This is a cache of https://www.elastic.co/guide/en/beats/libbeat/8.19/release-notes-8.9.0.html. It is a snapshot of the page as it appeared on 2025-12-15T03:22:44.500+0000.
Beat<strong>s</strong> ver<strong>s</strong>ion 8.9.0 | Beat<strong>s</strong> Platform Reference [8.19] | Ela<strong>s</strong>tic
« Beats version 8.9.1 Beats version 8.8.2 »
Elastic Docs ›Beats Platform Reference [8.19] ›Release notes

Beats version 8.9.0

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Beats version 8.9.0

edit

View commits

Bugfixes

edit

Affecting all Beats

  • Do not print context cancelled error message when running under agent 36006
  • Fix recovering from invalid output configuration when running under Elastic-Agent 36016

Filebeat

  • Add support in s3 input for JsON with array of objects. 35475
  • RFC5424 syslog timestamps with offset Z will be treated as UTC rather than using the default timezone. 35360
  • Fixed a minor code error in the GCs input scheduler where a config value was being used directly instead of the source struct. 35729
  • Fix CEL input JsON marshalling of nested objects. 35763 35774
  • Fix metric collection in GCPPubsub input. 35773
  • Fix end point deregistration in http_endpoint input. 35899 35903
  • Fix duplicate ID panic in filestream metrics. 35964 35972
  • Improve error reporting and fix IPv6 handling of TCP and UDP metric collection. 35996
  • Fix handling of NUL-terminated log lines in Fortinet Firewall module. 36026 36027
  • Make redact field configuration recommended in CEL input and log warning if missing. 36008
  • Fix handling of region name configuration in awss3 input 36034

Heartbeat

  • Update gval version. 35636
  • Filter dev flags for ui monitors inside synthetics_args. 35788
  • Fix temp dir running out of space with project monitors. 35843

Metricbeat

  • Fix no error logs displayed in CloudWatch EC2, RDs and sQs metadata 34985 35035
  • Remove Beta warning from IIs application_pool metricset 35480
  • Improve documentation for ActiveMQ module 35113 35558
  • Resolve statsd module’s prematurely halting of metrics parsing upon encountering an invalid packet. 35075

Packetbeat

  • Fix double channel close panic when reloading. 35324

Winlogbeat

  • Prevent panic on closing iterators on empty channels in experimental API. 33966 35423

Added

edit

Affecting all Beats

  • Add Hetzner Cloud as a provider for add_cloud_metadata. 35456
  • Upgrade version of elastic-agent-autodiscover to v0.6.1 for improved memory consumption on k8s. 35483
  • Added orchestrator.cluster.id and orchestrator.cluster.name fields to the add_cloud_metadata processor, AWs cloud provider. 35182
  • Lowercase reported hostnames per Elastic Common schema (ECs) guidelines for the host.name field. Upgraded github.com/elastic/go-sysinfo to 1.11.0. 35652

Filebeat

  • Added support for decoding apache parquet files in awss3 input. 34662 35578
  • Add support for CRC validation in Filebeat’s HTTP endpoint input. 35204
  • Add support for CRC validation in Zoom module. 35604
  • Add execution budget to CEL input. 35409
  • Add XML decoding support to HTTPJsON. 34438 35235
  • Add delegated account support when using Google ADC in httpjson input. 35507
  • Add metrics for filestream input. 35529
  • Add support for collecting httpjson metrics. 35392
  • Add XML decoding support to CEL. 34438 35372
  • Mark CEL input as GA. 35559
  • Add metrics for gcp-pubsub input. 35614
  • Allow non-AWs endpoints for awss3 input. 35496 35520
  • Add Okta input package for entity analytics. 35611
  • Expose harvester metrics from filestream input 35835 33771
  • Add device support for Azure AD entity analytics. 35807

Libbeat - Added support for Apache Parquet file reader. 34662 35183

Metricbeat

  • Add GCP Redis metadata 33701
  • Migrate Azure Billing, Monitor, and storage metricsets to the newer sDK. 33585
  • Add support for float64 values parsing for statsd metrics of counter type. 35099

Packetbeat

  • Added packetbeat.interfaces.fanout_group to allow a Packetbeat sniffer to join an AF_PACKET fanout group. 35451 35453

Winlogbeat

  • set host.os.type and host.os.family to "windows" if not already set. 35435
  • Handle empty DNs answer data in QueryResults for the sysmon Pipeline 35207
« Beats version 8.9.1 Beats version 8.8.2 »