Beats breaking changes
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Stack
Generally available
Breaking changes can impact your Elastic applications, potentially disrupting normal operations. Before you upgrade, carefully review the Beats breaking changes and take the necessary steps to mitigate any issues. To learn how to upgrade, check Upgrade.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
No breaking changes.
All
Remove otel.component.id and otel.component.kind from beat receiver events.
In a previous version, we added the otel.component.id and otel.component.kind fields, but after running the relevant benchmarks we found that there was not enough value to justify the cost of sending the extra data in every event.
For more information, check #47729#47600.
Impact
These fields were not publicly documented and were not part of an API. However, if you do rely on them, they will no longer be available.
No breaking changes.
Filebeat
Change aws.cloudwatch.* field in awscloudwatch input to nested object.
For more information, check #46357.
No breaking changes.
All
Remove otel.component.id and otel.component.kind from beat receiver events.
No breaking changes.
No breaking changes.
No breaking changes.
Filebeat
Journald input now converts byte-encoded messages to string.
No breaking changes.
Metricbeat
API used by index summary metricset changed.
Changed index summary metricset to use _nodes/stats API instead of _stats API to avoid data gaps.
For more information, check #45049.
No breaking changes.
All Beats
Update user agent used by Beats HTTP clients.
The default user agent was updated to distinguish between all beat modes:
- Standalone indicates that the beat is not running under agent.
- Unmanaged indicates that the beat is running under agent but not managed by Fleet.
- Managed indicates that the beat is running under agent and managed by Fleet.
Users relying on specific user agents could be impacted.
For more information, check #45251.
All Beats
The default data and logs path for the Windows service installation has changed.
The base folder has changed from C:\ProgramData\ to C:\ProgramFiles\
because the latter has stricter permissions. The state
and logs are now stored in C:\Program Files\<Beat Name>-Data.
When the installation script runs, it looks for the previous default
data path. If the path is found, data is moved to the new path.
The installation script accepts the parameter -ForceLegacyPath to
force using the legacy data path.
In a PowerShell prompt, use Get-Help install-service-<Beat Name>.ps1 -detailed to get detailed help.
See 'Quick start -> Installation script' from each Beat for more details.
Filebeat
'close.on_state_change.removed' defaults to true on Windows and false on the rest of the platforms.
To keep the previous behaviour, add close.on_state_change.removed: true on every Filestream input.
Even after the file is removed, the file handles will stay open until
it is closed due to
inactivity. See close.on_state_change.inactive
for more details.
For more information, check #38523
Filebeat
Journald input now converts byte-encoded messages to string.
No breaking changes.
All Beats
The default data and logs path for the Windows service installation has changed.
The base folder has changed from C:\ProgramData\ to
C:\ProgramFiles\ because the latter has stricter permissions. The state
and logs are now stored in C:\Program Files\<Beat Name>-Data.
When the installation script runs, it looks for the previous default
data path. If the path is found, data is moved to the new path.
The installation script accepts the parameter -ForceLegacyPath to
force using the legacy data path.
In a PowerShell prompt, use Get-Help install-service-<Beat Name>.ps1 -detailed to get detailed help.
See 'Quick start -> Installation script' from each Beat for more details.
Metricbeat
Change index summary metricset to use _nodes/stats API instead of _stats API to avoid data gaps.
For more information, check #45049.
No breaking changes.
No breaking changes.
No breaking changes.
Set default Kafka version to 2.1.0 in Kafka output and Filebeat.
For more information, check #41662.
Replaced default Ubuntu-based images with UBI-minimal-based ones.
For more information, check #42150.
Removed support for a single "-" to precede multi-letter command line arguments. Use "--" instead.
Filebeat fails to start if there is any input with a duplicated ID. It logs the duplicated IDs and the offending inputs configurations.
For more information, check #41731.
Filestream inputs with duplicated IDs will fail to start. An error is logged showing the ID and the full input configuration.
Filestream inputs can define "allow_deprecated_id_duplication: true" to keep the previous behaviour of running inputs with duplicated IDs.
Filestream inputs now starts ingesting files only if they are 1024 bytes or larger because the default file identity has changed from native to fingerprint.
At startup Filebeat automatically updates the state from known, active files (i.e: files that are still present on the disk and have not changed path since Filebeat was stopped) to use the new file identity. If Filebeat cannot migrate the state to the new file identity, the file will be re-ingested. To preserve the behaviour from 8.x, set file_identity.native: ~ and prospector.scanner.fingerprint.enabled: false.
Refer to the file identity documentation for more details. You can also check #40197 #41762.
Filebeat fails to start when its configuration contains usage of the deprecated log or container inputs. However, they can still be used when "allow_deprecated_use: true" is set in their configuration.
For more information, check #42295.
Upgrade osquery version to 5.13.1.
For more information, check #40849.
Use base-16 for reporting serial_number value in TLS fields in line with the ECS recommendation.
For more information, check #41542.
Default to use raw API and delete older XML implementation.
For more information, check #42275.
The Beats logger and file output rotate files when necessary. The beat now forces a file rotation when unexpectedly writing to a file through a symbolic link.
Remove kibana.settings metricset since the API was removed in 8.0 in Metricbeat.
Removed support for the Enterprise Search module in Metricbeat.
For more information, check #42915.
Allow faccessat(2) in seccomp.
For more information, check #43322.