diff --git a/.editorconfig b/.editorconfig index bd0cc74b8755..7a1535ad1b44 100644 --- a/.editorconfig +++ b/.editorconfig @@ -23,7 +23,10 @@ indent_size = 4 indent_style = space indent_size = 2 -[Makefile] +[Makefile*] +indent_style = tab + +[*.mk] indent_style = tab [Vagrantfile] diff --git a/.gitattributes b/.gitattributes index f02f9636b36b..2c1aaba4dec0 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1,5 +1,5 @@ -CHANGELOG.md merge=union -CHANGELOG.asciidoc merge=union +CHANGELOG.next.asciidoc merge=union +CHANGELOG-developer.next.asciidoc merge=union # Keep these file types as CRLF (Windows). *.bat text eol=crlf diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 000000000000..1efac5f55b34 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,39 @@ +# GitHub CODEOWNERS definition +# See: https://help.github.com/articles/about-codeowners/ + +# * @elastic/beats + +# libbeat +/libbeat/ @elastic/beats +/auditbeat/ @elastic/beats +/packetbeat/ @elastic/beats +/filebeat/ @elastic/beats +/metricbeat/ @elastic/beats +/journalbeat/ @elastic/beats +/winlogbeat/ @elastic/beats + +# Auditbeat +/auditbeat/module/ @elastic/secops +/x-pack/auditbeat/ @elastic/secops + +# Packetbeat +/packetbeat/protos/ @elastic/secops +/x-pack/packetbeat/ @elastic/secops + +# Filebeat +/filebeat/module/ @elastic/infrastructure +/filebeat/module/elasticsearch/ @elastic/stack-monitoring +/filebeat/module/kibana/ @elastic/stack-monitoring +/filebeat/module/logstash/ @elastic/stack-monitoring +/x-pack/filebeat/module/ @elastic/infrastructure +/x-pack/filebeat/module/suricata/ @elastic/secops + +# Metricbeat +/metricbeat/module/ @elastic/infrastructure +/metricbeat/module/elasticsearch/ @elastic/stack-monitoring +/metricbeat/module/kibana/ @elastic/stack-monitoring +/metricbeat/module/logstash/ @elastic/stack-monitoring +/x-pack/metricbeat/module/ @elastic/infrastructure + +# Heartbeat +/heartbeat/ @elastic/uptime diff --git a/.github/ISSUE_TEMPLATE.md b/.github/ISSUE_TEMPLATE.md index 055a6d3793b6..e23de0d9da83 100644 --- a/.github/ISSUE_TEMPLATE.md +++ b/.github/ISSUE_TEMPLATE.md @@ -1,3 +1,9 @@ +--- +name: Bug +about: "Report confirmed bugs. For unconfirmed bugs please visit https://discuss.elastic.co/c/beats" + +--- + Please post all questions and issues on https://discuss.elastic.co/c/beats before opening a Github Issue. Your questions will reach a wider audience there, and if we confirm that there is a bug, then you can open a new issue. @@ -5,6 +11,8 @@ and if we confirm that there is a bug, then you can open a new issue. For security vulnerabilities please only send reports to security@elastic.co. See https://www.elastic.co/community/security for more information. +Please include configurations and logs if available. + For confirmed bugs, please report: - Version: - Operating System: diff --git a/.github/ISSUE_TEMPLATE/bug-report.md b/.github/ISSUE_TEMPLATE/bug-report.md new file mode 100644 index 000000000000..e23de0d9da83 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/bug-report.md @@ -0,0 +1,20 @@ +--- +name: Bug +about: "Report confirmed bugs. For unconfirmed bugs please visit https://discuss.elastic.co/c/beats" + +--- + +Please post all questions and issues on https://discuss.elastic.co/c/beats +before opening a Github Issue. Your questions will reach a wider audience there, +and if we confirm that there is a bug, then you can open a new issue. + +For security vulnerabilities please only send reports to security@elastic.co. +See https://www.elastic.co/community/security for more information. + +Please include configurations and logs if available. + +For confirmed bugs, please report: +- Version: +- Operating System: +- Discuss Forum URL: +- Steps to Reproduce: diff --git a/.github/ISSUE_TEMPLATE/feature-request.md b/.github/ISSUE_TEMPLATE/feature-request.md new file mode 100644 index 000000000000..63f696fa62e7 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/feature-request.md @@ -0,0 +1,10 @@ +--- +name: Enhancement request +about: Beats can't do all the things, but maybe it can do your things. + +--- + +**Describe the enhancement:** + +**Describe a specific use case for the enhancement or feature:** + diff --git a/.github/ISSUE_TEMPLATE/flaky-test.md b/.github/ISSUE_TEMPLATE/flaky-test.md new file mode 100644 index 000000000000..2fde723b510f --- /dev/null +++ b/.github/ISSUE_TEMPLATE/flaky-test.md @@ -0,0 +1,19 @@ +--- +name: Flaky Test +about: Report a flaky test (one that doesn't pass consistently) + +--- + +## Flaky Test + +* **Test Name:** Name of the failing test. +* **Link:** Link to file/line number in github. +* **Branch:** Git branch the test was seen in. If a PR, the branch the PR was based off. +* **Artifact Link:** If available, attach the generated zip artifact associated with the stack trace for this failure. +* **Notes:** Additional details about the test. e.g. theory as to failure cause + +### Stack Trace + +``` +paste stack trace here +``` diff --git a/.github/ISSUE_TEMPLATE/module-checklist.md b/.github/ISSUE_TEMPLATE/module-checklist.md new file mode 100644 index 000000000000..eeb545187cb0 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/module-checklist.md @@ -0,0 +1,36 @@ +--- +name: New Module / Dataset +about: "Meta issue to track the creation, updating of a new module or dataset." + +--- + +# Metricbeat Module / Dataset release checklist + +This checklist is intended for Devs which create or update a module to make sure modules are consistent. + +## Modules + +For a metricset to go GA, the following criterias should be met: + +* [ ] Supported versions are documented +* [ ] Supported operating systems are documented (if applicable) +* [ ] Integration tests exist +* [ ] System tests exist +* [ ] Automated checks that all fields are documented +* [ ] Documentation +* [ ] Fields follow [ECS](https://github.com/elastic/ecs) and [naming conventions](https://www.elastic.co/guide/en/beats/devguide/master/event-conventions.html) +* [ ] Dashboards exists (if applicable) +* [ ] Kibana Home Tutorial (if applicable) + * [ ] Open issue in [EUI repo](https://github.com/elastic/eui) to add [icon for module](https://elastic.github.io/eui/#/display/icons) if not already exists. + * [ ] Open PR against Kibana repo with tutorial. Examples can be found [here](https://github.com/elastic/kibana/tree/master/src/legacy/core_plugins/kibana/server/tutorials). + +## Filebeat module + +* [ ] Test log files exist for the grok patterns +* [ ] Generated output for at least 1 log file exists + + +## Metricbeat module + +* [ ] Example `data.json` exists and an automated way to generate it exists (`go test -data`) +* [ ] Test environment in Docker exist for integration tests diff --git a/.github/ISSUE_TEMPLATE/question.md b/.github/ISSUE_TEMPLATE/question.md new file mode 100644 index 000000000000..2d231df29a71 --- /dev/null +++ b/.github/ISSUE_TEMPLATE/question.md @@ -0,0 +1,18 @@ +--- +name: Question +about: Who, what, when, where, and how? + +--- + +Hey, stop right there! + +We use GitHub to track feature requests and bug reports. Please do not submit issues for questions about how to use features of Beat, how to set Beats up, best practices, or development related help. + +However, we do want to help! Head on over to our official Beats forums and ask +your questions there. In additional to awesome, knowledgeable community +contributors, core Beats developers are on the forums every single day to help +you out. + +The forums are here: https://discuss.elastic.co/c/beats + +We can't stop you from opening an issue here, but it will likely linger without a response for days or weeks before it is closed and we ask you to join us on the forums instead. Save yourself the time, and ask on the forums today. diff --git a/.go-version b/.go-version index 587c5f0c7309..89c881bc9cb9 100644 --- a/.go-version +++ b/.go-version @@ -1 +1 @@ -1.10.3 +1.12.4 diff --git a/.travis.yml b/.travis.yml index 4f7b7eca46a9..f39dbc02b1cb 100644 --- a/.travis.yml +++ b/.travis.yml @@ -12,8 +12,8 @@ env: global: # Cross-compile for amd64 only to speed up testing. - GOX_FLAGS="-arch amd64" - - DOCKER_COMPOSE_VERSION=1.11.1 - - GO_VERSION="$(cat .go-version)" + - DOCKER_COMPOSE_VERSION=1.21.0 + - TRAVIS_GO_VERSION=$(cat .go-version) # Newer versions of minikube fail on travis, see: https://github.com/kubernetes/minikube/issues/2704 - TRAVIS_MINIKUBE_VERSION=v0.25.2 @@ -22,113 +22,138 @@ jobs: # General checks - os: linux env: TARGETS="check" - go: $GO_VERSION + go: $TRAVIS_GO_VERSION stage: check # Filebeat - os: linux env: TARGETS="-C filebeat testsuite" - go: $GO_VERSION + go: $TRAVIS_GO_VERSION stage: test - os: osx env: TARGETS="TEST_ENVIRONMENT=0 -C filebeat testsuite" - go: $GO_VERSION + go: $TRAVIS_GO_VERSION + stage: test + - os: linux + env: TARGETS="-C x-pack/filebeat testsuite" + go: $(GO_VERSION) stage: test # Heartbeat - os: linux env: TARGETS="-C heartbeat testsuite" - go: $GO_VERSION + go: $TRAVIS_GO_VERSION stage: test - os: osx env: TARGETS="TEST_ENVIRONMENT=0 -C heartbeat testsuite" - go: $GO_VERSION + go: $TRAVIS_GO_VERSION stage: test # Auditbeat - os: linux env: TARGETS="-C auditbeat testsuite" - go: $GO_VERSION + go: $TRAVIS_GO_VERSION stage: test - os: osx env: TARGETS="TEST_ENVIRONMENT=0 -C auditbeat testsuite" - go: $GO_VERSION + go: $TRAVIS_GO_VERSION stage: test - os: linux env: TARGETS="-C auditbeat crosscompile" - go: $GO_VERSION + go: $TRAVIS_GO_VERSION + stage: test + - os: linux + env: TARGETS="-C x-pack/auditbeat testsuite" + go: $TRAVIS_GO_VERSION stage: test # Libbeat - os: linux env: TARGETS="-C libbeat testsuite" - go: $GO_VERSION + go: $TRAVIS_GO_VERSION stage: test - os: linux env: TARGETS="-C libbeat crosscompile" - go: $GO_VERSION + go: $TRAVIS_GO_VERSION stage: test - os: linux env: STRESS_TEST_OPTIONS="-timeout=20m -race -v -parallel 1" TARGETS="-C libbeat stress-tests" - go: $GO_VERSION + go: $TRAVIS_GO_VERSION + stage: test + - os: linux + env: TARGETS="-C x-pack/libbeat testsuite" + go: $TRAVIS_GO_VERSION stage: test # Metricbeat - os: linux - env: TARGETS="-C metricbeat testsuite" - go: $GO_VERSION + env: TARGETS="-C metricbeat unit-tests coverage-report" + go: $TRAVIS_GO_VERSION stage: test + - os: linux + env: TARGETS="-C metricbeat integration-tests-environment coverage-report" + go: $TRAVIS_GO_VERSION + stage: test + - os: linux + env: TARGETS="-C metricbeat update system-tests-environment coverage-report" + go: $TRAVIS_GO_VERSION + stage: test + - os: osx env: TARGETS="TEST_ENVIRONMENT=0 -C metricbeat testsuite" - go: $GO_VERSION + go: $TRAVIS_GO_VERSION stage: test - os: linux env: TARGETS="-C metricbeat crosscompile" - go: $GO_VERSION + go: $TRAVIS_GO_VERSION + stage: test + - os: linux + env: TARGETS="-C x-pack/metricbeat testsuite" + go: $TRAVIS_GO_VERSION stage: test # Packetbeat - os: linux env: TARGETS="-C packetbeat testsuite" - go: $GO_VERSION + go: $TRAVIS_GO_VERSION stage: test # Winlogbeat - os: linux env: TARGETS="-C winlogbeat crosscompile" - go: $GO_VERSION + go: $TRAVIS_GO_VERSION stage: test # Functionbeat - os: linux env: TARGETS="-C x-pack/functionbeat testsuite" - go: $GO_VERSION + go: $TRAVIS_GO_VERSION stage: test - os: osx env: TARGETS="TEST_ENVIRONMENT=0 -C x-pack/functionbeat testsuite" - go: $GO_VERSION + go: $TRAVIS_GO_VERSION stage: test # Journalbeat - os: linux env: TARGETS="-C journalbeat testsuite" - go: $GO_VERSION + go: $TRAVIS_GO_VERSION stage: test # Generators - os: linux env: TARGETS="-C generator/metricbeat test" - go: $GO_VERSION + go: $TRAVIS_GO_VERSION stage: test - os: linux env: TARGETS="-C generator/beat test" - go: $GO_VERSION + go: $TRAVIS_GO_VERSION stage: test # Docs - os: linux env: TARGETS="docs" - go: $GO_VERSION + go: $TRAVIS_GO_VERSION stage: test # Kubernetes @@ -167,6 +192,7 @@ addons: - xsltproc - libxml2-utils - libsystemd-journal-dev + - librpm-dev before_install: - python --version diff --git a/CHANGELOG-developer.asciidoc b/CHANGELOG-developer.asciidoc index ac0b60a293ee..29fd3cce790b 100644 --- a/CHANGELOG-developer.asciidoc +++ b/CHANGELOG-developer.asciidoc @@ -12,10 +12,46 @@ other Beats should be migrated. Note: This changelog was only started after the 6.3 release. -=== Beats version HEAD -https://github.com/elastic/beats/compare/v6.3.0..master[Check the HEAD diff] +=== Beats version 7.0.0-rc2 +https://github.com/elastic/beats/compare/v7.0.0-rc1..v7.0.0-rc2[Check the HEAD diff] -The list below covers the major changes between 6.3.0 and master only. +=== Beats version 7.0.0-rc1 +https://github.com/elastic/beats/compare/v7.0.0-beta1..v7.0.0-rc1[Check the HEAD diff] + +==== Breaking changes + +- Remove support for deprecated `GenRootCmd` methods. {pull}10721[10721] +- Remove SkipNormalization, SkipAgentMetadata, SkipAddHostName. {pull}10801[10801] {pull}10769[10769] + +==== Bugfixes + +- Align default index between elasticsearch and logstash and kafka output. {pull}10841[10841] +- Fix duplication check for `append_fields` option. {pull}10959[10959] + +==== Added + +- Introduce processing.Support to instance.Setting. This allows Beats to fully modify the event processing. {pull}10801[10801] + +=== Beats version 7.0.0-beta1 +https://github.com/elastic/beats/compare/v7.0.0-alpha2..v7.0.0-beta1[Check the HEAD diff] + +==== Breaking changes +- Outputs receive Index Manager as additional parameter. The index manager can + be used to create an index selector. {pull}10347[10347] +- Remove support for loading dashboards to Elasticsearch 5. {pull}10451[10451] + +==== Added + +- Allow multiple object type configurations per field. {pull}9772[9772] +- Move agent metadata addition to a processor. {pull}9952[9952] +- Add (*common.Config).Has and (*common.Config).Remove. {pull}10363[10363] +- Introduce ILM and IndexManagement support to beat.Settings. {pull}10347[10347] +- Generating index pattern on demand instead of shipping them in the packages. {pull}10478[10478] + +=== Beats version 7.0.0-alpha2 +https://github.com/elastic/beats/compare/v6.3.0..v7.0.0-alpha2[Check the HEAD diff] + +The list below covers the major changes between 6.3.0 and 7.0.0-alpha2 only. ==== Breaking changes @@ -31,12 +67,16 @@ The list below covers the major changes between 6.3.0 and master only. used because the value is specified in magefile.go. {pull}7670[7670] - Outputs must implement String. {pull}6404[6404] - Renamed `-beat-name` CLI option used in `kibana_index_pattern.go` to `-beat` for consistency with other scripts in `dev-tools/cmd`. {pull}8615[8615] +- Systemd unit file template used on Linux packaging now includes environment variables to ease flag overriding. One of them includes the `-e` flag, making beats log to stderr by default on systemd uses. {pull}8942[8942] +- Removed dashboards and index patterns generation for Kibana 5. {pull}8927[8927] +- Move generator packages of Filebeat from `scripts/generator` to `generator`. {pull}9147[9147] ==== Bugfixes - Fix permissions of generated Filebeat filesets. {pull}7140[7140] - Collect fields from _meta/fields.yml too. {pull}8397[8397] - Fix issue on asset generation that could lead to different results in Windows. {pull}8464[8464] +- Remove default version qualifier, you can use `VERSION_QUALIFIER` environment variable to set it. {pull}9148[9148] ==== Added @@ -61,3 +101,12 @@ The list below covers the major changes between 6.3.0 and master only. - Add `mage.GenerateModuleReferenceConfig` for generating reference config files that include configuration sections from the module directory. {pull}8615[8615] - Add `mage.GenerateFieldsGo` for generating fields.go files. {pull}8615[8615] - Add `mage.KibanaDashboards` for collecting Kibana dashboards and generating index patterns. {pull}8615[8615] +- Allow to disable config resolver using the `Settings.DisableConfigResolver` field when initializing libbeat. {pull}8769[8769] +- Add `mage.AddPlatforms` to allow to specify dependent platforms when building a beat. {pull}8889[8889] +- Add `cfgwarn.CheckRemoved6xSetting(s)` to display a warning for options removed in 7.0. {pull}8909[8909] +- Add docker image building to `mage.Package`. {pull}8898[8898] +- Simplified exporting of dashboards. {pull}7730[7730] +- Update Beats to use go 1.11.2 {pull}8746[8746] +- Allow/Merge fields.yml overrides {pull}9188[9188] +- Filesets can now define multiple ingest pipelines, with the first one considered as the entry point pipeline. {pull}8914[8914] +- Add `group_measurements_by_instance` option to windows perfmon metricset. {pull}8688[8688] diff --git a/CHANGELOG-developer.next.asciidoc b/CHANGELOG-developer.next.asciidoc new file mode 100644 index 000000000000..0df7b4fc21a9 --- /dev/null +++ b/CHANGELOG-developer.next.asciidoc @@ -0,0 +1,37 @@ +// Use these for links to issue and pulls. Note issues and pulls redirect one to +// each other on Github, so don't worry too much on using the right prefix. +:issue: https://github.com/elastic/beats/issues/ +:pull: https://github.com/elastic/beats/pull/ + +This changelog is intended for community Beat developers. It covers the major +breaking changes to the internal APIs in the official Beats and changes related +to developing a Beat like code generators or `fields.yml`. Only the major +changes will be covered in this changelog that are expected to affect community +developers. Each breaking change added here should have an explanation on how +other Beats should be migrated. + +Note: This changelog documents the current changes which are not yet present in +an actual release. + +=== Beats version HEAD +https://github.com/elastic/beats/compare/v7.0.0-rc2..master[Check the HEAD diff] + +The list below covers the major changes between 7.0.0-rc2 and master only. + +==== Breaking changes + +- Move Fields from package libbeat/common to libbeat/mapping. {pull}11198[11198] + +==== Bugfixes + +==== Added + +- Metricset generator generates beta modules by default now. {pull}10657[10657] +- The `beat.Event` accessor methods now support `@metadata` keys. {pull}10761[10761] +- Assertion for documented fields in tests fails if any of the fields in the tested event is documented as an alias. {pull}10921[10921] +- Support for Logger in the Metricset base instance. {pull}11106[11106] +- Filebeat modules can now use ingest pipelines in YAML format. {pull}11209[11209] +- Added support for using PYTHON_EXE to control what Python interpreter is used + by `make` and `mage`. Example: `export PYTHON_EXE=python2.7`. {pull}11212[11212] +- Prometheus helper for metricbeat contains now `Namespace` field for `prometheus.MetricsMappings` {pull}11424[11424] +- Update Jinja2 version to 2.10.1. {pull}11817[11817] diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc index be54f72d9deb..6857f7a10560 100644 --- a/CHANGELOG.asciidoc +++ b/CHANGELOG.asciidoc @@ -3,108 +3,1272 @@ :issue: https://github.com/elastic/beats/issues/ :pull: https://github.com/elastic/beats/pull/ -//////////////////////////////////////////////////////////// -// Template, add newest changes here +[[release-notes-7.0.0-rc2]] +=== Beats version 7.0.0-rc2 +https://github.com/elastic/beats/compare/v7.0.0-rc1...v7.0.0-rc2[Check the HEAD diff] -=== Beats version HEAD -https://github.com/elastic/beats/compare/v6.4.0...master[Check the HEAD diff] +==== Breaking changes + +*Auditbeat* + +- Process dataset: Only report processes with executable. {pull}11232[11232] +- Shorten entity IDs. {pull}11405[11405] + +*Metricbeat* + +- Add connection and request timeouts for HTTP helper. {pull}11032[11032] + +==== Bugfixes + +*Affecting all Beats* + +- Fixed OS family classification in `add_host_metadata` for Amazon Linux, Raspbian, and RedHat Linux. {issue}9134[9134] {pull}11494[11494] + +*Filebeat* + +- Don't apply multiline rules in Logstash json logs. {pull}11346[11346] +- Fix panic in add_kubernetes_metadata processor when key `log` does not exist. {issue}11543[11543] {pull}11549[11549] + +==== Added + +*Auditbeat* + +- Login dataset: Add event category and type. {pull}11339[11339] + +*Filebeat* + +- Add support for MySQL 8.0, Percona 8.0 and MariaDB 10.3. {pull}11417[11417] + +[[release-notes-7.0.0-rc1]] +=== Beats version 7.0.0-rc1 +https://github.com/elastic/beats/compare/v7.0.0-beta1...v7.0.0-rc1[Check the HEAD diff] + +==== Breaking changes + +*Affecting all Beats* + +- On Google Cloud Engine (GCE) the add_cloud_metadata will now trim the project + info from the cloud.machine.type and cloud.availability_zone. {issue}10968[10968] +- Add `cleanup_timeout` option to docker autodiscover, to wait some time before removing configurations after a container is stopped. {issue}10374[10374] {pull}10905[10905] +- Empty `meta.json` file will be treated as a missing meta file. {issue}8558[8558] +- Rename `migration.enabled` config to `migration.6_to_7.enabled`. {pull}11284[11284] +- Initialize the Paths before the keystore and save the keystore into `data/{beatname}.keystore`. {pull}10706[10706] +- Beats Xpack now checks for Basic license on connect. {pull}11296[11296] + +*Auditbeat* + +- Process dataset: Only report processes with executable. {pull}11232[11232] + +*Filebeat* + +- Set `ecs: true` in user_agent processors when loading pipelines with Filebeat 7.0.x into Elasticsearch 6.7.x. {issue}10655[10655] {pull}10875[10875] + +*Metricbeat* + +- Migrate docker module to ECS. {pull}10927[10927] + +*Functionbeat* + +- Correctly extract Kinesis Data field from the Kinesis Record. {pull}11141[11141] + +==== Bugfixes + +*Affecting all Beats* + +- Reconnections of Kubernetes watchers are now logged at debug level when they are harmless. {pull}10988[10988] +- Add missing host.* fields to fields.yml. {pull}11016[11016] +- Include ip and boolean type when generating index pattern. {pull}10995[10995] +- Using an environment variable for the password when enrolling a beat will now raise an error if the variable doesn't exist. {pull}10936[10936] +- Cancelling enrollment of a beat will not enroll the beat. {issue}10150[10150] +- Allow to configure Kafka fetching strategy for the topic metadata. {pull}10682[10682] + +*Auditbeat* + +- Package: Disable librpm signal handlers. {pull}10694[10694] +- Login: Handle different bad login UTMP types. {pull}10865[10865] +- System module: Fix and unify bucket closing logic. {pull}10897[10897] +- User dataset: Numerous fixes to error handling. {pull}10942[10942] + +*Filebeat* + +- Fix errors in filebeat Zeek dashboard and README files. Add notice.log support. {pull}10916[10916] +- Fix a bug when converting NetFlow fields to snake_case. {pull}10950[10950] +- Add on_failure handler for Zeek ingest pipelines. Fix one field name error for notice and add an additional test case. {issue}11004[11004] {pull}11105[11105] +- Fix issue preventing docker container events to be stored if the container has a network interface without ip address. {issue}11225[11225] {pull}11247[11247] +- Change URLPATH grok pattern to support brackets. {issue}11135[11135] {pull}11252[11252] +- Add support for iis log with different address format. {issue}11255[11255] {pull}11256[11256] + +*Heartbeat* + +- Fix checks for TCP send/receive data {pull}11118[11118] + +*Metricbeat* + +- Migrate docker autodiscover to ECS. {issue}10757[10757] {pull}10862[10862] +- Fix issue in kubernetes module preventing usage percentages to be properly calculated. {pull}10946[10946] +- Fix for not reusable http client leading to connection leaks in Jolokia module {pull}11014[11014] +- Fix parsing error using GET in Jolokia module. {pull}11075[11075] {issue}11071[11071] +- Collect metrics when EC2 instances are not in running state. {issue}11008[11008] {pull}11023[11023] +- Change ECS field cloud.provider to aws. {pull}11023[11023] +- Add documentation about jolokia autodiscover fields. {issue}10925[10925] {pull}10979[10979] +- Add missing aws.ec2.instance.state.name into fields.yml. {issue}11219[11219] {pull}11221[11221] +- Fix ec2 metricset to collect metrics from Cloudwatch with the same timestamp. {pull}11142[11142] +- Fix potential memory leak in stopped docker metricsets {pull}11294[11294] + +*Packetbeat* + +- Avoid reporting unknown MongoDB opcodes more than once. {pull}10878[10878] + +*Winlogbeat* + +- Prevent Winlogbeat from dropping events with invalid XML. {pull}11006[11006] +- Fix Winlogbeat escaping CR, LF and TAB characters. {issue}11328[11328] {pull}11357[11357] + +*Functionbeat* + +==== Added + +*Affecting all Beats* + +- Add ip fields to default_field in Elasticsearch template. {pull}11035[11035] + +*Auditbeat* + +- Move System module to beta. {pull}10800[10800] + +*Filebeat* + +- Add ISO8601 timestamp support in syslog metricset. {issue}8716[8716] {pull}10736[10736] +- Add support for loading custom NetFlow and IPFIX field definitions to netflow input. {pull}10945[10945] {pull}11223[11223] +- Added categorization fields for SSH login events in the system/auth fileset. {pull}11334[11334] + +*Metricbeat* + +- Add filters and pie chart for AWS EC2 dashboard. {pull}10596[10596] + + +==== Known Issue + +*Journalbeat* + +- Journalbeat requires at least systemd v233 in order to follow entries after journal changes (rotation, vacuum). + +[[release-notes-7.0.0-beta1]] +=== Beats version 7.0.0-beta1 +https://github.com/elastic/beats/compare/v7.0.0-alpha2...v7.0.0-beta1[Check the HEAD diff] + +==== Breaking changes + +*Affecting all Beats* + +- Embedded html is not escaped anymore by default. {pull}9914[9914] +- Remove port settings from Logstash and Redis output. {pull}9934[9934] +- Rename `process.exe` to `process.executable` in add_process_metadata to align with ECS. {pull}9949[9949] +- Import ECS change https://github.com/elastic/ecs/pull/308[ecs#308]: + leaf field `user.group` is now the `group` field set. {pull}10275[10275] +- Update the code of Central Management to align with the new returned format. {pull}10019[10019] +- Docker and Kubernetes labels/annotations will be "dedoted" by default. {pull}10338[10338] +- Remove --setup command line flag. {pull}10138[10138] +- Remove --version command line flag. {pull}10138[10138] +- Remove --configtest command line flag. {pull}10138[10138] +- Move output.elasticsearch.ilm settings to setup.ilm. {pull}10347[10347] +- ILM will be available by default if Elasticsearch > 7.0 is used. {pull}10347[10347] + +*Auditbeat* + +- Rename `process.exe` to `process.executable` in auditd module to align with ECS. {pull}9949[9949] +- Rename `process.cwd` to `process.working_directory` in auditd module to align with ECS. {pull}10195[10195] +- Change data type of `process.pid` and `process.ppid` to number in JSON output + of the auditd module. {pull}10195[10195] +- Change data type of `file.uid` and `file.gid` to string in JSON output of the + FIM module. {pull}10195[10195] +- Field `file.origin` changed type from `text` to `keyword`. {pull}10544[10544] +- Rename user fields to ECS in auditd module. {pull}10456[10456] +- Rename `event.type` to `auditd.message_type` in auditd module because event.type is reserved for future use by ECS. {pull}10536[10536] +- Rename `auditd.messages` to `event.original` and `auditd.warnings` to `error.message`. {pull}10577[10577] + +*Filebeat* + +- Rename many `kibana.log.*` fields to map to ECS. {pull}9301[9301] +- Modify apache/error dataset to follow ECS. {pull}8963[8963] +- Rename many `traefik.access.*` fields to map to ECS. {pull}9005[9005] +- Fix parsing of GC entries in elasticsearch server log. {issue}9513[9513] {pull}9810[9810] +- Rename `read_timestamp` to `event.created` for Redis input. {pull}9924[9924] +- Rename a few `elasticsearch.audit.*` fields to map to ECS. {pull}9293[9293] +- Rename `read_timestamp` to `event.created` for all Filebeat modules using it. {pull}10139[10139] +- Rename many `iis.error.*` fields to map to ECS. {pull}9955[9955] +- Adjust fileset `haproxy.log` to map to ECS. {pull}10143[10143] +- Rename a few `logstash.*` fields to map to ECS, remove logstash.slowlog.message. {pull}9935[9935] +- Rename a few `mongodb.*` fields to map to ECS. {pull}10009[10009] +- Rename a few `mysql.*` fields to map to ECS. {pull}10008[10008] +- Rename a few `nginx.error.*` fields to map to ECS. {pull}10007[10007] +- Rename many `auditd.log.*` fields to map to ECS. {pull}10192[10192] +- Filesets with multiple ingest pipelines added in {pull}8914[8914] only work with Elasticsearch >= 6.5.0 {pull}10001[10001] +- Remove service.name from Elastcsearch module. Replace by service.type. {pull}10042[10042] +- Remove numeric coercions for `user.id` and `group.id`. IDs should be `keyword`. {pull}10233[10233] +- Add grok pattern to support redis 5.0.3 log timestamp. {issue}9819[9819] {pull}10033[10033] +- Now save the 'first seen' timestamp in `event.created` (previously `read_timestamp`), + instead of saving the parsed date. Now aligned with `event.created` semantics elsewhere. {pull}10139[10139] +- Rename `mysql.error.thread_id` and `mysql.slowlog.id` to `mysql.thread_id`. {pull}10161[10161] +- Remove `mysql.error.timestamp` and `mysql.slowlog.timestamp`. {pull}10161[10161] +- Migrate multiple fields to `event.duration`, from modules "apache", "elasticsearch", + "haproxy", "iis", "kibana", "mysql", "nginx", "postgresql" and "traefik", + including `http.response.elapsed_time` (ECS). {pull}10188[10188], {pull}10274[10274] +- Rename multiple fields to `http.response.body.bytes`, from modules "apache", "iis", + "kibana", "nginx" and "traefik", including `http.response.content_length` (ECS). {pull}10188[10188] +- Change type from haproxy.log fileset fields from text to keyword: response.captured_headers, request.captured_headers, `raw_request_line`, `mode`. {pull}10397[10397] +- Change type of field backend_url and frontend_name in traefik.access metricset to type keyword. {pull}10401[10401] +- Ingesting Elasticsearch audit logs is only supported with Elasticsearch 6.5.0 and above {pull}10352[10352] +- Migrate Elasticsearch audit logs fields to ECS {pull}10352[10352] +- Several text fields in the Logstash module are now indexed as `keyword` fields with `text` multi-fields (ECS). {pull}10417[10417] +- Several text fields in the Elasticsearch module are now indexed as `keyword` fields with `text` multi-fields (ECS). {pull}10414[10414] +- Move dissect pattern for traefik.access fileset from Filbeat to Elasticsearch. {pull}10442[10442] +- The `elasticsearch/deprecation` fileset now indexes the `component` field under `elasticsearch` instead of `elasticsearch.server`. {pull}10445[10445] +- Remove field `kafka.log.trace.full` from kafka.log fielset. {pull}10398[10398] +- Change field `kafka.log.class` for kafka.log fileset from text to keyword. {pull}10398[10398] +- Address add_kubernetes_metadata processor issue where old source field is + still used for matcher. {issue}10505[10505] {pull}10506[10506] +- Change type of haproxy.source from text to keyword. {pull}10506[10506] +- Rename `event.type` to `suricata.eve.event_type` in Suricata module because event.type is reserved for future use by ECS. {pull}10575[10575] +- Populate more ECS fields in the Suricata module. {pull}10006[10006] +- Rename setting `filebeat.registry_flush` to `filebeat.registry.flush`. {pull}10504[10504] +- Rename setting `filebeat.registry_file_permission` to `filebeat.registry.file_permission`. {pull}10504[10504] +- Remove setting `filebeat.registry_file` in favor of `filebeat.registry.path`. The registry file will be stored in a sub-directory by now. {pull}10504[10504] + +*Heartbeat* + +- Remove monitor generator script that was rarely used. {pull}9648[9648] +- monitor IDs are now configurable. Auto generated monitor IDs now use a different formula based on a hash of their config values. If you wish to have continuity with the old format of monitor IDs you'll need to set the `id` property explicitly. {pull}9697[9697] +- A number of fields have been aliased to their relevant counterparts in the `url.*` field. Existing visualizations should mostly work. The fields that have been moved are `monitor.scheme -> url.scheme`, `monitor.host -> url.domain`, `resolve.host -> url.domain`, `http.url -> url.full`, `tcp.port -> url.port`. In addition to these moves the new fields `url.username`, `url.password`, `url.path`, and `url.query` are now present. It should be noted that the `url.password` field does not contain actual password values, but rather the text `` {pull}9570[9570]. +- The included Kibana HTTP dashboard is now removed in favor of the Uptime app in Kibana. {pull}10294[10294] + +*Journalbeat* + +- Rename read_timestamp to event.created to align with ECS. {pull}10043[10043], {pull}10139[10139] +- Rename host.name to host.hostname to align with ECS. {pull}10043[10043] +- Fix typo in the field name `container.id_truncated`. {pull}10525[10525] +- Rename `container.image.tag` to `container.log.tag`. {pull}10561[10561] +- Change type of `text` fields to `keyword`. {pull}10542[10542] + +*Metricbeat* + +- Migrate system process metricset fields to ECS. {pull}10332[10332] +- Refactor Prometheus metric mappings {pull}9948[9948] +- Removed Prometheus stats metricset in favor of just using Prometheus collector {pull}9948[9948] +- Migrate system socket metricset fields to ECS. {pull}10339[10339] +- Renamed direction values in sockets to ECS recommendations, from incoming/outcoming to inbound/outbound. {pull}10339[10339] +- Adjust Redis.info metricset fields to ECS. {pull}10319[10319] +- Change type of field docker.container.ip_addresses to `ip` instead of `keyword`. {pull}10364[10364] +- Rename http.request.body field to http.request.body.content. {pull}10315[10315] +- Adjust php_fpm.process metricset fields to ECS. {pull}10366[10366] +- Adjust mongodb.status metricset to to ECS. {pull}10368[10368] +- Refactor munin module to collect an event per plugin and to have more strict field mappings. `namespace` option has been removed, and will be replaced by `service.name`. {pull}10322[10322] +- Change the following fields from type text to keyword: {pull}10318[10318] + - ceph.osd_df.name + - ceph.osd_tree.name + - ceph.osd_tree.children + - kafka.consumergroup.meta + - kibana.stats.name + - mongodb.metrics.replication.executor.network_interface + - php_fpm.process.request_uri + - php_fpm.process.script +- Add `service.name` option to all modules to explicitly set `service.name` if it is unset. {pull}10427[10427] +- Update a few elasticsearch.* fields to map to ECS. {pull}10350[10350] +- Update a few logstash.* fields to map to ECS. {pull}10350[10350] +- Update a few kibana.* fields to map to ECS. {pull}10350[10350] +- Update rabbitmq.* fields to map to ECS. {pull}10563[10563] +- Update haproxy.* fields to map to ECS. {pull}10558[10558] {pull}10568[10568] +- Collect all EC2 meta data from all instances in all states. {pull}10628[10628] +- Fix MongoDB dashboard that had some incorrect field names from `status` Metricset {pull}9795[9795] {issue}9715[9715] + +*Packetbeat* + +- Adjust Packetbeat `http` fields to ECS Beta 2 {pull}9645[9645] + - `http.request.body` moves to `http.request.body.content` + - `http.response.body` moves to `http.response.body.content` +- Changed Packetbeat fields to align with ECS. {issue}7968[7968] +- Removed trailing dot from domain names reported by the DNS protocol. {pull}9941[9941] + +*Winlogbeat* + +- Adjust Winlogbeat fields to map to ECS. {pull}10333[10333] + +*Functionbeat* + +- Correctly normalize Cloudformation resource name. {issue}10087[10087] +- Functionbeat can now deploy a function for Kinesis. {10116}10116[10116] +- Allow functionbeat to use the keystore. {issue}9009[9009] + +==== Bugfixes + +*Affecting all Beats* + +- Fix config appender registration. {pull}9873[9873] +- Gracefully handle TLS options when enrolling a Beat. {issue}9129[9129] +- The backing off now implements jitter to better distribute the load. {issue}10172[10172] +- Fix TLS certificate DoS vulnerability. {pull}10302[10302] +- Fix panic and file unlock in spool on atomic operation (arm, x86-32). File lock was not released when panic occurs, leading to the beat deadlocking on startup. {pull}10289[10289] +- Fix encoding of timestamps when using disk spool. {issue}10099[10099] +- Fix stopping of modules started by kubernetes autodiscover. {pull}10476[10476] +- Fix a issue when remote and local configuration didn't match when fetching configuration from Central Management. {issue}10587[10587] +- Fix unauthorized error when loading dashboards by adding username and password into kibana config. {issue}10513[10513] {pull}10675[10675] +- Fix exclude_labels when there are dotted keys {pull}10154[10154] +- Fix registry handle leak on Windows (https://github.com/elastic/go-sysinfo/pull/33). {pull}9920[9920] + +*Auditbeat* + +- Enable System module config on Windows. {pull}10237[10237] + +*Filebeat* + +- Support IPv6 addresses with zone id in IIS ingest pipeline. + {issue}9836[9836] error log: {pull}9869[9869], access log: {pull}9955[9955]. +- Support haproxy log lines without captured headers. {issue}9463[9463] {pull}9958[9958] +- Make elasticsearch/audit fileset be more lenient in parsing node name. {issue}10035[10035] {pull}10135[10135] +- Fix bad bytes count in `docker` input when filtering by stream. {pull}10211[10211] +- Fixed data types for roles and indices fields in `elasticsearch/audit` fileset {pull}10307[10307] +- Ensure `source.address` is always populated by the nginx module (ECS). {pull}10418[10418] +- Support mysql 5.7.22 slowlog starting with time information. {issue}7892[7892] {pull}9647[9647] + +*Heartbeat* + +- Made monitors.d configuration part of the default config. {pull}9004[9004] +- Fixed rare issue where TLS connections to endpoints with x509 certificates missing either notBefore or notAfter would cause the check to fail with a stacktrace. {pull}9566[9566] + +*Journalbeat* + +- Do not stop collecting events when journal entries change. {pull}9994[9994] + +*Metricbeat* + +- Fix panics in vsphere module when certain values where not returned by the API. {pull}9784[9784] +- Fix pod UID metadata enrichment in Kubernetes module. {pull}10081[10081] +- Fix issue that would prevent collection of processes without command line on Windows. {pull}10196[10196] +- Fixed data type for tags field in `docker/container` metricset {pull}10307[10307] +- Fixed data type for tags field in `docker/image` metricset {pull}10307[10307] +- Fixed data type for isr field in `kafka/partition` metricset {pull}10307[10307] +- Fixed data types for various hosts fields in `mongodb/replstatus` metricset {pull}10307[10307] +- Added function to close sql database connection. {pull}10355[10355] +- Fix issue with `elasticsearch/node_stats` metricset (x-pack) not indexing `source_node` field. {pull}10639[10639] + +*Packetbeat* + +- Fix DHCPv4 dashboard that wouldn't load in Kibana. {issue}9850[9850] +- Fixed a crash when using af_packet capture {pull}10477[10477] + +*Winlogbeat* + +- Close handle on signalEvent. {pull}9838[9838] + +*Functionbeat* + +- Ensure that functionbeat is logging at info level not debug. {issue}10262[10262] +- Add the required permissions to the role when deployment SQS functions. {issue}9152[9152] + +==== Added + +*Affecting all Beats* + +- Update field definitions for `http` to ECS Beta 2 {pull}9645[9645] +- Add `agent.id` and `agent.ephemeral_id` fields to all beats. {pull}9404[9404] +- Add `name` config option to `add_host_metadata` processor. {pull}9943[9943] +- Add `add_labels` and `add_tags` processors. {pull}9973[9973] +- Add missing file encoding to readers. {pull}10080[10080] +- Introduce `migration.enabled` configuration. {pull}9805[9805] +- Add alias field support in Kibana index pattern. {pull}10075[10075] +- Add `add_fields` processor. {pull}10119[10119] +- Add Kibana field formatter to bytes fields. {pull}10184[10184] +- Document a few more `auditd.log.*` fields. {pull}10192[10192] +- Support Kafka 2.1.0. {pull}10440[10440] +- Add ILM mode `auto` to setup.ilm.enabled setting. This new default value detects if ILM is available {pull}10347[10347] +- Add support to read ILM policy from external JSON file. {pull}10347[10347] +- Add `overwrite` and `check_exists` settings to ILM support. {pull}10347[10347] +- Generate Kibana index pattern on demand instead of using a local file. {pull}10478[10478] +- Calls to Elasticsearch X-Pack APIs made by Beats won't cause deprecation logs in Elasticsearch logs. {9656}9656[9656] +- Allow to unenroll a Beat from the UI. {issue}9452[9452] +- Release Jolokia autodiscover as GA. {pull}9706[9706] +- Allow Central Management to send events back to kibana. {issue}9382[9382] + +*Auditbeat* + +- Add system module. {pull}9546[9546] +- Add `user.id` (UID) and `user.name` for ECS. {pull}10195[10195] +- Add `group.id` (GID) and `group.name` for ECS. {pull}10195[10195] +- System module `process` dataset: Add user information to processes. {pull}9963[9963] +- Add system `package` dataset. {pull}10225[10225] +- Add system module `login` dataset. {pull}9327[9327] +- Add `entity_id` fields. {pull}10500[10500] +- Add seven dashboards for the system module. {pull}10511[10511] + +*Filebeat* + +- Add `convert_timezone` option to Elasticsearch module to convert dates to UTC. {issue}9756[9756] {pull}9761[9761] +- Added module for parsing Google Santa logs. {pull}9540[9540] +- Added netflow input type that supports NetFlow v1, v5, v6, v7, v8, v9 and IPFIX. {issue}9399[9399] +- Add option to modules.yml file to indicate that a module has been moved {pull}9432[9432]. +- Add support for ssl_request_log in apache2 module. {issue}8088[8088] {pull}9833[9833] +- Add support for iis 7.5 log format. {issue}9753[9753] {pull}9967[9967] +- Add service.type field to all Modules. By default the field is set with the module name. It can be overwritten with `service.type` config. {pull}10042[10042] +- Add support for MariaDB in the `slowlog` fileset of `mysql` module. {pull}9731[9731] +- Apache module's error fileset now performs GeoIP lookup, like the access fileset. {pull}10273[10273] +- Elasticsearch module's slowlog now populates `event.duration` (ECS). {pull}9293[9293] +- HAProxy module now populates `event.duration` and `http.response.bytes` (ECS). {pull}10143[10143] +- Teach elasticsearch/audit fileset to parse out some more fields. {issue}10134[10134] {pull}10137[10137] +- Add convert_timezone to nginx module. {issue}9839[9839] {pull}10148[10148] +- Add support for Percona in the `slowlog` fileset of `mysql` module. {issue}6665[6665] {pull}10227[10227] +- Added support for ingesting structured Elasticsearch audit logs {pull}10352[10352] +- Added support for ingesting structured Elasticsearch slow logs {pull}10445[10445] +- Added support for ingesting structured Elasticsearch deprecation logs {pull}10445[10445] +- New iptables module that receives iptables/ip6tables logs over syslog or file. Supports Ubiquiti Firewall extensions. {issue}8781[8781] {pull}10176[10176] +- Added support for ingesting structured Elasticsearch server logs {pull}10428[10428] +- Populate more ECS fields in the Suricata module. {pull}10006[10006] +- Add module zeek. {issue}9931[9931] {pull}10034[10034] + +*Heartbeat* + +- Autodiscover metadata is now included in events by default. So, if you are using the docker provider for instance, you'll see the correct fields under the `docker` key. {pull}10258[10258] + +*Journalbeat* + +- Migrate registry from previously incorrect path. {pull}10486[10486] + +*Metricbeat* + +- Add `key` metricset to the Redis module. {issue}9582[9582] {pull}9657[9657] {pull}9746[9746] +- Add `socket_summary` metricset to system defaults, removing experimental tag and supporting Windows {pull}9709[9709] +- Add docker `event` metricset. {pull}9856[9856] +- Add 'performance' metricset to x-pack mssql module {pull}9826[9826] +- Add DeDot for kubernetes labels and annotations. {issue}9860[9860] {pull}9939[9939] +- Add more meaningful metrics to 'performance' Metricset on 'MSSQL' module {pull}10011[10011] +- Rename some fields in `performance` Metricset on MSSQL module to match the updated documentation from Microsoft {pull}10074[10074] +- Add AWS EC2 module. {pull}9257[9257] {issue}9300[9300] +- Release windows Metricbeat module as GA. {pull}10163[10163] +- Release traefik Metricbeat module as GA. {pull}10166[10166] +- Release Elastic stack modules (Elasticsearch, Logstash, and Kibana) as GA. {pull}10094[10094] +- List filesystems on Windows that have an access path but not an assigned letter {issue}8916[8916] {pull}10196[10196] +- Add `nats` module. {issue}10071[10071] +- Release uswgi Metricbeat module GA. {pull}10164[10164] +- Release php_fpm module as GA. {pull}10198[10198] +- Release Memcached module as GA. {pull}10199[10199] +- Release etcd module as GA. {pull}10200[10200] +- Release Ceph module as GA. {pull}10202[10202] +- Release aerospike module as GA. {pull}10203[10203] +- Release kubernetes apiserver and event metricsets as GA {pull}10212[10212] +- Release Couchbase module as GA. {pull}10201[10201] +- Release RabbitMQ module GA. {pull}10165[10165] +- Release envoyproxy module GA. {pull}10223[10223] +- Release mongodb.metrics and mongodb.replstatus as GA. {pull}10242[10242] +- Release mysql.galera_status as GA. {pull}10242[10242] +- Release postgresql.statement as GA. {pull}10242[10242] +- Release RabbitMQ Metricbeat module GA. {pull}10165[10165] +- Release Dropwizard module as GA. {pull}10240[10240] +- Release Graphite module as GA. {pull}10240[10240] +- Release kvm module as beta. {pull}10279[10279] +- Release http.server metricset as GA. {pull}10240[10240] +- Release Nats module as GA. {pull}10281[10281] +- Release munin module as GA. {pull}10311[10311] +- Release Golang module as GA. {pull}10312[10312] +- Release use of xpack.enabled: true flag in Elasticsearch and Kibana modules as GA. {pull}10222[10222] +- Add support for MySQL 8.0 and tests also for Percona and MariaDB. {pull}10261[10261] +- Rename 'db' Metricset to 'transaction_log' in MSSQL Metricbeat module {pull}10109[10109] +- Add process arguments and the path to its executable file in the system process metricset {pull}10332[10332] +- Added 'server' Metricset to Zookeeper Metricbeat module {issue}8938[8938] {pull}10341[10341] +- Release AWS module as GA. {pull}10345[10345] +- Add overview dashboard to Zookeeper Metricbeat module {pull}10379[10379] + +*Packetbeat* + +- Add `network.community_id` to Packetbeat flow events. {pull}10061[10061] +- Add aliases for flow fields that were renamed. {issue}7968[7968] {pull}10063[10063] +- Add support to decode mysql prepare statement command. {pull}8084[8084] + +*Functionbeat* + +- Mark Functionbeat as GA. {pull}10564[10564] + + +[[release-notes-7.0.0-alpha2]] +=== Beats version 7.0.0-alpha2 +https://github.com/elastic/beats/compare/v7.0.0-alpha1...v7.0.0-alpha2[Check the HEAD diff] + +==== Breaking changes + +*Affecting all Beats* + +- Update add_cloud_metadata fields to adjust to ECS. {pull}9265[9265] +- Automaticall cap signed integers to 63bits. {pull}8991[8991] +- Rename beat.timezone to event.timezone. {pull}9458[9458] +- Use _doc as document type. {pull}9056[9056] +- Removed dashboards and index patterns generation for Kibana 5. {pull}8927[8927] +- On systems with systemd, the Beats log is now written to journald by default rather than file. To revert this behaviour override BEAT_LOG_OPTS with an empty value. {pull}8942[8942]. + +*Auditbeat* + +- Remove warning for deprecated option: "filters". {pull}9002[9002] + +*Filebeat* + +- Allow beats to blacklist certain part of the configuration while using Central Management. {pull}9099[9099] +- Remove warnings for deprecated options: "spool_size", "publish_async", "idle_timeout". {pull}9002[9002] +- Rename many `haproxy.*` fields to map to ECS. {pull}9117[9117] +- Rename many `iis.access.*` fields to map to ECS. {pull}9084[9084] +- IIS module's user agent string is no longer encoded (`+` replaced with spaces). {pull}9084[9084] +- Rename many `system.syslog.*` fields to map to ECS. {pull}9135[9135] +- Rename many `nginx.access.*` fields to map to ECS. {pull}9081[9081] +- Rename many `system.auth.*` fields to map to ECS. {pull}9138[9138] +- Rename many `apache2.access.*` fields to map to ECS. {pull}9245[9245] +- Rename `apache2` module to `apache`. {pull}9402[9402] + +*Metricbeat* + +- Allow beats to blacklist certain part of the configuration while using Central Management. {pull}9099[9099] +- Remove warning for deprecated option: "filters". {pull}9002[9002] + +*Packetbeat* + +- Renamed the flow event fields to follow Elastic Common Schema. {pull}9121[9121] +- Renamed several client and server fields. IP, port, and process metadata are + now contained under the client and server namespaces. {issue}9303[9303] + +*Functionbeat* + +- The CLI will now log CloudFormation Stack events. {issue}8912[8912] +- Function concurrency is now set to 5 instead of unreserved. {pull}8992[8992] + +==== Bugfixes + +*Affecting all Beats* + +- Propagate Sync error when running SafeFileRotate. {pull}9069[9069] +- Fix autodiscover configurations stopping when metadata is missing. {pull}8851[8851] +- Log events at the debug level when dropped by encoding problems. {pull}9251[9251] +- Refresh host metadata in add_host_metadata. {pull}9359[9359] +- When collecting swap metrics for beats telemetry or system metricbeat module handle cases of free swap being bigger than total swap by assuming no swap is being used. {issue}6271[6271] {pull}9383[9383] +- Adding logging traces at debug level when the pipeline client receives the following events: onFilteredOut, onDroppedOnPublish. {pull}9016[9016] +- Ignore non index fields in default_field for Elasticsearch. {pull}9549[9549] +- Update Kibana index pattern attributes for objects that are disabled. {pull}9644[9644] +- Enforce validation for the Central Management access token. {issue}9621[9621] +- Update to Golang 1.11.4. {pull}9627[9627] + +*Auditbeat* + +*Filebeat* + +- Correctly parse `December` or `Dec` in the Syslog input. {pull}9349[9349] +- Fix installation of haproxy dashboard. {issue}9307[9307] {pull}9313[9313] +- Don't generate incomplete configurations when logs collection is disabled by hints. {pull}9305[9305] +- Stop runners disabled by hints after previously being started. {pull}9305[9305] +- Fix saved objects in filebeat haproxy dashboard. {pull}9417[9417] +- Use `log.source.address` instead of `log.source.ip` for network input sources. {pull}9487[9487] +- Rename many `redis.log.*` fields to map to ECS. {pull}9315[9315] +- Rename many `icinga.*` fields to map to ECS. {pull}9294[9294] +- Rename many `postgresql.log.*` fields to map to ECS. {pull}9308[9308] +- Rename many `kafka.log.*` fields to map to ECS. {pull}9297[9297] +- Add `convert_timezone` option to Logstash module to convert dates to UTC. {issue}9756[9756] {pull}9797[9797] + +*Metricbeat* + +- Fix issue preventing diskio metrics collection for idle disks. {issue}9124[9124] {pull}9125[9125] +- Fix panic on docker healthcheck collection on dockers without healthchecks. {pull}9171[9171] +- Fix issue with not collecting Elasticsearch cross-cluster replication stats correctly. {pull}9179[9179] +- The `node.name` field in the `elasticsearch/node` metricset now correctly reports the Elasticsarch node name. Previously this field was incorrectly reporting the node ID instead. {pull}9209[9209] + +*Packetbeat* + +- Fix issue with process monitor associating traffic to the wrong process. {issue}9151[9151] {pull}9443[9443] + +==== Added + +*Affecting all Beats* + +- Unify dashboard exporter tools. {pull}9097[9097] +- Add cache.ttl to add_host_metadata. {pull}9359[9359] +- Add support for index lifecycle management (beta). {pull}7963[7963] +- Always include Pod UID as part of Pod metadata. {pull}9517[9517] +- Autodiscovery no longer requires that the `condition` field be set. If left unset all configs will be matched. {pull}9029[9029] +- Add geo fields to `add_host_metadata` processor. {pull}9392[9392] + +*Filebeat* + +- Added the `redirect_stderr` option that allows panics to be logged to log files. {pull}8430[8430] +- Added `detect_null_bytes` selector to detect null bytes from a io.reader. {pull}9210[9210] +- Added `syslog_host` variable to HAProxy module to allow syslog listener to bind to configured host. {pull}9366[9366] +- Added support on Traefik for Common Log Format and Combined Log Format mixed which is the default Traefik format {issue}8015[8015] {issue}6111[6111] {pull}8768[8768]. +- Add support for multi-core thread_id in postgresql module {issue}9156[9156] {pull}9482[9482] + +*Heartbeat* + +- Add last monitor status to dashboard table. Further break out monitors in dashboard table by monitor.ip. {pull}9022[9022] +- Add central management support. {pull}9254[9254] + +*Journalbeat* + +- Add cursor_seek_fallback option. {pull}9234[9234] + +*Metricbeat* + +- Add settings to disable docker and cgroup cpu metrics per core. {issue}9187[9187] {pull}9194[9194] {pull}9589[9589] +- The `elasticsearch/node` metricset now reports the Elasticsearch cluster UUID. {pull}8771[8771] +- Add service.type field to Metricbeat. {pull}8965[8965] +- Support GET requests in Jolokia module. {issue}8566[8566] {pull}9226[9226] +- Add freebsd support for the uptime metricset. {pull}9413[9413] +- Add `host.os.name` field to add_host_metadata processor. {issue}8948[8948] {pull}9405[9405] +- Add more TCP statuses to `socket_summary` metricset. {pull}9430[9430] +- Remove experimental tag from ceph metricsets. {pull}9708[9708] +- Add MS SQL module to X-Pack {pull}9414[9414 + +==== Deprecated + +*Metricbeat* + +- event.duration is now in nano and not microseconds anymore. {pull}8941[8941] + +[[release-notes-7.0.0-alpha1]] +=== Beats version 7.0.0-alpha1 +https://github.com/elastic/beats/compare/v6.5.0...v7.0.0-alpha1[View commits] + +==== Breaking changes + +*Affecting all Beats* + +- Dissect syntax change, use * instead of ? when working with field reference. {issue}8054[8054] + +*Auditbeat* + +- Use `initial_scan` action for new paths. {pull}7954[7954] +- Rename beat.name to agent.type, beat.hostname to agent.hostname, beat.version to agent.version. +- Rename `source.hostname` to `source.domain` in the auditd module. {pull}9027[9027] + +*Filebeat* + +- Rename `fileset.name` to `event.name`. {pull}8879[8879] +- Rename `fileset.module` to `event.module`. {pull}8879[8879] +- Rename source to log.file.path and log.source.ip {pull}8902[8902] +- Remove the deprecated `prospector(s)` option in the configuration use `input(s)` instead. {pull}8909[8909] +- Rename `offset` to `log.offset`. {pull}8923[8923] +- Rename `source_ecs` to `source` in the Filebeat Suricata module. {pull}8983[8983] + +==== Bugfixes + +*Affecting all Beats* + +- Fixed `-d` CLI flag by trimming spaces from selectors. {pull}7864[7864] +- Fixed Support `add_docker_metadata` in Windows by identifying systems' path separator. {issue}7797[7797] +- Do not panic when no tokenizer string is configured for a dissect processor. {issue}8895[8895] +- Start autodiscover consumers before producers. {pull}7926[7926] + +*Filebeat* + +- Fixed a memory leak when harvesters are closed. {pull}7820[7820] +- Fix improperly set config for CRI Flag in Docker Input {pull}8899[8899] +- Just enabling the `elasticsearch` fileset and starting Filebeat no longer causes an error. {pull}8891[8891] +- Fix macOS default log path for elasticsearch module based on homebrew paths. {pul}8939[8939] + +*Heartbeat* + +- Heartbeat now always downloads the entire body of HTTP endpoints, even if no checks against the body content are declared. This fixes an issue where timing metrics would be incorrect in scenarios where the body wasn't used since the connection would be closed soon after the headers were sent, but before the entire body was. {pull}8894[8894] +- `Host` header can now be overridden for HTTP requests sent by Heartbeat monitors. {pull}9148[9516] + +*Metricbeat* + +- Fix golang.heap.gc.cpu_fraction type from long to float in Golang module. {pull}7789[7789] +- Add missing namespace field in http server metricset {pull}7890[7890] +- Fix race condition when enriching events with kubernetes metadata. {issue}9055[9055] {issue}9067[9067] + +*Packetbeat* + +- Fixed the mysql missing transactions if monitoring a connection from the start. {pull}8173[8173] + + +==== Added + +*Affecting all Beats* + +- Add field `host.os.kernel` to the add_host_metadata processor and to the + internal monitoring data. {issue}7807[7807] +- Add debug check to logp.Logger {pull}7965[7965] +- Count HTTP 429 responses in the elasticsearch output {pull}8056[8056] +- Allow Bus to buffer events in case listeners are not configured. {pull}8527[8527] +- Dissect will now flag event on parsing error. {pull}8751[8751] +- add_cloud_metadata initialization is performed asynchronously to avoid delays on startup. {pull}8845[8845] +- Add DeDot method in add_docker_metadata processor in libbeat. {issue}9350[9350] {pull}9505[9505] + +*Filebeat* + +- Make inputsource generic taking bufio.SplitFunc as input {pull}7746[7746] +- Add custom unpack to log hints config to avoid env resolution {pull}7710[7710] +- Make docker input check if container strings are empty {pull}7960[7960] +- Keep unparsed user agent information in user_agent.original. {pull}8537[8537] +- Allow to force CRI format parsing for better performance {pull}8424[8424] + +*Heartbeat* + +- Add automatic config file reloading. {pull}8023[8023] + +*Journalbeat* + +- Add the ability to check against JSON HTTP bodies with conditions. {pull}8667[8667] + +*Metricbeat* + +- Add metrics about cache size to memcached module {pull}7740[7740] +- Add experimental socket summary metricset to system module {pull}6782[6782] +- Collect custom cluster `display_name` in `elasticsearch/cluster_stats` metricset. {pull}8445[8445] +- Test etcd module with etcd 3.3. {pull}9068[9068] +- All `elasticsearch` metricsets now have module-level `cluster.id` and `cluster.name` fields. {pull}8770[8770] {pull}8771[8771] {pull}9164[9164] {pull}9165[9165] {pull}9166[9166] {pull}9168[9168] +- All `elasticsearch` node-level metricsets now have `node.id` and `node.name` fields. {pull}9168[9168] {pull}9209[9209] + +*Packetbeat* + +- Add support to decode HTTP bodies compressed with `gzip` and `deflate`. {pull}7915[7915] +- Added support to calculate certificates' fingerprints (MD5, SHA-1, SHA-256). {issue}8180[8180] +- Support new TLS version negotiation introduced in TLS 1.3. {issue}8647[8647]. + +[[release-notes-6.7.1]] +=== Beats version 6.7.1 +https://github.com/elastic/beats/compare/v6.7.0...v6.7.1[View commits] + +==== Breaking changes + +*Affecting all Beats* + +- Initialize the Paths before the keystore and save the keystore into `data/{beatname}.keystore`. {pull}10706[10706] + +==== Bugfixes + +*Affecting all Beats* + +- Remove IP fields from default_field in Elasticsearch template. {pull}11399[11399] + +[[release-notes-6.7.0]] +=== Beats version 6.7.0 +https://github.com/elastic/beats/compare/v6.6.2...v6.7.0[View commits] + +==== Breaking changes + +*Affecting all Beats* + +- Port settings have been deprecated in redis/logstash output and will be removed in 7.0. {pull}9915[9915] +- Update the code of Central Management to align with the new returned format. {pull}10019[10019] +- Allow Central Management to send events back to kibana. {issue}9382[9382] +- Fix panic if fields settting is used to configure `hosts.x` fields. {issue}10824[10824] {pull}10935[10935] +- Introduce query.default_field as part of the template. {pull}11205[11205] +- Beats Xpack now checks for Basic license on connect. {pull}11296[11296] + +*Filebeat* + +- Filesets with multiple ingest pipelines added in {pull}8914[8914] only work with Elasticsearch >= 6.5.0 {pull}10001[10001] +- Add grok pattern to support redis 5.0.3 log timestamp. {issue}9819[9819] {pull}10033[10033] +- Ingesting Elasticsearch audit logs is only supported with Elasticsearch 6.5.0 and above {pull}8852[8852] +- Remove `ecs` option from user_agent processors when loading pipelines with Filebeat 6.7.x into Elasticsearch < 6.7.0. {issue}10655[10655] {pull}11362[11362] + +*Heartbeat* + +- Remove monitor generator script that was rarely used. {pull}9648[9648] + +==== Bugfixes + +*Affecting all Beats* + +- Fix TLS certificate DoS vulnerability. {pull}10303[10303] +- Fix panic and file unlock in spool on atomic operation (arm, x86-32). File lock was not released when panic occurs, leading to the beat deadlocking on startup. {pull}10289[10289] +- Adding logging traces at debug level when the pipeline client receives the following events: onFilteredOut, onDroppedOnPublish. {pull}9016[9016] +- Do not panic when no tokenizer string is configured for a dissect processor. {issue}8895[8895] +- Fix a issue when remote and local configuration didn't match when fetching configuration from Central Management. {issue}10587[10587] +- Add ECS-like selectors and dedotting to docker autodiscover. {issue}10757[10757] {pull}10862[10862] +- Fix encoding of timestamps when using disk spool. {issue}10099[10099] +- Include ip and boolean type when generating index pattern. {pull}10995[10995] +- Using an environment variable for the password when enrolling a beat will now raise an error if the variable doesn't exist. {pull}10936[10936] +- Cancelling enrollment of a beat will not enroll the beat. {issue}10150[10150] +- Remove IP fields from default_field in Elasticsearch template. {pull}11399[11399] + +*Auditbeat* + +- Package: Disable librpm signal handlers. {pull}10694[10694] +- Login: Handle different bad login UTMP types. {pull}10865[10865] +- Fix hostname references in System module dashbords. {pull}11064[11064] +- User dataset: Numerous fixes to error handling. {pull}10942[10942] + +*Filebeat* + +- Support IPv6 addresses with zone id in IIS ingest pipeline. {issue}9836[9836] error log: {pull}9869[9869] access log: {pull}10029[10029] +- Fix bad bytes count in `docker` input when filtering by stream. {pull}10211[10211] +- Fixed data types for roles and indices fields in `elasticsearch/audit` fileset {pull}10307[10307] +- Cover empty request data, url and version in Apache2 module{pull}10846[10846] +- Fix a bug with the convert_timezone option using the incorrect timezone field. {issue}11055[11055] {pull}11164[11164] +- Change URLPATH grok pattern to support brackets. {issue}11135[11135] {pull}11252[11252] +- Add support for iis log with different address format. {issue}11255[11255] {pull}11256[11256] +- Add fix to parse syslog message with priority value 0. {issue}11010[11010] + +*Heartbeat* + +- `Host` header can now be overridden for HTTP requests sent by Heartbeat monitors. {pull}9148[9516] +- Fix checks for TCP send/receive data {pull}10777[10777] + +*Journalbeat* + +- Do not stop collecting events when journal entries change. {pull}9994[9994] + +*Metricbeat* + +- Fix MongoDB dashboard that had some incorrect field names from `status` Metricset {pull}9795[9795] {issue}9715[9715] +- Fix issue that would prevent collection of processes without command line on Windows. {pull}10196[10196] +- Fixed data type for tags field in `docker/container` metricset {pull}10307[10307] +- Fixed data type for tags field in `docker/image` metricset {pull}10307[10307] +- Fixed data type for isr field in `kafka/partition` metricset {pull}10307[10307] +- Fixed data types for various hosts fields in `mongodb/replstatus` metricset {pull}10307[10307] +- Added function to close sql database connection. {pull}10355[10355] +- Fix parsing error using GET in Jolokia module. {pull}11075[11075] {issue}11071[11071] + +*Winlogbeat* + +- Fix Winlogbeat escaping CR, LF and TAB characters. {issue}11328[11328] {pull}11357[11357] + +*Functionbeat* + +- Correctly extract Kinesis Data field from the Kinesis Record. {pull}11141[11141] +- Add the required permissions to the role when deployment SQS functions. {issue}9152[9152] + +==== Added + +*Affecting all Beats* + +- Add ip fields to default_field in Elasticsearch template. {pull}11035[11035] +- Add `cleanup_timeout` option to docker autodiscover, to wait some time before removing configurations after a container is stopped. {issue}10374[10374] {pull}10905[10905] + +*Auditbeat* + +- System module `process` dataset: Add user information to processes. {pull}9963[9963] +- Add system `package` dataset. {pull}10225[10225] +- Add system module `login` dataset. {pull}9327[9327] +- Add `entity_id` fields. {pull}10500[10500] +- Add seven dashboards for the system module. {pull}10511[10511] + +*Filebeat* + +- Add field log.source.address and log.file.path to replace source. {pull}9435[9435] +- Support mysql 5.7.22 slowlog starting with time information. {issue}7892[7892] {pull}9647[9647] +- Add support for ssl_request_log in apache2 module. {issue}8088[8088] {pull}9833[9833] +- Add support for iis 7.5 log format. {issue}9753[9753] {pull}9967[9967] +- Add support for MariaDB in the `slowlog` fileset of `mysql` module. {pull}9731[9731] +- Add convert_timezone to nginx module. {issue}9839[9839] {pull}10148[10148] +- Add support for Percona in the `slowlog` fileset of `mysql` module. {issue}6665[6665] {pull}10227[10227] +- Added support for ingesting structured Elasticsearch audit logs {pull}8852[8852] +- New iptables module that receives iptables/ip6tables logs over syslog or file. Supports Ubiquiti Firewall extensions. {issue}8781[8781] {pull}10176[10176] +- Populate more ECS fields in the Suricata module. {pull}10006[10006] + +*Heartbeat* + +- Made monitors.d configuration part of the default config. {pull}9004[9004] +- Autodiscover metadata is now included in events by default. So, if you are using the docker provider for instance, you'll see the correct fields under the `docker` key. {pull}10258[10258] + +*Metricbeat* + +- Add field `event.dataset` which is `{module}.{metricset}`. +- Add more TCP statuses to `socket_summary` metricset. {pull}9430[9430] +- Remove experimental tag from ceph metricsets. {pull}9708[9708] +- Add `key` metricset to the Redis module. {issue}9582[9582] {pull}9657[9657] +- Add DeDot for kubernetes labels and annotations. {issue}9860[9860] {pull}9939[9939] +- Add docker `event` metricset. {pull}9856[9856] +- Release Ceph module as GA. {pull}10202[10202] +- Release windows Metricbeat module as GA. {pull}10163[10163] +- Release traefik Metricbeat module as GA. {pull}10166[10166] +- List filesystems on Windows that have an access path but not an assigned letter {issue}8916[8916] {pull}10196[10196] +- Release uswgi Metricbeat module GA. {pull}10164[10164] +- Release php_fpm module as GA. {pull}10198[10198] +- Release Memcached module as GA. {pull}10199[10199] +- Release etcd module as GA. {pull}10200[10200] +- Release kubernetes apiserver and event metricsets as GA {pull}10212[10212] +- Release Couchbase module as GA. {pull}10201[10201] +- Release aerospike module as GA. {pull}10203[10203] +- Release envoyproxy module GA. {pull}10223[10223] +- Release mongodb.metrics and mongodb.replstatus as GA. {pull}10242[10242] +- Release mysql.galera_status as Beta. {pull}10242[10242] +- Release postgresql.statement as GA. {pull}10242[10242] +- Release RabbitMQ Metricbeat module GA. {pull}10165[10165] +- Release Dropwizard module as GA. {pull}10240[10240] +- Release Graphite module as GA. {pull}10240[10240] +- Release http.server metricset as GA. {pull}10240[10240] +- Add support for MySQL 8.0 and tests also for Percona and MariaDB. {pull}10261[10261] +- Release use of xpack.enabled: true flag in Elasticsearch and Kibana modules as GA. {pull}10222[10222] +- Release Elastic stack modules (Elasticsearch, Logstash, and Kibana) as GA. {pull}10094[10094] +- Add remaining memory metrics of pods in Kubernetes metricbeat module {pull}10157[10157] +- Added 'server' Metricset to Zookeeper Metricbeat module {issue}8938[8938] {pull}10341[10341] +- Add overview dashboard to Zookeeper Metricbeat module {pull}10379[10379] + +*Functionbeat* + +- Mark Functionbeat as GA. {pull}10564[10564] +- Functionbeat can now deploy a function for Kinesis. {pull}10116[10116] +- Allow functionbeat to use the keystore. {issue}9009[9009] + +==== Deprecated + +*Filebeat* + +- Deprecate field source. Will be replaced by log.source.address and log.file.path in 7.0. {pull}9435[9435] + +*Metricbeat* + +- Deprecate field `metricset.rtt`. Replaced by `event.duration` which is in nano instead of micro seconds. + +*Packetbeat* + +- Support new TLS version negotiation introduced in TLS 1.3. {issue}8647[8647]. + +==== Known Issue + +*Journalbeat* + +- Journalbeat requires at least systemd v233 in order to follow entries after journal changes (rotation, vacuum). + +[[release-notes-6.6.2]] +=== Beats version 6.6.2 +https://github.com/elastic/beats/compare/v6.6.1...6.6.2[View commits] + +==== Bugfixes + +*Auditbeat* + +- System module: Fix and unify bucket closing logic. {pull}10897[10897] + +*Filebeat* + +- Fix a bug when converting NetFlow fields to snake_case. {pull}10950[10950] + +*Metricbeat* + +- Fix issue in kubernetes module preventing usage percentages to be properly calculated. {pull}10946[10946] + +*Packetbeat* + +- Avoid reporting unknown MongoDB opcodes more than once. {pull}10878[10878] + +*Winlogbeat* + +- Prevent Winlogbeat from dropping events with invalid XML. {pull}11006[11006] + +[[release-notes-6.6.1]] +=== Beats version 6.6.1 +https://github.com/elastic/beats/compare/v6.6.0...6.6.1[View commits] + +==== Breaking changes + +*Affecting all Beats* + +- Fix stopping of modules started by kubernetes autodiscover. {pull}10476[10476] + +*Auditbeat* + +- Enable System module config on Windows. {pull}10237[10237] + +*Filebeat* + +- Fix bad bytes count in `docker` input when filtering by stream. {pull}10211[10211] +- Add `convert_timezone` option to Logstash module to convert dates to UTC. {issue}9756[9756] {pull}9797[9797] +- Add `convert_timezone` option to Elasticsearch module to convert dates to UTC. {issue}9756[9756] {pull}9761[9761] +- Make elasticsearch/audit fileset be more lenient in parsing node name. {issue}10035[10035] {pull}10135[10135] + +*Journalbeat* + +- Fix fields.yml indentation of audit group which had the effect of creating an incomplete Elasticsearch index template. {pull}10556[10556] + +*Metricbeat* + +- Fix issue with `elasticsearch/node_stats` metricset (x-pack) not indexing `source_node` field. {pull}10639[10639] + +*Packetbeat* + +- Fixed a crash when using af_packet capture {pull}10477[10477] + +*Functionbeat* + +- Ensure that functionbeat is logging at info level not debug. {issue}10262[10262] + +==== Added + +*Filebeat* + +- Teach elasticsearch/audit fileset to parse out some more fields. {issue}10134[10134] {pull}10137[10137] + +*Journalbeat* + +- Migrate registry from previously incorrect path. {pull}10486[10486] + +[[release-notes-6.6.0]] +=== Beats version 6.6.0 +https://github.com/elastic/beats/compare/v6.5.4...6.6[View commits] + +==== Breaking changes + +*Affecting all Beats* + +- Dissect syntax change, use * instead of ? when working with field reference. {issue}8054[8054] + +*Filebeat* + +- Allow beats to blacklist certain part of the configuration while using Central Management. {pull}9099[9099] + +*Metricbeat* + +- Allow beats to blacklist certain part of the configuration while using Central Management. {pull}9099[9099] + +*Functionbeat* + +- The CLI will now log CloudFormation Stack events. {issue}8912[8912] +- Correctly normalize Cloudformation resource name. {issue}10087[10087] + +==== Bugfixes + +*Affecting all Beats* + +- Fix autodiscover configurations stopping when metadata is missing. {pull}8851[8851] +- Refresh host metadata in add_host_metadata. {pull}9359[9359] +- When collecting swap metrics for beats telemetry or system metricbeat module handle cases of free swap being bigger than total swap by assuming no swap is being used. {issue}6271[6271] {pull}9383[9383] +- Ignore non index fields in default_field for Elasticsearch. {pull}9549[9549] +- Update Golang to 1.10.6. {pull}9563[9563] +- Update Kibana index pattern attributes for objects that are disabled. {pull}9644[9644] +- Enforce validation for the Central Management access token. {issue}9621[9621] +- Fix registry handle leak on Windows (https://github.com/elastic/go-sysinfo/pull/33). {pull}9920[9920] +- Gracefully handle TLS options when enrolling a Beat. {issue}9129[9129] +- Allow to unenroll a Beat from the UI. {issue}9452[9452] +- The backing off now implements jitter to better distribute the load. {issue}10172[10172] +- Fix config appender registration. {pull}9873[9873] +- Fix TLS certificate DoS vulnerability. {pull}10304[10304] + +*Filebeat* + +- Fix improperly set config for CRI Flag in Docker Input {pull}8899[8899] +- Just enabling the `elasticsearch` fileset and starting Filebeat no longer causes an error. {pull}8891[8891] +- Fix macOS default log path for elasticsearch module based on homebrew paths. {pul}8939[8939] +- Support IPv6 addresses with zone id in IIS ingest pipeline. {issue}9836[9836] error log: {pull}9869[9869] access log: {pull}10030[10030] +- Support haproxy log lines without captured headers. {issue}9463[9463] {pull}9958[9958] + +*Heartbeat* + +- Heartbeat now always downloads the entire body of HTTP endpoints, even if no checks against the body content are declared. This fixes an issue where timing metrics would be incorrect in scenarios where the body wasn't used since the connection would be closed soon after the headers were sent, but before the entire body was. {pull}8894[8894] + +*Metricbeat* + +- Add missing namespace field in http server metricset {pull}7890[7890] +- Fix issue with not collecting Elasticsearch cross-cluster replication stats correctly. {pull}9179[9179] +- The `node.name` field in the `elasticsearch/node` metricset now correctly reports the Elasticsarch node name. Previously this field was incorrectly reporting the node ID instead. {pull}9209[9209] +- Fix panics in vsphere module when certain values where not returned by the API. {pull}9784[9784] +- Fix pod UID metadata enrichment in Kubernetes module. {pull}10081[10081] + + +*Packetbeat* + +- Fix issue with process monitor associating traffic to the wrong process. {issue}9151[9151] {pull}9443[9443] +- Fix DHCPv4 dashboard that wouldn't load in Kibana. {issue}9850[9850] + + +==== Added + +*Affecting all Beats* + +- Unify dashboard exporter tools. {pull}9097[9097] +- Dissect will now flag event on parsing error. {pull}8751[8751] +- Added the `redirect_stderr` option that allows panics to be logged to log files. {pull}8430[8430] +- Add cache.ttl to add_host_metadata. {pull}9359[9359] +- Add support for index lifecycle management (beta). {pull}7963[7963] +- Always include Pod UID as part of Pod metadata. {pull]9517[9517] +- Release Jolokia autodiscover as GA. {pull}9706[9706] + +*Auditbeat* + +- Add system module. {pull}9546[9546] + +*Filebeat* +- Added `detect_null_bytes` selector to detect null bytes from a io.reader. {pull}9210[9210] +- Added `syslog_host` variable to HAProxy module to allow syslog listener to bind to configured host. {pull}9366[9366] +- Allow to force CRI format parsing for better performance {pull}8424[8424] +- Add event.dataset to module events. {pull}9457[9457] +- Add field log.source.address and log.file.path to replace source. {pull}9435[9435] +- Add support for multi-core thread_id in postgresql module {issue}9156[9156] {pull}9482[9482] +- Added netflow input type that supports NetFlow v1, v5, v6, v7, v8, v9 and IPFIX. {issue}9399[9399] + +*Journalbeat* + +- Add the ability to check against JSON HTTP bodies with conditions. {pull}8667[8667] +- Add cursor_seek_fallback option. {pull}9234[9234] + +*Metricbeat* + +- Collect custom cluster `display_name` in `elasticsearch/cluster_stats` metricset. {pull}8445[8445] +- Test etcd module with etcd 3.3. {pull}9068[9068] +- All `elasticsearch` metricsets now have module-level `cluster.id` and `cluster.name` fields. {pull}8770[8770] {pull}8771[8771] {pull}9164[9164] {pull}9165[9165] {pull}9166[9166] {pull}9168[9168] +- All `elasticsearch` node-level metricsets now have `node.id` and `node.name` fields. {pull}9168[9168] {pull}9209[9209] +- Add settings to disable docker and cgroup cpu metrics per core. {issue}9187[9187] {pull}9194[9194] {pull}9589[9589] +- The `elasticsearch/node` metricset now reports the Elasticsearch cluster UUID. {pull}8771[8771] +- Support GET requests in Jolokia module. {issue}8566[8566] {pull}9226[9226] +- Add freebsd support for the uptime metricset. {pull}9413[9413] +- Add `host.os.name` field to add_host_metadata processor. {issue}8948[8948] {pull}9405[9405] +- Add field `event.dataset` which is `{module}.{metricset)`. {pull}9393[9393] + +==== Deprecated + +*Filebeat* +- Deprecate field source. Will be replaced by log.source.address and log.file.path in 7.0. {pull}9435[9435] + +*Metricbeat* + +- Deprecate field `metricset.rtt`. Replaced by `event.duration` which is in nano instead of micro seconds. {pull}9393[9393] -==== Breaking changes +*Packetbeat* + +- Support new TLS version negotiation introduced in TLS 1.3. {issue}8647[8647]. + + + +[[release-notes-6.5.4]] +=== Beats version 6.5.4 +https://github.com/elastic/beats/compare/v6.5.3...v6.5.4[View commits] + +==== Bugfixes *Affecting all Beats* -*Auditbeat* +- Update Golang to 1.10.6. This fixes an issue in remote certificate validation CVE-2018-16875. {pull}9563[9563] -- Use `initial_scan` action for new paths. {pull}7954[7954] +*Filebeat* + +- Fix saved objects in filebeat haproxy dashboard. {pull}9417[9417] +- Fixed a memory leak when harvesters are closed. {pull}7820[7820] + +==== Added *Filebeat* -*Heartbeat* +- Added support on Traefik for Common Log Format and Combined Log Format mixed which is the default Traefik format {issue}8015[8015] {issue}6111[6111] {pull}8768[8768]. + + +[[release-notes-6.5.3]] +=== Beats version 6.5.3 +https://github.com/elastic/beats/compare/v6.5.2...v6.5.3[View commits] + +==== Bugfixes + +*Affecting all Beats* + +- Log events at the debug level when dropped by encoding problems. {pull}9251[9251] + +*Filebeat* + +- Correctly parse `December` or `Dec` in the Syslog input. {pull}9349[9349] +- Don't generate incomplete configurations when logs collection is disabled by hints. {pull}9305[9305] +- Stop runners disabled by hints after previously being started. {pull}9305[9305] +- Fix installation of haproxy dashboard. {issue}9307[9307] {pull}9313[9313] + +[[release-notes-6.5.2]] +=== Beats version 6.5.2 +https://github.com/elastic/beats/compare/v6.5.1...v6.5.2[View commits] + +==== Bugfixes + +*Affecting all Beats* + +- Propagate Sync error when running SafeFileRotate. {pull}9069[9069] + +*Metricbeat* + +- Fix panic on docker healthcheck collection on dockers without healthchecks. {pull}9171[9171] +- Fix issue preventing diskio metrics collection for idle disks. {issue}9124[9124] {pull}9125[9125] + +[[release-notes-6.5.1]] +=== Beats version 6.5.1 +https://github.com/elastic/beats/compare/v6.5.0...v6.5.1[View commits] + +==== Bugfixes + +*Affecting all Beats* +- Fix windows binaries not having an enroll command. {issue}9096[9096] {pull}8836[8836] *Journalbeat* +- Fix journalbeat sometimes hanging if output is unavailable. {pull}9106[9106] *Metricbeat* +- Fix race condition when enriching events with kubernetes metadata. {issue}9055[9055] {issue}9067[9067] -*Packetbeat* +==== Added -*Winlogbeat* +*Journalbeat* +- Add minimal kibana dashboard. {pull}9106[9106] -*Functionbeat* + +[[release-notes-6.5.0]] +=== Beats version 6.5.0 +https://github.com/elastic/beats/compare/v6.4.0...v6.5.0[View commits] ==== Bugfixes *Affecting all Beats* - Fixed `add_host_metadata` not initializing correctly on Windows. {issue}7715[7715] -- Fixed `-d` CLI flag by trimming spaces from selectors. {pull}7864[7864] - Fixed missing file unlock in spool file on Windows, so file can be reopened and locked. {pull}7859[7859] - Fix spool file opening/creation failing due to file locking on Windows. {pull}7859[7859] - Fix size of maximum mmaped read area in spool file on Windows. {pull}7859[7859] - Fix potential data loss on OS X in spool file by using fcntl with F_FULLFSYNC. {pull}7859[7859] - Improve fsync on linux, by assuming the kernel resets error flags of failed writes. {pull}7859[7859] - Remove unix-like permission checks on Windows, so files can be opened. {issue}7849[7849] -- Deregister pipeline loader callback when inputsRunner is stopped. {pull}7893[7893] - Replace index patterns in TSVB visualizations. {pull}7929[7929] -- Fixed Support `add_docker_metadata` in Windows by identifying systems' path separator. {issue}7797[7797] +- Deregister pipeline loader callback when inputsRunner is stopped. {pull}[7893][7893] - Add backoff support to x-pack monitoring outputs. {issue}7966[7966] +- Removed execute permissions systemd unit file. {pull}7873[7873] - Fix a race condition with the `add_host_metadata` and the event serialization. {pull}8223[8223] {pull}8653[8653] - Enforce that data used by k8s or docker doesn't use any reference. {pull}8240[8240] - Switch to different UUID lib due to to non-random generated UUIDs. {pull}8485[8485] - Fix race condition when publishing monitoring data. {pull}8646[8646] +- Fix bug in loading dashboards from zip file. {issue}8051[8051] - Fix in-cluster kubernetes configuration on IPv6. {pull}8754[8754] +- The export config subcommand should not display real value for field reference. {pull}8769[8769] +- The setup command will not fail if no dashboard is available to import. {pull}8977[8977] +- Fix central management configurations reload when a configuration is removed in Kibana. {issue}9010[9010] *Auditbeat* - Fixed a crash in the file_integrity module under Linux. {issue}7753[7753] -- Fixed a data race in the file_integrity module. {issue}8009[8009] -- Fixed a deadlock in the file_integrity module. {pull}8027[8027] - Fixed the RPM by designating the config file as configuration data in the RPM spec. {issue}8075[8075] - Fixed a concurrent map write panic in the auditd module. {pull}8158[8158] +- Fixed a data race in the file_integrity module. {issue}8009[8009] +- Fixed a deadlock in the file_integrity module. {pull}8027[8027] *Filebeat* -- Fixed a memory leak when harvesters are closed. {pull}7820[7820] - Fix date format in Mongodb Ingest pipeline. {pull}7974[7974] -- Mark the TCP and UDP input as GA. {pull}8125[8125] - Fixed a docker input error due to the offset update bug in partial log join.{pull}8177[8177] - Update CRI format to support partial/full tags. {pull}8265[8265] - Fix some errors happening when stopping syslog input. {pull}8347[8347] - Fix RFC3339 timezone and nanoseconds parsing with the syslog input. {pull}8346[8346] +- Mark the TCP and UDP input as GA. {pull}8125[8125] - Support multiline logs in logstash/log fileset of Filebeat. {pull}8562[8562] +- Support different timestamp format in postgresql module. {issue}9494[9494] {pull}9650[9650] *Heartbeat* - Fixed bug where HTTP responses with larger bodies would incorrectly report connection errors. {pull}8660[8660] -*Journalbeat* - *Metricbeat* - Fix golang.heap.gc.cpu_fraction type from long to float in Golang module. {pull}7789[7789] -- Fixed a panic when the kvm module cannot establish a connection to libvirtd. {issue}7792[7792]. -- Recover metrics for old apache versions removed by mistake on #6450. {pull}7871[7871] -- Add missing namespace field in http server metricset {pull}7890[7890] - Fixed the RPM by designating the modules.d config files as configuration data in the RPM spec. {issue}8075[8075] - Fixed the location of the modules.d dir in Deb and RPM packages. {issue}8104[8104] - Add docker diskio stats on Windows. {issue}6815[6815] {pull}8126[8126] - Fix incorrect type conversion of average response time in Haproxy dashboards {pull}8404[8404] -- Fix dropwizard module parsing of metric names. {issue}8365[8365] {pull}6385[8385] - Added io disk read and write times to system module {issue}8473[8473] {pull}8508[8508] - Avoid mapping issues in kubernetes module. {pull}8487[8487] +- Recover metrics for old apache versions removed by mistake on #6450. {pull}7871[7871] +- Fix dropwizard module parsing of metric names. {issue}8365[8365] {pull}6385[8385] - Fix issue that would prevent kafka module to find a proper broker when port is not set {pull}8613[8613] - Fix range colors in multiple visualizations. {issue}8633[8633] {pull}8634[8634] - Fix incorrect header parsing on http metricbeat module {issue}8564[8564] {pull}8585[8585] +- Fixed a panic when the kvm module cannot establish a connection to libvirtd. {issue}7792[7792]. *Packetbeat* - Fixed a seccomp related error where the `fcntl64` syscall was not permitted on 32-bit Linux and the sniffer failed to start. {issue}7839[7839] - Added missing `cmdline` and `client_cmdline` fields to index template. {pull}8258[8258] -- Fixed the mysql missing transactions if monitoring a connection from the start. {pull}8173[8173] - -*Winlogbeat* - -*Functionbeat* ==== Added @@ -112,46 +1276,39 @@ https://github.com/elastic/beats/compare/v6.4.0...master[Check the HEAD diff] - Added time-based log rotation. {pull}8349[8349] - Add backoff on error support to redis output. {pull}7781[7781] -- Add field `host.os.kernel` to the add_host_metadata processor and to the - internal monitoring data. {issue}7807[7807] - Allow for cloud-id to specify a custom port. This makes cloud-id work in ECE contexts. {pull}7887[7887] - Add support to grow or shrink an existing spool file between restarts. {pull}7859[7859] -- Add debug check to logp.Logger {pull}7965[7965] - Make kubernetes autodiscover ignore events with empty container IDs {pull}7971[7971] -- Add DNS processor with support for performing reverse lookups on IP addresses. {issue}7770[7770] - Implement CheckConfig in RunnerFactory to make autodiscover check configs {pull}7961[7961] -- Count HTTP 429 responses in the elasticsearch output {pull}8056[8056] -- Report configured queue type. {pull}8091[8091] -- Added the `add_process_metadata` processor to enrich events with process information. {pull}6789[6789] -- Report number of open file handles on Windows. {pull}8329[8329] +- Add DNS processor with support for performing reverse lookups on IP addresses. {issue}7770[7770] - Support for Kafka 2.0.0 in kafka output {pull}8399[8399] - Add setting `setup.kibana.space.id` to support Kibana Spaces {pull}7942[7942] +- Better tracking of number of open file descriptors. {pull}7986[7986] +- Report number of open file handles on Windows. {pull}8329[8329] +- Added the `add_process_metadata` processor to enrich events with process information. {pull}6789[6789] - Add Beats Central Management {pull}8559[8559] -- Allow Bus to buffer events in case listeners are not configured. {pull}8527[8527] +- Report configured queue type. {pull}8091[8091] - Enable `host` and `cloud` metadata processors by default. {pull}8596[8596] -*Auditbeat* - *Filebeat* -- Make inputsource generic taking bufio.SplitFunc as input {pull}7746[7746] -- Add custom unpack to log hints config to avoid env resolution {pull}7710[7710] -- Make docker input check if container strings are empty {pull}7960[7960] - Add tag "truncated" to "log.flags" if incoming line is longer than configured limit. {pull}7991[7991] -- Add tag "multiline" to "log.flags" if event consists of multiple lines. {pull}7997[7997] - Add haproxy module. {pull}8014[8014] +- Add tag "multiline" to "log.flags" if event consists of multiple lines. {pull}7997[7997] - Release `docker` input as GA. {pull}8328[8328] -- Keep unparsed user agent information in user_agent.original. {pull}8537[8537] -- Better tracking of number of open file descriptors. {pull}7986[7986] +- Keep unparsed user agent information in user_agent.original. {pull}7823[7832] - Added default and TCP parsing formats to HAproxy module {issue}8311[8311] {pull}8637[8637] - Add Suricata IDS/IDP/NSM module. {issue}8153[8153] {pull}8693[8693] -- Allow to force CRI format parsing for better performance {pull}8424[8424] +- Support for Kafka 2.0.0 {pull}8853[8853] *Heartbeat* +- Heartbeat is marked as GA. +- Add automatic config file reloading. {pull}8023[8023] - Added autodiscovery support {pull}8415[8415] - Added support for extra TLS/x509 metadata. {pull}7944[7944] - Added stats and state metrics for number of monitors and endpoints started. {pull}8621[8621] +- Add last monitor status to dashboard table. Further break out monitors in dashboard table by monitor.ip. {pull}9022[9022] *Journalbeat* @@ -159,68 +1316,120 @@ https://github.com/elastic/beats/compare/v6.4.0...master[Check the HEAD diff] *Metricbeat* -- Add metrics about cache size to memcached module {pull}7740[7740] - Add `replstatus` metricset to MongoDB module {pull}7604[7604] -- Move common kafka fields (broker, topic and partition.id) to the module level to facilitate events correlation {pull}7767[7767] -- Add `metircs` metricset to MongoDB module. {pull}7611[7611] -- Add fields for mermory fragmentation, memory allocator stats, copy on write, master-slave status, and active defragmentation to `info` metricset of Redis module. {pull}7695[7695] - Add experimental socket summary metricset to system module {pull}6782[6782] +- Move common kafka fields (broker, topic and partition.id) to the module level to facilitate events correlation {pull}7767[7767] +- Add fields for memory fragmentation, memory allocator stats, copy on write, master-slave status, and active defragmentation to `info` metricset of Redis module. {pull}7695[7695] - Increase ignore_above for system.process.cmdline to 2048. {pull}8101[8100] - Add support to renamed fields planned for redis 5.0. {pull}8167[8167] - Allow TCP helper to support delimiters and graphite module to accept multiple metrics in a single payload. {pull}8278[8278] -- Added 'died' PID state to process_system metricset on system module{pull}8275[8275] +- Added 'died' PID state to process_system metricset on system module {pull}8275[8275] +- Add `metrics` metricset to MongoDB module. {pull}7611[7611] - Added `ccr` metricset to Elasticsearch module. {pull}8335[8335] -- Added support for query params in configuration {issue}8286[8286] {pull}8292[8292] - Support for Kafka 2.0.0 {pull}8399[8399] +- Added support for query params in configuration {issue}8286[8286] {pull}8292[8292] - Add container image for docker metricsets. {issue}8214[8214] {pull}8438[8438] -- Add support for `full` status page output for php-fpm module as a separate metricset called `process`. {pull}8394[8394] - Precalculate composed id fields for kafka dashboards. {pull}8504[8504] +- Add support for `full` status page output for php-fpm module as a separate metricset called `process`. {pull}8394[8394] - Add Kafka dashboard. {pull}8457[8457] -- Add untyped metric support to the prometheus module. {pull}8681[8681] +- Release Kafka module as GA. {pull}8854[8854] *Packetbeat* - Added DHCP protocol support. {pull}7647[7647] -- Add support to decode HTTP bodies compressed with `gzip` and `deflate`. {pull}7915[7915] -- Added support to calculate certificates' fingerprints (MD5, SHA-1, SHA-256). {issue}8180[8180] -*Winlogbeat* +*Functionbeat* + +- Initial version of Functionbeat. {pull}8678[8678] + +==== Deprecated *Heartbeat* -- Add automatic config file reloading. {pull}8023[8023] +- watch.poll_file is now deprecated and superceded by automatic config file reloading. -*Functionbeat* +*Metricbeat* -- Initial version of Functionbeat. {pull}8678[8678] +- Redis `info` `replication.master_offset` has been deprecated in favor of `replication.master.offset`.{pull}7695[7695] +- Redis `info` clients fields `longest_output_list` and `biggest_input_buf` have been renamed to `max_output_buffer` and `max_input_buffer` based on the names they will have in Redis 5.0, both fields will coexist during a time with the same value {pull}8167[8167]. +- Move common kafka fields (broker, topic and partition.id) to the module level {pull}7767[7767]. -==== Deprecated + + +[[release-notes-6.4.3]] +=== Beats version 6.4.3 +https://github.com/elastic/beats/compare/v6.4.2...v6.4.3[View commits] + +==== Bugfixes *Affecting all Beats* +- Fix a race condition with the `add_host_metadata` and the event serialization. {pull}8223[8223] {pull}8653[8653] +- Fix race condition when publishing monitoring data. {pull}8646[8646] +- Fix bug in loading dashboards from zip file. {issue}8051[8051] +- The export config subcommand should not display real value for field reference. {pull}8769[8769] + *Filebeat* -*Heartbeat* -- watch.poll_file is now deprecated and superceded by automatic config file reloading. +- Fix typo in Filebeat IIS Kibana visualization. {pull}8604[8604] -*Journalbeat* +*Metricbeat* + +- Recover metrics for old Apache versions removed by mistake on #6450. {pull}7871[7871] +- Avoid mapping issues in Kubernetes module. {pull}8487[8487] +- Fixed a panic when the KVM module cannot establish a connection to libvirtd. {issue}7792[7792] + + +[[release-notes-6.4.2]] +=== Beats version 6.4.2 +https://github.com/elastic/beats/compare/v6.4.1...v6.4.2[View commits] + +==== Bugfixes + +*Filebeat* + +- Fix some errors happening when stopping syslog input. {pull}8347[8347] +- Fix RFC3339 timezone and nanoseconds parsing with the syslog input. {pull}8346[8346] *Metricbeat* -- Redis `info` `replication.master_offset` has been deprecated in favor of `replication.master.offset`.{pull}7695[7695] -- Redis `info` clients fields `longest_output_list` and `biggest_input_buf` have been renamed to `max_output_buffer` and `max_input_buffer` based on the names they will have in Redis 5.0, both fields will coexist during a time with the same value {pull}8167[8167]. -- Move common kafka fields (broker, topic and partition.id) to the module level {pull}7767[7767]. +- Fix incorrect type conversion of average response time in Haproxy dashboards {pull}8404[8404] +- Fix dropwizard module parsing of metric names. {issue}8365[8365] {pull}6385[8385] -*Packetbeat* +[[release-notes-6.4.1]] +=== Beats version 6.4.1 +https://github.com/elastic/beats/compare/v6.4.0...v6.4.1[View commits] -*Winlogbeat* +==== Bugfixes -*Functionbeat* +*Affecting all Beats* -==== Known Issue +- Add backoff support to x-pack monitoring outputs. {issue}7966[7966] +- Removed execute permissions systemd unit file. {pull}7873[7873] +- Fix a race condition with the `add_host_metadata` and the event serialization. {pull}8223[8223] +- Enforce that data used by k8s or docker doesn't use any reference. {pull}8240[8240] +- Implement CheckConfig in RunnerFactory to make autodiscover check configs {pull}7961[7961] +- Make kubernetes autodiscover ignore events with empty container IDs {pull}7971[7971] + +*Auditbeat* + +- Fixed a concurrent map write panic in the auditd module. {pull}8158[8158] +- Fixed the RPM by designating the config file as configuration data in the RPM spec. {issue}8075[8075] + +*Filebeat* + +- Fixed a docker input error due to the offset update bug in partial log join.{pull}8177[8177] +- Update CRI format to support partial/full tags. {pull}8265[8265] + +*Metricbeat* + +- Fixed the location of the modules.d dir in Deb and RPM packages. {issue}8104[8104] +- Fixed the RPM by designating the modules.d config files as configuration data in the RPM spec. {issue}8075[8075] +- Fix golang.heap.gc.cpu_fraction type from long to float in Golang module. {pull}7789[7789] +*Packetbeat* -//////////////////////////////////////////////////////////// +- Added missing `cmdline` and `client_cmdline` fields to index template. {pull}8258[8258] [[release-notes-6.4.0]] === Beats version 6.4.0 @@ -376,6 +1585,7 @@ The issue will be fixed in the 6.4.1 release. - Release prometheus collector metricset as GA. {pull}7660[7660] - Add Elasticsearch `cluster_stats` metricset. {pull}7638[7638] - Added `basepath` setting for HTTP-based metricsets {pull}7700[7700] +- Add couchdb module. {pull}9406[9406] *Packetbeat* @@ -522,6 +1732,7 @@ https://github.com/elastic/beats/compare/v6.2.3...v6.3.0[View commits] *Winlogbeat* - Fixed a crash under Windows 2003 and XP when an event had less insert strings than required by its format string. {pull}6247[6247] +- Fix config validation to allow `event_logs.processors`. [pull]6217[6217] ==== Added @@ -886,7 +2097,6 @@ https://github.com/elastic/beats/compare/v6.0.1...v6.1.0[View commits] - Fix the registry file. It was not correctly storing event log names, and upon restart it would begin reading at the start of each event log. {issue}5813[5813] -- Fix config validation to allow `event_logs.processors`. [pull]6217[6217] ==== Added @@ -1497,6 +2707,132 @@ https://github.com/elastic/beats/compare/v5.4.0...v6.0.0-alpha1[View commits] - Prospector reloading only works properly with new files. {pull}3546[3546] + +[[release-notes-5.6.14]] +=== Beats version 5.6.14 +https://github.com/elastic/beats/compare/v5.6.13...v5.6.14[View commits] + +No changes in this version. + +[[release-notes-5.6.13]] +=== Beats version 5.6.13 +https://github.com/elastic/beats/compare/v5.6.12...v5.6.13[View commits] + +No changes in this version. + +[[release-notes-5.6.12]] +=== Beats version 5.6.12 +https://github.com/elastic/beats/compare/v5.6.11...v5.6.12[View commits] + +No changes in this version. + +[[release-notes-5.6.11]] +=== Beats version 5.6.11 +https://github.com/elastic/beats/compare/v5.6.10...v5.6.11[View commits] + +No changes in this version. + +[[release-notes-5.6.10]] +=== Beats version 5.6.10 +https://github.com/elastic/beats/compare/v5.6.9...v5.6.10[View commits] + +==== Bugfixes + +*Packetbeat* + +- Fix an out of bounds access in HTTP parser caused by malformed request. {pull}6997[6997] + +[[release-notes-5.6.9]] +=== Beats version 5.6.9 +https://github.com/elastic/beats/compare/v5.6.8...v5.6.9[View commits] + +==== Bugfixes + +*Affecting all Beats* + +- Fix a type issue when specifying certicate authority when using the `import_dashboards` command. {pull}6678[6678] + +*Packetbeat* + +- Fix http status phrase parsing not allow spaces. {pull}5312[5312] +- Fix http parse to allow to parse get request with space in the URI. {pull}5495[5495] +- Fix mysql SQL parser to trim `\r` from Windows Server `SELECT\r\n\t1`. {pull}5572[5572] +- Fix corruption when parsing repeated headers in an HTTP request or response. {pull}6325[6325] +- Fix panic when parsing partial AMQP messages. {pull}6384[6384] +- Fix out of bounds access to slice in MongoDB parser. {pull}6256[6256] +- Fix sniffer hanging on exit under Linux. {pull}6535[6535] +- Fix bounds check error in http parser causing a panic. {pull}6750[6750] +- HTTP parses successfully on empty status phrase. {issue}6176[6176] +- HTTP parser supports broken status line. {pull}6631[6631] + + +[[release-notes-5.6.8]] +=== Beats version 5.6.8 +https://github.com/elastic/beats/compare/v5.6.7...v5.6.8[View commits] + +==== Bugfixes + +*Winlogbeat* + +- Fixed a crash under Windows 2003 and XP when an event had less insert strings than required by its format string. {pull}6247[6247] + + +[[release-notes-5.6.7]] +=== Beats version 5.6.7 +https://github.com/elastic/beats/compare/v5.6.6...v5.6.7[View commits] + +No changes in this release. + + +[[release-notes-5.6.6]] +=== Beats version 5.6.6 +https://github.com/elastic/beats/compare/v5.6.5...v5.6.6[View commits] + +No changes in this release. + + +[[release-notes-5.6.5]] +=== Beats version 5.6.5 +https://github.com/elastic/beats/compare/v5.6.4...v5.6.5[View commits] + +==== Bugfixes + +*Affecting all Beats* + +- Fix duplicate batches of events in retry queue. {pull}5520[5520] + +*Metricbeat* + +- Clarify meaning of percentages reported by system core metricset. {pull}5565[5565] +- Fix map overwrite in docker diskio module. {issue}5582[5582] + +[[release-notes-5.6.4]] +=== Beats version 5.6.4 +https://github.com/elastic/beats/compare/v5.6.3...v5.6.4[View commits] + +==== Bugfixes + +*Affecting all Beats* + +- Fix race condition in internal logging rotator. {pull}4519[4519] + +*Packetbeat* + +- Fix missing length check in the PostgreSQL module. {pull}5457[5457] + +==== Added + +*Affecting all Beats* + +- Add support for enabling TLS renegotiation. {issue}4386[4386] +- Add setting to enable/disable the slow start in logstash output. {pull}5400[5400] + +[[release-notes-5.6.3]] +=== Beats version 5.6.3 +https://github.com/elastic/beats/compare/v5.6.2...v5.6.3[View commits] + +No changes in this release. + [[release-notes-5.6.2]] === Beats version 5.6.2 https://github.com/elastic/beats/compare/v5.6.1...v5.6.2[View commits] diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc new file mode 100644 index 000000000000..edb5970cf42c --- /dev/null +++ b/CHANGELOG.next.asciidoc @@ -0,0 +1,183 @@ +// Use these for links to issue and pulls. Note issues and pulls redirect one to +// each other on Github, so don't worry too much on using the right prefix. +:issue: https://github.com/elastic/beats/issues/ +:pull: https://github.com/elastic/beats/pull/ + +=== Beats version HEAD +https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD diff] + +==== Breaking changes + +*Affecting all Beats* + +- Update to Golang 1.12.1. {pull}11330[11330] + +*Auditbeat* + +- Auditd module: Normalized value of `event.category` field from `user-login` to `authentication`. {pull}11432[11432] + +*Filebeat* +- Modify apache/error dataset to follow ECS. {pull}8963[8963] +- Rename many `traefik.access.*` fields to map to ECS. {pull}9005[9005] +- Fix parsing of GC entries in elasticsearch server log. {issue}9513[9513] {pull}9810[9810] +- Add read_buffer configuration option. {pull}11739[11739] + +*Heartbeat* + +- Removed the `add_host_metadata` and `add_cloud_metadata` processors from the default config. These don't fit well with ECS for Heartbeat and were rarely used. + +*Journalbeat* + +*Metricbeat* + +- Add new option `OpMultiplyBuckets` to scale histogram buckets to avoid decimal points in final events {pull}10994[10994] +- Change cloud.provider from ec2 to aws and from gce to gcp in add_cloud_metadata to align with ECS. {issue}10775[10775] {pull}11687[11687] + +*Packetbeat* + +- Add support for mongodb opcode 2013 (OP_MSG). {issue}6191[6191] {pull}8594[8594] + +*Winlogbeat* + +- Adjust Winlogbeat fields to map to ECS. {pull}10333[10333] + +*Functionbeat* + +==== Bugfixes + +*Affecting all Beats* + +- Ensure all beat commands respect configured settings. {pull}10721[10721] +- Add missing fields and test cases for libbeat add_kubernetes_metadata processor. {issue}11133[11133], {pull}11134[11134] +- decode_json_field: process objects and arrays only {pull}11312[11312] +- decode_json_field: do not process arrays when flag not set. {pull}11318[11318] +- Report faulting file when config reload fails. {pull}[11304]11304 +- Fix a typo in libbeat/outputs/transport/client.go by updating `c.conn.LocalAddr()` to `c.conn.RemoteAddr()`. {pull}11242[11242] +- Management configuration backup file will now have a timestamps in their name. {pull}11034[11034] +- [CM] Parse enrollment_token response correctly {pull}11648[11648] +- Not hiding error in case of http failure using elastic fetcher {pull}11604[11604] +- Relax validation of the X-Pack license UID value. {issue}11640[11640] +- Fix a parsing error with the X-Pack license check on 32-bit system. {issue}11650[11650] +- Fix ILM policy always being overwritten. {pull}11671[11671] +- Fix template always being overwritten. {pull}11671[11671] +- Fix matching of string arrays in contains condition. {pull}11691[11691] +- Fix formatting for `event.duration`, "human readable" was not working well for this. {pull}11675[11675] +- Fix initialization of the TCP input logger. {pull}11605[11605] +- Fix flaky service_integration_windows_test test by introducing a confidence factor and enriching the error message with more service details. {issue}8880[8880] and {issue}7977[7977] + +*Auditbeat* + +- Package dataset: dlopen versioned librpm shared objects. {pull}11565[11565] +- Package dataset: Nullify Librpm's rpmsqEnable. {pull}11628[11628] + +*Filebeat* + +- Add support for Cisco syslog format used by their switch. {pull}10760[10760] +- Cover empty request data, url and version in Apache2 module{pull}10730[10730] +- Fix registry entries not being cleaned due to race conditions. {pull}10747[10747] +- Improve detection of file deletion on Windows. {pull}10747[10747] +- Fix goroutine leak happening when harvesters are dynamically stopped. {pull}11263[11263] +- Fix `add_docker_metadata` source matching, using `log.file.path` field now. {pull}11577[11577] +- Add missing Kubernetes metadata fields to Filebeat CoreDNS module, and fix a documentation error. {pull}11591[11591] +- Reduce memory usage if long lines are truncated to fit `max_bytes` limit. The line buffer is copied into a smaller buffer now. This allows the runtime to release unused memory earlier. {pull}11524[11524] + +*Heartbeat* + +*Journalbeat* + +*Metricbeat* + +- Add _bucket to histogram metrics in Prometheus Collector {pull}11578[11578] +- Prevent the docker/memory metricset from processing invalid events before container start {pull}11676[11676] +- Change `add_cloud_metadata` processor to not overwrite `cloud` field when it already exist in the event. {pull}11612[11612] {issue}11305[11305] + +*Packetbeat* + +- Prevent duplicate packet loss error messages in HTTP events. {pull}10709[10709] +- Avoid reporting unknown MongoDB opcodes more than once. {pull}10878[10878] + +*Winlogbeat* + +*Functionbeat* + +==== Added + +*Affecting all Beats* + +- Add `network` condition to processors for matching IP addresses against CIDRs. {pull}10743[10743] +- Add if/then/else support to processors. {pull}10744[10744] +- Add `community_id` processor for computing network flow hashes. {pull}10745[10745] +- Add output test to kafka output {pull}10834[10834] +- Gracefully shut down on SIGHUP {pull}10704[10704] +- New processor: `copy_fields`. {pull}11303[11303] +- Add `error.message` to events when `fail_on_error` is set in `rename` and `copy_fields` processors. {pull}11303[11303] +- New processor: `truncate_fields`. {pull}11297[11297] +- Allow a beat to ship monitoring data directly to an Elasticsearch monitoring clsuter. {pull}9260[9260] +- Updated go-seccomp-bpf library to v1.1.0 which updates syscall lists for Linux v5.0. {pull}NNNN[NNNN] + +*Auditbeat* + +- Auditd module: Add `event.outcome` and `event.type` for ECS. {pull}11432[11432] +- Package: Enable suse. {pull}11634[11634] +- Add support to the system package dataset for the SUSE OS family. {pull}11634[11634] + +*Filebeat* + +- Add more info to message logged when a duplicated symlink file is found {pull}10845[10845] +- Add option to configure docker input with paths {pull}10687[10687] +- Add Netflow module to enrich flow events with geoip data. {pull}10877[10877] +- Set `event.category: network_traffic` for Suricata. {pull}10882[10882] +- Add configuration knob for auto-discover hints to control whether log harvesting is enabled for the pod/container. {issue}10811[10811] {pull}10911[10911] +- Change Suricata module pipeline to handle `destination.domain` being set if a reverse DNS processor is used. {issue}10510[10510] +- Add the `network.community_id` flow identifier to field to the IPTables, Suricata, and Zeek modules. {pull}11005[11005] +- New Filebeat coredns module to ingest coredns logs. It supports both native coredns deployment and coredns deployment in kubernetes. {pull}11200[11200] +- New module for Cisco ASA logs. {issue}9200[9200] {pull}11171[11171] +- Added support for Cisco ASA fields to the netflow input. {pull}11201[11201] +- Configurable line terminator. {pull}11015[11015] +- Add Filebeat envoyproxy module. {pull}11700[11700] + +*Heartbeat* + +*Journalbeat* + +*Metricbeat* + +- Add AWS SQS metricset. {pull}10684[10684] {issue}10053[10053] +- Add AWS s3_request metricset. {pull}10949[10949] {issue}10055[10055] +- Add s3_daily_storage metricset. {pull}10940[10940] {issue}10055[10055] +- Add `coredns` metricbeat module. {pull}10585[10585] +- Add SSL support for Metricbeat HTTP server. {pull}11482[11482] {issue}11457[11457] +- The `elasticsearch.index` metricset (with `xpack.enabled: true`) now collects `refresh.external_total_time_in_millis` fields from Elasticsearch. {pull}11616[11616] +- Allow module configurations to have variants {pull}9118[9118] + +*Packetbeat* + +*Functionbeat* + +*Winlogbeat* + +- Add support for reading from .evtx files. {issue}4450[4450] + +==== Deprecated + +*Affecting all Beats* + +*Filebeat* + +*Heartbeat* + +*Journalbeat* + +*Metricbeat* + +*Packetbeat* + +*Winlogbeat* + +- Close handle on signalEvent. {pull}9838[9838] + +*Functionbeat* + +==== Known Issue + +*Journalbeat* diff --git a/Jenkinsfile b/Jenkinsfile new file mode 100644 index 000000000000..7b1a7bd647c8 --- /dev/null +++ b/Jenkinsfile @@ -0,0 +1,120 @@ +#!/usr/bin/env groovy + +library identifier: 'apm@v1.0.2', +retriever: modernSCM( + [$class: 'GitSCMSource', + credentialsId: 'f94e9298-83ae-417e-ba91-85c279771570', + id: '37cf2c00-2cc7-482e-8c62-7bbffef475e2', + remote: 'git@github.com:elastic/apm-pipeline-library.git']) + +pipeline { + agent none + environment { + BASE_DIR="src/github.com/elastic/beats" + } + options { + timeout(time: 1, unit: 'HOURS') + buildDiscarder(logRotator(numToKeepStr: '20', artifactNumToKeepStr: '20', daysToKeepStr: '30')) + timestamps() + ansiColor('xterm') + disableResume() + durabilityHint('PERFORMANCE_OPTIMIZED') + } + parameters { + booleanParam(name: 'Run_As_Master_Branch', defaultValue: false, description: 'Allow to run any steps on a PR, some steps normally only run on master branch.') + } + stages { + /** + Checkout the code and stash it, to use it on other stages. + */ + stage('Checkout') { + agent { label 'linux && immutable' } + environment { + PATH = "${env.PATH}:${env.WORKSPACE}/bin" + HOME = "${env.WORKSPACE}" + GOPATH = "${env.WORKSPACE}" + } + options { skipDefaultCheckout() } + steps { + dir("${BASE_DIR}"){ + checkout scm + } + stash allowEmpty: true, name: 'source', useDefaultExcludes: false + script { + env.GO_VERSION = readFile("${BASE_DIR}/.go-version") + } + } + } + /** + Updating generated files for Beat. + Checks the GO environment. + Checks the Python environment. + Checks YAML files are generated. + Validate that all updates were committed. + */ + stage('Intake') { + agent { label 'linux && immutable' } + options { skipDefaultCheckout() } + environment { + PATH = "${env.PATH}:${env.WORKSPACE}/bin" + HOME = "${env.WORKSPACE}" + GOPATH = "${env.WORKSPACE}" + } + steps { + withEnvWrapper() { + unstash 'source' + dir("${BASE_DIR}"){ + sh './dev-tools/jenkins_intake.sh' + } + } + } + } + stage('Test') { + failFast true + parallel { + /** + Run unit tests and report junit results. + */ + stage('Filebeat') { + agent { label 'linux && immutable' } + options { skipDefaultCheckout() } + environment { + PATH = "${env.PATH}:${env.WORKSPACE}/bin" + HOME = "${env.WORKSPACE}" + GOPATH = "${env.WORKSPACE}" + } + steps { + withEnvWrapper() { + unstash 'source' + dir("${BASE_DIR}"){ + sh './filebeat/scripts/jenkins/unit-test.sh' + } + } + } + post { + always { + junit(allowEmptyResults: true, + keepLongStdio: true, + testResults: "${BASE_DIR}/build/junit-*.xml") + } + } + } + } + } + } + post { + success { + echoColor(text: '[SUCCESS]', colorfg: 'green', colorbg: 'default') + } + aborted { + echoColor(text: '[ABORTED]', colorfg: 'magenta', colorbg: 'default') + } + failure { + echoColor(text: '[FAILURE]', colorfg: 'red', colorbg: 'default') + //step([$class: 'Mailer', notifyEveryUnstableBuild: true, recipients: "${NOTIFY_TO}", sendToIndividuals: false]) + } + unstable { + echoColor(text: '[UNSTABLE]', colorfg: 'yellow', colorbg: 'default') + } + } +} diff --git a/Makefile b/Makefile index b9b5e274a260..82564069db31 100644 --- a/Makefile +++ b/Makefile @@ -13,12 +13,27 @@ REVIEWDOG_OPTIONS?=-diff "git diff master" REVIEWDOG_REPO=github.com/haya14busa/reviewdog/cmd/reviewdog XPACK_SUFFIX=x-pack/ +# PROJECTS_XPACK_PKG is a list of Beats that have independent packaging support +# in the x-pack directory (rather than having the OSS build produce both sets +# of artifacts). This will be removed once we complete the transition. +PROJECTS_XPACK_PKG=x-pack/auditbeat x-pack/filebeat x-pack/metricbeat +# PROJECTS_XPACK_MAGE is a list of Beats whose primary build logic is based in +# Mage. For compatibility with CI testing these projects support a subset of the +# makefile targets. After all Beats converge to primarily using Mage we can +# remove this and treat all sub-projects the same. +PROJECTS_XPACK_MAGE=$(PROJECTS_XPACK_PKG) + +# +# Includes +# +include dev-tools/make/mage.mk + # Runs complete testsuites (unit, system, integration) for all beats with coverage and race detection. # Also it builds the docs and the generators .PHONY: testsuite testsuite: - @$(foreach var,$(PROJECTS),$(MAKE) -C $(var) testsuite || exit 1;) + @$(foreach var,$(PROJECTS) $(PROJECTS_XPACK_MAGE),$(MAKE) -C $(var) testsuite || exit 1;) .PHONY: setup-commit-hook setup-commit-hook: @@ -54,15 +69,15 @@ coverage-report: .PHONY: update update: notice - @$(foreach var,$(PROJECTS),$(MAKE) -C $(var) update || exit 1;) + @$(foreach var,$(PROJECTS) $(PROJECTS_XPACK_MAGE),$(MAKE) -C $(var) update || exit 1;) @$(MAKE) -C deploy/kubernetes all .PHONY: clean -clean: +clean: mage @rm -rf build - @$(foreach var,$(PROJECTS),$(MAKE) -C $(var) clean || exit 1;) + @$(foreach var,$(PROJECTS) $(PROJECTS_XPACK_MAGE),$(MAKE) -C $(var) clean || exit 1;) @$(MAKE) -C generator clean - @-mage -clean 2> /dev/null + @-mage -clean # Cleans up the vendor directory from unnecessary files # This should always be run after updating the dependencies @@ -72,7 +87,7 @@ clean-vendor: .PHONY: check check: python-env - @$(foreach var,$(PROJECTS) dev-tools,$(MAKE) -C $(var) check || exit 1;) + @$(foreach var,$(PROJECTS) dev-tools $(PROJECTS_XPACK_MAGE),$(MAKE) -C $(var) check || exit 1;) @# Checks also python files which are not part of the beats @$(FIND) -name *.py -exec $(PYTHON_ENV)/bin/autopep8 -d --max-line-length 120 {} \; | (! grep . -q) || (echo "Code differs from autopep8's style" && false) @# Validate that all updates were committed @@ -107,7 +122,7 @@ misspell: .PHONY: fmt fmt: add-headers python-env - @$(foreach var,$(PROJECTS) dev-tools,$(MAKE) -C $(var) fmt || exit 1;) + @$(foreach var,$(PROJECTS) dev-tools $(PROJECTS_XPACK_MAGE),$(MAKE) -C $(var) fmt || exit 1;) @# Cleans also python files which are not part of the beats @$(FIND) -name "*.py" -exec $(PYTHON_ENV)/bin/autopep8 --in-place --max-line-length 120 {} \; @@ -150,8 +165,8 @@ snapshot: # Builds a release. .PHONY: release release: beats-dashboards - @$(foreach var,$(BEATS),$(MAKE) -C $(var) release || exit 1;) - @$(foreach var,$(BEATS), \ + @$(foreach var,$(BEATS) $(PROJECTS_XPACK_PKG),$(MAKE) -C $(var) release || exit 1;) + @$(foreach var,$(BEATS) $(PROJECTS_XPACK_PKG), \ test -d $(var)/build/distributions && test -n "$$(ls $(var)/build/distributions)" || exit 0; \ mkdir -p build/distributions/$(subst $(XPACK_SUFFIX),'',$(var)) && mv -f $(var)/build/distributions/* build/distributions/$(subst $(XPACK_SUFFIX),'',$(var))/ || exit 1;) @@ -167,11 +182,6 @@ release-manager-snapshot: release-manager-release: ./dev-tools/run_with_go_ver $(MAKE) release -# Installs the mage build tool from the vendor directory. -.PHONY: mage -mage: - @go install github.com/elastic/beats/vendor/github.com/magefile/mage - # Collects dashboards from all Beats and generates a zip file distribution. .PHONY: beats-dashboards beats-dashboards: mage update diff --git a/NOTICE.txt b/NOTICE.txt index 4c77d72651aa..c173e8b7ab2c 100644 --- a/NOTICE.txt +++ b/NOTICE.txt @@ -1,5 +1,5 @@ Elastic Beats -Copyright 2014-2018 Elasticsearch BV +Copyright 2014-2019 Elasticsearch BV This product includes software developed by The Apache Software Foundation (http://www.apache.org/). @@ -9,6 +9,15 @@ Third party libraries used by the Elastic Beats project: ========================================================================== +-------------------------------------------------------------------- +Dependency: cloud.google.com/go +Revision: 632e11ec7c242a85e1931e4a8fdda2002316569f +License type (autodetected): Apache-2.0 +./vendor/cloud.google.com/go/LICENSE: +-------------------------------------------------------------------- +Apache License 2.0 + + -------------------------------------------------------------------- Dependency: github.com/aerospike/aerospike-client-go Revision: 0f3b54da6bdc2c31c505f9afbc5f434dd2089658 @@ -164,8 +173,7 @@ Copyright 2014-2015 Stripe, Inc. -------------------------------------------------------------------- Dependency: github.com/awslabs/goformation -Version: 1.2.2 -Revision: d42502ef32a8892bf380256e2f57c6f69190d802 +Revision: c5f655c41370a0bec733fa251fd2ecd4e3f0dfe3 License type (autodetected): Apache-2.0 ./vendor/github.com/awslabs/goformation/LICENSE: -------------------------------------------------------------------- @@ -233,8 +241,8 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. -------------------------------------------------------------------- Dependency: github.com/coreos/go-systemd -Version: v17 -Revision: 39ca1b05acc7ad1220e09f133283b8859a8b71ab +Version: v18 +Revision: 9002847aa1425fb6ac49077c0a630b3b67e0fbfd License type (autodetected): Apache-2.0 ./vendor/github.com/coreos/go-systemd/LICENSE: -------------------------------------------------------------------- @@ -262,6 +270,40 @@ Copyright 2014 CoreOS, Inc This product includes software developed at CoreOS, Inc. (http://www.coreos.com/). +-------------------------------------------------------------------- +Dependency: github.com/DataDog/zstd +Revision: 2bf71ec4836011b92dc78df3b9ace6b40e65f7df +License type (autodetected): BSD-3-Clause +./vendor/github.com/DataDog/zstd/LICENSE: +-------------------------------------------------------------------- +Simplified BSD License + +Copyright (c) 2016, Datadog +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + + * Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above copyright notice, + this list of conditions and the following disclaimer in the documentation + and/or other materials provided with the distribution. + * Neither the name of the copyright holder nor the names of its contributors + may be used to endorse or promote products derived from this software + without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" +AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE +FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER +CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, +OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + -------------------------------------------------------------------- Dependency: github.com/davecgh/go-spew Version: v1.1.0 @@ -304,6 +346,40 @@ ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. +-------------------------------------------------------------------- +Dependency: github.com/denisenkom/go-mssqldb +Revision: 4e0d7dc8888fbb59764060e99b7b68e77a6f9698 +License type (autodetected): BSD-3-Clause +./vendor/github.com/denisenkom/go-mssqldb/LICENSE.txt: +-------------------------------------------------------------------- +Copyright (c) 2012 The Go Authors. All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are +met: + + * Redistributions of source code must retain the above copyright +notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above +copyright notice, this list of conditions and the following disclaimer +in the documentation and/or other materials provided with the +distribution. + * Neither the name of Google Inc. nor the names of its +contributors may be used to endorse or promote products derived from +this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + -------------------------------------------------------------------- Dependency: github.com/digitalocean/go-libvirt Revision: 59d541f19311883ad82708651353009fb207d8a9 @@ -313,6 +389,34 @@ License type (autodetected): Apache-2.0 Apache License 2.0 +-------------------------------------------------------------------- +Dependency: github.com/dlclark/regexp2 +Revision: 7632a260cbaf5e7594fc1544a503456ecd0827f1 +License type (autodetected): MIT +./vendor/github.com/dlclark/regexp2/LICENSE: +-------------------------------------------------------------------- +The MIT License (MIT) + +Copyright (c) Doug Clark + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. + -------------------------------------------------------------------- Dependency: github.com/docker/distribution Revision: 1e2f10eb65743fed02f573d31a4587de09afb20e @@ -324,7 +428,7 @@ Apache License 2.0 -------------------------------------------------------------------- Dependency: github.com/docker/docker -Revision: d192db0d9350222d2b8bb6eba8525b04c3be7d61 +Revision: 1009e6a40b295187e038b67e184e9c0384d95538 License type (autodetected): Apache-2.0 ./vendor/github.com/docker/docker/LICENSE: -------------------------------------------------------------------- @@ -353,7 +457,8 @@ See also https://www.apache.org/dev/crypto.html and/or seek legal counsel. -------------------------------------------------------------------- Dependency: github.com/docker/go-connections -Revision: e15c02316c12de00874640cd76311849de2aeed5 +Version: v0.3.0 +Revision: 3ede32e2033de7505e6500d6c868c2b9ed9f169d License type (autodetected): Apache-2.0 ./vendor/github.com/docker/go-connections/LICENSE: -------------------------------------------------------------------- @@ -378,6 +483,48 @@ License type (autodetected): Apache-2.0 Apache License 2.0 +-------------------------------------------------------------------- +Dependency: github.com/dop251/goja +Revision: dd2ac4456e2073f116d6b88741d513addabe0326 +License type (autodetected): MIT +./vendor/github.com/dop251/goja/LICENSE: +-------------------------------------------------------------------- +Copyright (c) 2016 Dmitry Panov + +Copyright (c) 2012 Robert Krimen + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated +documentation files (the "Software"), to deal in the Software without restriction, including without limitation +the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE +WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR +OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + +-------------------------------------------------------------------- +Dependency: github.com/dop251/goja_nodejs +Revision: adff31b136e6b7e044712aab7236a775e1bd085e +License type (autodetected): MIT +./vendor/github.com/dop251/goja_nodejs/LICENSE: +-------------------------------------------------------------------- +Copyright (c) 2016 Dmitry Panov + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated +documentation files (the "Software"), to deal in the Software without restriction, including without limitation +the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to +permit persons to whom the Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE +WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR +OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + -------------------------------------------------------------------- Dependency: github.com/dustin/go-humanize Revision: 259d2a102b871d17f30e3cd9881a642961a1e486 @@ -490,6 +637,31 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +-------------------------------------------------------------------- +Dependency: github.com/elastic/ecs +Version: 1.0 +Revision: b9f735dd33b0bbb95dbca4229397c9b7f81f8f53 +License type (autodetected): Apache-2.0 +./vendor/github.com/elastic/ecs/LICENSE.txt: +-------------------------------------------------------------------- +Apache License 2.0 + +-------NOTICE.txt----- +Elastic Common Schema +Copyright 2018 Elasticsearch B.V. + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + -------------------------------------------------------------------- Dependency: github.com/elastic/go-libaudit Version: v0.4.0 @@ -517,7 +689,8 @@ Apache License 2.0 -------------------------------------------------------------------- Dependency: github.com/elastic/go-seccomp-bpf -Revision: 5bed103a93993f24c58dd267faaab582f2373e31 +Version: v1.1.0 +Revision: 4e6640ac0ec1b7cd22a7ec12f4ca610efbe3c4d9 License type (autodetected): Apache-2.0 ./vendor/github.com/elastic/go-seccomp-bpf/LICENSE.txt: -------------------------------------------------------------------- @@ -542,7 +715,7 @@ Apache License 2.0 -------------------------------------------------------------------- Dependency: github.com/elastic/go-sysinfo -Revision: 7b021494a9562d0c3f0422d49b9980709c5650e9 +Revision: ab4f04edfc3d6b3864f5f06a068ddab9ad79774f License type (autodetected): Apache-2.0 ./vendor/github.com/elastic/go-sysinfo/LICENSE.txt: -------------------------------------------------------------------- @@ -557,8 +730,8 @@ Elasticsearch, B.V. (https://www.elastic.co/). -------------------------------------------------------------------- Dependency: github.com/elastic/go-txfile -Version: v0.0.3 -Revision: 389b527ad365f6fc6cf5fa7e0ba5a2294ad2f3ed +Version: v0.0.6 +Revision: fa3d87c14381c01aaa1c7901877fb5e483294964 License type (autodetected): Apache-2.0 ./vendor/github.com/elastic/go-txfile/LICENSE: -------------------------------------------------------------------- @@ -567,8 +740,8 @@ Apache License 2.0 -------------------------------------------------------------------- Dependency: github.com/elastic/go-ucfg -Version: v0.6.4 -Revision: e81c02ad8f1ab46b9e8b07f0832245c0c2e1d13c +Version: v0.7.0 +Revision: 0539807037ce820e147797f051ff32b05f4f9288 License type (autodetected): Apache-2.0 ./vendor/github.com/elastic/go-ucfg/LICENSE: -------------------------------------------------------------------- @@ -592,8 +765,8 @@ Elasticsearch, B.V. (https://www.elastic.co/). -------------------------------------------------------------------- Dependency: github.com/elastic/gosigar -Version: v0.9.0 -Revision: 237dff72b4ba95da2cd985f96a9c0ede4aefc760 +Version: v0.10.0 +Revision: f2a90fc413720c43da9c4fe1a47513c73f45ac3d License type (autodetected): Apache-2.0 ./vendor/github.com/elastic/gosigar/LICENSE: -------------------------------------------------------------------- @@ -649,7 +822,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. -------------------------------------------------------------------- Dependency: github.com/fsnotify/fsevents -Revision: 4d5197691b054c220286f7c6ea167de9753d902d +Revision: e1d381a4d27063baac2e9d3c5887ceb4ab059287 License type (autodetected): BSD-3-Clause ./vendor/github.com/fsnotify/fsevents/LICENSE: -------------------------------------------------------------------- @@ -804,9 +977,42 @@ The above copyright notice and this permission notice shall be included in all c THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. +-------------------------------------------------------------------- +Dependency: github.com/go-sourcemap/sourcemap +Revision: b019cc30c1eaa584753491b0d8f8c1534bf1eb44 +License type (autodetected): BSD-2-Clause +./vendor/github.com/go-sourcemap/sourcemap/LICENSE: +-------------------------------------------------------------------- +Copyright (c) 2016 The github.com/go-sourcemap/sourcemap Contributors. +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are +met: + + * Redistributions of source code must retain the above copyright +notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above +copyright notice, this list of conditions and the following disclaimer +in the documentation and/or other materials provided with the +distribution. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + -------------------------------------------------------------------- Dependency: github.com/go-sql-driver/mysql -Revision: 9dee4ca50b83acdf57a35fb9e6fb4be640afa2f3 +Version: v1.4.1 +Revision: 72cd26f257d44c1114970e19afddcd812016007e License type (autodetected): MPL-2.0 ./metricbeat/module/mysql/vendor/github.com/go-sql-driver/mysql/LICENSE: -------------------------------------------------------------------- @@ -1687,6 +1893,22 @@ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +-------------------------------------------------------------------- +Dependency: github.com/konsorten/go-windows-terminal-sequences +Revision: f55edac94c9bbba5d6182a4be46d86a2c9b5b50e +License type (autodetected): MIT +./vendor/github.com/konsorten/go-windows-terminal-sequences/LICENSE: +-------------------------------------------------------------------- +(The MIT License) + +Copyright (c) 2017 marvin + konsorten GmbH (open-source@konsorten.de) + +Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the 'Software'), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + -------------------------------------------------------------------- Dependency: github.com/kubernetes/apimachinery Version: kubernetes-1.11.1 @@ -1714,7 +1936,8 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI -------------------------------------------------------------------- Dependency: github.com/magefile/mage -Revision: 5e51f9ad1ed0886c5d06a8c46a09703cfc4d9034 +Version: v1.8.0 +Revision: aedfce64c122eef47009b7f80c9771044753215d License type (autodetected): Apache-2.0 ./vendor/github.com/magefile/mage/LICENSE: -------------------------------------------------------------------- @@ -2152,7 +2375,7 @@ SoundCloud Ltd. (http://soundcloud.com/). -------------------------------------------------------------------- Dependency: github.com/rcrowley/go-metrics -Revision: 1f30fe9094a513ce4c700b9a54458bbb0c96996c +Revision: 3113b8401b8a98917cde58f8bbd42a1b1c03b1fd License type (autodetected): BSD-2-Clause ./vendor/github.com/rcrowley/go-metrics/LICENSE: -------------------------------------------------------------------- @@ -2358,8 +2581,8 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -------------------------------------------------------------------- Dependency: github.com/shirou/gopsutil -Version: v2.18.06 -Revision: 4a180b209f5f494e5923cfce81ea30ba23915877 +Version: v2.18.11 +Revision: 0f70a4a06f7a1039305ec9b3ba9c2800f8929fba License type (autodetected): BSD-3-Clause ./vendor/github.com/shirou/gopsutil/LICENSE: -------------------------------------------------------------------- @@ -2426,8 +2649,8 @@ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -------------------------------------------------------------------- Dependency: github.com/Shopify/sarama -Version: =v1.18.0/enh/offset-replica-id -Revision: 0143592836b090a1b481def4d902cfb3c5c05ae5 +Version: v1.20.1 +Revision: 03a43f93cd29dc549e6d9b11892795c206f9c38c License type (autodetected): MIT ./vendor/github.com/Shopify/sarama/LICENSE: -------------------------------------------------------------------- @@ -2453,10 +2676,10 @@ OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. -------------------------------------------------------------------- -Dependency: github.com/Sirupsen/logrus -Revision: 5e5dc898656f695e2a086b8e12559febbfc01562 +Dependency: github.com/sirupsen/logrus +Revision: a6c0064cfaf982707445a1c90368f956421ebcf0 License type (autodetected): MIT -./vendor/github.com/Sirupsen/logrus/LICENSE: +./vendor/github.com/sirupsen/logrus/LICENSE: -------------------------------------------------------------------- The MIT License (MIT) @@ -2647,7 +2870,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -------------------------------------------------------------------- Dependency: github.com/tsg/gopacket -Revision: f289b3ea3e41a01b2822be9caf5f40c01fdda05c +Revision: 7c5392a5f2b5c5fa393c71e1f9064e22b5408995 License type (autodetected): BSD-3-Clause ./vendor/github.com/tsg/gopacket/LICENSE: -------------------------------------------------------------------- @@ -2850,7 +3073,7 @@ THE SOFTWARE. -------------------------------------------------------------------- Dependency: golang.org/x/crypto -Revision: 5119cf507ed5294cc409c092980c7497ee5d6fd2 +Revision: 85e1b3f9139abd58575d728a509643924e3b2ebf License type (autodetected): BSD-3-Clause ./vendor/golang.org/x/crypto/LICENSE: -------------------------------------------------------------------- @@ -2919,7 +3142,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -------------------------------------------------------------------- Dependency: golang.org/x/sys -Revision: 0ffbfd41fbef8ffcf9b62b0b0aa3a5873ed7a4fe +Revision: d989b31c87461dc8ab2f1cac6792814e27fadea9 License type (autodetected): BSD-3-Clause ./vendor/golang.org/x/sys/LICENSE: -------------------------------------------------------------------- @@ -3054,6 +3277,15 @@ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +-------------------------------------------------------------------- +Dependency: google.golang.org/appengine +Revision: e9657d882bb81064595ca3b56cbe2546bbabf7b1 +License type (autodetected): Apache-2.0 +./metricbeat/module/mysql/vendor/google.golang.org/appengine/LICENSE: +-------------------------------------------------------------------- +Apache License 2.0 + + -------------------------------------------------------------------- Dependency: gopkg.in/inf.v0 Revision: 3887ee99ecf07df5b447e9b00d9c0b2adaa9f3e4 diff --git a/README.md b/README.md index aa735422e023..f6f0bc6bbc87 100644 --- a/README.md +++ b/README.md @@ -21,7 +21,9 @@ Beat | Description --- | --- [Auditbeat](https://github.com/elastic/beats/tree/master/auditbeat) | Collect your Linux audit framework data and monitor the integrity of your files. [Filebeat](https://github.com/elastic/beats/tree/master/filebeat) | Tails and ships log files +[Functionbeat](https://github.com/elastic/beats/tree/master/x-pack/functionbeat) | Read and ships events from serverless infrastructure. [Heartbeat](https://github.com/elastic/beats/tree/master/heartbeat) | Ping remote services for availability +[Journalbeat](https://github.com/elastic/beats/tree/master/journalbeat) | Read and ships event from Journald. [Metricbeat](https://github.com/elastic/beats/tree/master/metricbeat) | Fetches sets of metrics from the operating system and services [Packetbeat](https://github.com/elastic/beats/tree/master/packetbeat) | Monitors the network and applications by sniffing packets [Winlogbeat](https://github.com/elastic/beats/tree/master/winlogbeat) | Fetches and ships Windows Event logs @@ -40,7 +42,9 @@ on the [elastic.co site](https://www.elastic.co/guide/): * [Beats platform](https://www.elastic.co/guide/en/beats/libbeat/current/index.html) * [Auditbeat](https://www.elastic.co/guide/en/beats/auditbeat/current/index.html) * [Filebeat](https://www.elastic.co/guide/en/beats/filebeat/current/index.html) +* [Functionbeat](https://www.elastic.co/guide/en/beats/functionbeat/current/index.html) * [Heartbeat](https://www.elastic.co/guide/en/beats/heartbeat/current/index.html) +* [Journalbeat](https://www.elastic.co/guide/en/beats/journalbeat/current/index.html) * [Metricbeat](https://www.elastic.co/guide/en/beats/metricbeat/current/index.html) * [Packetbeat](https://www.elastic.co/guide/en/beats/packetbeat/current/index.html) * [Winlogbeat](https://www.elastic.co/guide/en/beats/winlogbeat/current/index.html) @@ -77,3 +81,7 @@ Beats](https://github.com/elastic/beats/blob/master/libbeat/docs/communitybeats. See our [CONTRIBUTING](CONTRIBUTING.md) file for information about setting up your dev environment to build Beats from the source. + +## Snapshots + +For testing purposes, we generate snapshot builds that you can find [here](https://beats-ci.elastic.co/job/elastic+beats+master+multijob-package-linux/lastSuccessfulBuild/gcsObjects/). Please be aware that these are built on top of master and are not meant for production. diff --git a/Vagrantfile b/Vagrantfile index 310e5e097596..a851be38692f 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -37,7 +37,7 @@ cmd /c mklink /d C:\\Gopath\\src\\github.com\\elastic\\beats \\\\vboxsvr\\vagran echo "Installing gvm to manage go version" [Net.ServicePointManager]::SecurityProtocol = "tls12" -Invoke-WebRequest -URI https://github.com/andrewkroh/gvm/releases/download/v0.0.5/gvm-windows-amd64.exe -Outfile C:\Windows\System32\gvm.exe +Invoke-WebRequest -URI https://github.com/andrewkroh/gvm/releases/download/v0.1.0/gvm-windows-amd64.exe -Outfile C:\Windows\System32\gvm.exe C:\Windows\System32\gvm.exe --format=powershell #{GO_VERSION} | Invoke-Expression go version @@ -69,16 +69,19 @@ if [ -d "/vagrant" ] && [ ! -e "beats" ]; then ln -s /vagrant beats; fi SCRIPT # Linux GVM -$linuxGvmProvision = <