64 Pull requests merged by 16 people

• [8.x](backport #42226) [filebeat] Add E2E testing for filebeat in otel mode

  #42276 merged Jan 9, 2025

• [filebeat] Add E2E testing for filebeat in otel mode

  #42226 merged Jan 9, 2025

• remove os.Args hack for backwards compatible arguments

  #42209 merged Jan 9, 2025

• [8.x](backport #42202) Update elastic-agent-libs to v0.18.0

  #42211 merged Jan 9, 2025

• Remove TLSv1.0 from supported protocols

  #42267 merged Jan 8, 2025

• docs: update docs versions 8.17.1

  #42261 merged Jan 8, 2025

• Switch Docker images to UBI

  #42150 merged Jan 8, 2025

• docs: update docs versions 8.16.3

  #42257 merged Jan 8, 2025

• docs: update docs versions 7.17.27

  #42253 merged Jan 8, 2025

• docs: Prepare Changelog for 7.17.27

  #42250 merged Jan 8, 2025

• [8.x](backport #41817) [aws] [s3] Introduce ignore_older & start_timestamp for S3 input allowing better registry cleanups

  #42246 merged Jan 7, 2025

• [aws] [s3] Introduce ignore_older & start_timestamp for S3 input allowing better registry cleanups

  #41817 merged Jan 7, 2025

• [8.x](backport #42212) [filebeat][streaming] - Added OAuth2 support with auto token refresh for websockets

  #42243 merged Jan 7, 2025

• [8.16](backport #42212) [filebeat][streaming] - Added OAuth2 support with auto token refresh for websockets

  #42242 merged Jan 7, 2025

• [8.17](backport #42212) [filebeat][streaming] - Added OAuth2 support with auto token refresh for websockets

  #42244 merged Jan 7, 2025

• [filebeat][streaming] - Added OAuth2 support with auto token refresh for websockets

  #42212 merged Jan 7, 2025

• [8.17](backport #42225) [filebeat][websocket] - Added infinite & blanket retry options to websockets and improved logging and retry logic

  #42236 merged Jan 7, 2025

• [8.x](backport #42225) [filebeat][websocket] - Added infinite & blanket retry options to websockets and improved logging and retry logic

  #42235 merged Jan 7, 2025

• [8.16](backport #42225) [filebeat][websocket] - Added infinite & blanket retry options to websockets and improved logging and retry logic

  #42234 merged Jan 7, 2025

• [8.17](backport #42016) [Kubernetes Integration] Fix for apiserver token expiration

  #42232 merged Jan 7, 2025

• [8.x](backport #42016) [Kubernetes Integration] Fix for apiserver token expiration

  #42231 merged Jan 7, 2025

• [8.16](backport #42016) [Kubernetes Integration] Fix for apiserver token expiration

  #42230 merged Jan 7, 2025

• [8.x](backport #42233) github-actions: python 3.12 is the default when using ubuntu-latest

  #42239 merged Jan 7, 2025

• [8.17](backport #42233) github-actions: python 3.12 is the default when using ubuntu-latest

  #42240 merged Jan 7, 2025

• [8.16](backport #42233) github-actions: python 3.12 is the default when using ubuntu-latest

  #42238 merged Jan 7, 2025

• [7.17](backport #42233) github-actions: python 3.12 is the default when using ubuntu-latest

  #42237 merged Jan 7, 2025

• github-actions: python 3.12 is the default when using ubuntu-latest

  #42233 merged Jan 7, 2025

• [8.17](backport #42183) libbeat/tests/system: bump python libs to fix issues with Python 3.13

  #42196 merged Jan 7, 2025

• [filebeat][websocket] - Added infinite & blanket retry options to websockets and improved logging and retry logic

  #42225 merged Jan 7, 2025

• [8.16](backport #42152) security: bump golang.org/x/net to v0.33.0

  #42164 merged Jan 7, 2025

• [8.x](backport #42218) [filebeat][streaming] - Added more retry codes to websocket retry logic

  #42228 merged Jan 7, 2025

• [8.16](backport #42218) [filebeat][streaming] - Added more retry codes to websocket retry logic

  #42227 merged Jan 7, 2025

• [8.17](backport #42218) [filebeat][streaming] - Added more retry codes to websocket retry logic

  #42229 merged Jan 7, 2025

• [8.x](backport #42187) [Winlogbeat] Improve query building and error recovery

  #42210 merged Jan 7, 2025

• [Kubernetes Integration] Fix for apiserver token expiration

  #42016 merged Jan 7, 2025

• [filebeat][streaming] - Added more retry codes to websocket retry logic

  #42218 merged Jan 7, 2025

• [8.x](backport #42219) fix: delete msr_test binary

  #42223 merged Jan 6, 2025

• [8.x](backport #41762) Use fingerprint file identity by default and migrate file state from native or path

  #42126 merged Jan 6, 2025

• fix: delete msr_test binary

  #42219 merged Jan 6, 2025

• [8.17](backport #42060) fix templates and docs to use correct -- command line args

  #42205 merged Jan 6, 2025

• [8.x](backport #42180) libbeat: optimize asset data decoding

  #42193 merged Jan 6, 2025

• [8.16](backport #42183) libbeat/tests/system: bump python libs to fix issues with Python 3.13

  #42195 merged Jan 6, 2025

• [8.x](backport #42183) libbeat/tests/system: bump python libs to fix issues with Python 3.13

  #42190 merged Jan 6, 2025

• [8.16](backport #42199) Fix Otel API change and update system test golden files to 2025

  #42217 merged Jan 6, 2025

• [8.17](backport #42199) Fix Otel API change and update system test golden files to 2025

  #42215 merged Jan 6, 2025

• [7.17](backport #42199) Fix Otel API change and update system test golden files to 2025

  #42214 merged Jan 6, 2025

• [8.16](backport #37892) Add Integration tests to Auditbeat CI pipeline

  #41450 merged Jan 6, 2025

• [8.x](backport #37892) Add Integration tests to Auditbeat CI pipeline

  #41451 merged Jan 6, 2025

• [8.x](backport #42177) [go.mod] update elastic-agent-system-metrics

  #42179 merged Jan 6, 2025

• [8.x](backport #42060) fix templates and docs to use correct -- command line args

  #42204 merged Jan 6, 2025

• [8.x](backport #41849) [filebeat] Introduce otel mode

  #42188 merged Jan 6, 2025

• Filestream returns error when an input with duplicated ID is created

  #41954 merged Jan 4, 2025

• [8.x](backport #42199) Fix Otel API change and update system test golden files to 2025

  #42203 merged Jan 3, 2025

• Update elastic-agent-libs to v0.18.0

  #42202 merged Jan 3, 2025

• [Winlogbeat] Improve query building and error recovery

  #42187 merged Jan 3, 2025

• fix templates and docs to use correct -- command line args

  #42060 merged Jan 3, 2025

• Fix Otel API change and update system test golden files to 2025

  #42199 merged Jan 3, 2025

• [8.x](backport #42127) [Filebeat] aws-s3 - Document _id generation behavior

  #42130 merged Jan 2, 2025

• [8.16](backport #42191) [chore] update notice

  #42201 merged Jan 2, 2025

• [7.17](backport #42191) [chore] update notice

  #42200 merged Jan 2, 2025

• [8.17](backport #42191) [chore] update notice

  #42198 merged Jan 2, 2025

• [8.x](backport #42191) [chore] update notice

  #42197 merged Jan 2, 2025

• [chore] update notice

  #42191 merged Jan 2, 2025

• libbeat: optimize asset data decoding

  #42180 merged Jan 2, 2025

20 Pull requests opened by 12 people

• build(deps): bump the gcp-sdks group across 1 directory with 6 updates

  #42206 opened Jan 3, 2025

• Add parsers documentation to Journald docs

  #42220 opened Jan 6, 2025

• Fix flakiness on TestFilestreamMetadataUpdatedOnRename

  #42221 opened Jan 6, 2025

• [fix:filebeat/input/redis/slowlog] Correctly parse Redis role values in connection receive

  #42222 opened Jan 6, 2025

• metricbeat/module/mongodb: Improve logic to calculate oplog info and window

  #42224 opened Jan 6, 2025

• [8.x] [JWT Integration] Fix for error handling in ParseWithClaims can lead to potentially dangerous situations

  #42241 opened Jan 7, 2025

• Skip flaky test TestSQSReceiver/ReceiveMessage_success

  #42245 opened Jan 7, 2025

• [Release] Update version to 7.17.28

  #42255 opened Jan 8, 2025

• [Release] Update test environments for 7.17.28

  #42256 opened Jan 8, 2025

• [Release] Update version to 8.16.4

  #42259 opened Jan 8, 2025

• [Release] Update test environments for 8.16.4

  #42260 opened Jan 8, 2025

• [Release] Update version to 8.17.2

  #42262 opened Jan 8, 2025

• [Release] Update test environments for 8.17.2

  #42263 opened Jan 8, 2025

• github-actions: support for copying the backport labels

  #42266 opened Jan 8, 2025

• Add description of Wolfi container install image

  #42268 opened Jan 8, 2025

• Migrate Netflow code to the logp logging library

  #42270 opened Jan 8, 2025

• x-pack/metricbeat/module/sql: Add debug queries when `merge_results: true`

  #42271 opened Jan 9, 2025

• [filebeat] Add support for pprof in otel

  #42272 opened Jan 9, 2025

• [x-pack][metricbeat][iis] improve error handling on pdh counters in application_pool data stream

  #42274 opened Jan 9, 2025

• [winlogbeat] Default to raw api

  #42275 opened Jan 9, 2025

13 Issues closed by 7 people

• Remove backwards compatible flag support

  #42117 closed Jan 9, 2025

• [Kubernetes] APiserver metrciset to be able to handle token updates

  #41910 closed Jan 8, 2025

• `aws-s3` input's bucket polling accumulates state in the registry

  #39116 closed Jan 7, 2025

• [AWS-S3] Add a timestamp filter for s3 polling mode

  #41232 closed Jan 7, 2025

• [filebeat][streaming] - Standard OAuth2 implementation for websockets.

  #41989 closed Jan 7, 2025

• Filebeat should fail to start when multiple filestream inputs have the same input ID

  #40540 closed Jan 4, 2025

• filestream should not run inputs with duplicated IDs

  #41938 closed Jan 4, 2025

• Investigate if it is possible to prevent inputs with non-unique IDs from being templated by autodiscovery

  #41881 closed Jan 4, 2025

• Filebeat cannot collect log files of soft links.

  #42216 closed Jan 4, 2025

• Remove TLS 1.x from default list of supported protocols

  #41595 closed Jan 3, 2025

• [Winlogbeat] Investigate if chaining XPath queries in XML query bypasses 22 clause limit.

  #35047 closed Jan 3, 2025

• [Winlogbeat] Detect and handle publisher disabled errors

  #35316 closed Jan 3, 2025

• 8.17.0 docker containers not starting with default arguments

  #42038 closed Jan 3, 2025

9 Issues opened by 9 people

• Filebeat can be asked for a listing of files that can be safely deleted

  #42278 opened Jan 9, 2025

• Keepalive for websocket connections

  #42277 opened Jan 9, 2025

• use decompress_gzip_field to decompress the gz compressed package, but the information received in Graylog was garbled

  #42273 opened Jan 9, 2025

• beats/x-pack/filebeat/modules.d /microsoft.yml doesn't seem to work with GCC High / Gov Endpoints

  #42265 opened Jan 8, 2025

• Consolidate documentation around fingerprint file identity in the Filestream output

  #42264 opened Jan 8, 2025

• Support filebeat kafka output's MSK IAM Auth

  #42248 opened Jan 8, 2025

• Implementation Detail: Logging should use logp everywhere

  #42247 opened Jan 7, 2025

• [Journald] Better align the fields produced by the input with ECS

  #42208 opened Jan 3, 2025

• libbeat: use klauspost/compress for asset encoding and decoding

  #42207 opened Jan 3, 2025

37 Unresolved conversations

Sometimes conversations happen on old items that aren’t yet closed. Here is a list of all the Issues and Pull Requests with unresolved conversations.

• Add registry to Filebeat's diagnostic

  #41795 commented on Jan 8, 2025 • 9 new comments

• [system] - Add a flag to the system module to control whether metrics failures mark agent as degraded

  #42160 commented on Jan 8, 2025 • 1 new comment

• [filebeat] Elasticsearch state storage for httpjson and cel inputs

  #41446 commented on Jan 8, 2025 • 1 new comment

• auditbeat: system/process module backed by quark

  #42032 commented on Jan 9, 2025 • 1 new comment

• [Filebeat] Filebeat Processors - Make URI Parts Processor Available To Filebeat

  #29947 commented on Jan 2, 2025 • 0 new comments

• [8.x](backport #40006) OOTB support AWS Eventbridge

  #40814 commented on Jan 6, 2025 • 0 new comments

• [8.15](backport #41119) Add a known issue entry for 8.15.0 and 8.15.2 referencing https://github.com/elastic/beats/issues/41118

  #41124 commented on Jan 6, 2025 • 0 new comments

• [8.x](backport #41119) Add a known issue entry for 8.15.0 and 8.15.2 referencing https://github.com/elastic/beats/issues/41118

  #41125 commented on Jan 6, 2025 • 0 new comments

• [feat:filebeat/input/redis/slowlog] Add client address and name to submitted slowlogs

  #41507 commented on Jan 6, 2025 • 0 new comments

• [8.x](backport #40652) build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/containerservice/armcontainerservice/v4 from 4.6.0 to 4.8.0

  #41556 commented on Jan 6, 2025 • 0 new comments

• [draft] [testing] update kafka version used in testing to 3.6.0

  #41833 commented on Jan 7, 2025 • 0 new comments

• [8.x](backport #41994) docs: Prepare Changelog for 8.17.0

  #41996 commented on Jan 9, 2025 • 0 new comments

• [main](backport #41808) Correct the default filename of events-data

  #42035 commented on Jan 8, 2025 • 0 new comments

• [8.x](backport #42019) x-pack/filebeat/input/awss3: fix document ID construction when using csv decoder

  #42100 commented on Jan 9, 2025 • 0 new comments

• [7.17](backport #41960) Add upstream deadlock warning to the logstash output

  #42109 commented on Jan 9, 2025 • 0 new comments

• [8.16](backport #41960) Add upstream deadlock warning to the logstash output

  #42110 commented on Jan 9, 2025 • 0 new comments

• [8.17](backport #41960) Add upstream deadlock warning to the logstash output

  #42112 commented on Jan 9, 2025 • 0 new comments

• [metricbeats][mongodb] handle extra collstats metrics

  #42171 commented on Jan 7, 2025 • 0 new comments

• build(deps): bump the github-actions group across 1 directory with 3 updates

  #42175 commented on Jan 5, 2025 • 0 new comments

• [Docs] Logging format samples outdated

  #32262 commented on Jan 3, 2025 • 0 new comments

• GA support for reading from journald

  #37086 commented on Jan 3, 2025 • 0 new comments

• [Heartbeat] Include packet stats in ICMP checks

  #37549 commented on Jan 3, 2025 • 0 new comments

• Clarify documentation of beats output errors

  #27763 commented on Jan 4, 2025 • 0 new comments

• Add 'composed_of' support for template creation with setup commands

  #29549 commented on Jan 4, 2025 • 0 new comments

• [DOCS] Document Metricbeat limitation related to some metrics

  #37556 commented on Jan 6, 2025 • 0 new comments

• filebeat clashes with chkconfig under Rocky Linux 9 (redhat like distrib)

  #37622 commented on Jan 6, 2025 • 0 new comments

• [packaging] Retire init.d support in linux packages

  #36799 commented on Jan 6, 2025 • 0 new comments

• Kafka output might lose connection and not recover

  #37276 commented on Jan 6, 2025 • 0 new comments

• Metricbeat: Add support for ZFS metrics

  #25725 commented on Jan 7, 2025 • 0 new comments

• [Filebeat] Netflow input - expand TCP controls bits to list of named flags

  #12858 commented on Jan 7, 2025 • 0 new comments

• `take_over: true` is ignored when using input configuration from external files

  #36378 commented on Jan 7, 2025 • 0 new comments

• Beat Check Event_log message could include the path to the event_log

  #41991 commented on Jan 7, 2025 • 0 new comments

• [Flaky test] TestSQSReceiver - `missing call(s) to *awss3.MockSQSAPI.ReceiveMessage`

  #41458 commented on Jan 7, 2025 • 0 new comments

• [Filebeat] mapper [o365.audit.Folders.FolderItems.SizeInBytes] cannot be changed from type [long] to [float]

  #36155 commented on Jan 8, 2025 • 0 new comments

• [IIS] [application_pool] Element Not Found for Application Pools with 'No Managed Code'

  #41596 commented on Jan 8, 2025 • 0 new comments

• [main](backport #35950) docs: Prepare Changelog for 7.17.11

  #35956 commented on Jan 6, 2025 • 0 new comments

• refactor: replace github.com/olekukonko/tablewriter with text/tablewriter

  #40158 commented on Jan 2, 2025 • 0 new comments