Beats version 6.3.0 »