Beats auditbeat: baixar versions anteriors

Features and enhancements
All
- Update Go to 1.26.8. #53026
Filebeat
- Add api_endpoint configuration option to gcp-pubsub input to allow overriding the default Pub/Sub API endpoint. #53080 #48923
- Filestream take_over supports from_any_id to migrate from any previous filestream input. #53122 #51307
- Reuse the UDP and Unix datagram read buffer so each packet allocates only its own length. #53490
Libbeat
- Add append_fields option to add_kubernetes_metadata processor to merge metadata into events that already have a kubernetes field without overwriting existing keys. #53098 #53094
- Reduce per-event allocations in the add_agent_metadata processor by pre-building the static metadata maps once at construction. #53477
Metricbeat
- Persist additional cluster settings in the autoops_es cluster_settings metricset. #53145
- Report archived cluster setting names in the autoops_es cluster_settings metricset. #53146 #52654
Fixes
Auditbeat
- Fix Auditbeat file_integrity kprobe leak that could prevent FIM from starting when the running kernel does not match the first candidate BTF spec. #53253 #45827
- Fix process misattribution in system/socket where TCP/UDP flows were attributed to wrong processes. #53421 #44741
Filebeat
- Fix the Elasticsearch state store writing other inputs of the same type to the first input's index. #53178 #53034
- Reconnect the ETW input when its real-time session is stopped and restarted. #53112 #49984
- Fix race condition in Kafka input when multiple inputs are configured. #53115 #34919
- Fix Azure AD entity analytics accumulating stale registered owners and users on devices. #53134 #53132
- Fix Active Directory entity analytics panic when ssl.certificate_authorities is set. #53218
- Fix EntraID entity analytics collection behavior for deleted devices when using minimal state mode. #53254 #20
- Respond to http_endpoint requests that contain no events instead of closing the connection. #53261
- Fix httpjson rate limiter marking the input "Degraded" when rate-limit headers are absent. #53326 #53185
- Scope the aws-s3 lexicographical polling tail to the input's bucket and key prefix. #53351 #53195
Libbeat
- Fix add_kubernetes_metadata: wait_for_metadata now prevents unenriched events at startup. #53093 #53090
- Make an ETW reader session safe to reuse and stop, and fix a lost stop that could hang shutdown. #53112 #49984
- Fix healthy input units stuck in CONFIGURING when a sibling unit fails config validation. #53299 #53292
Metricbeat
- Stop losing a day of azure/billing data when Cost Management returns HTTP 429. #53129
Osquerybeat
- Bound the osqueryd startup check and report startup failures through Elastic Agent. #52992
- Clamp native schedule metadata and history timestamps when endpoint clock skew precedes the configured start date. #52992
Packetbeat
- Fix rendering of TLS certificate serial numbers so each byte is always represented as two hex digits, matching OpenSSL output. #53027 #52995
- Fix panic in DHCPv4 parser when the OptionTimeOffset value is shorter than 4 bytes. #53419 #53330
Winlogbeat
- Fix binary event data fields being overread into subsequent buffer contents. #53327 #53260

Features and enhancements
All
- Add hostname overrides for Beat events. #53029 #48923
Filebeat
- Add hints.input_allow_list to restrict Filebeat hints-generated input types. #53006 #52624
- Report health status from the ETW input when running under Elastic Agent. #53089 #44271
Metricbeat
- Add ingest volume enrichment fields to the autoops_es module. #52914 #48923
- Collect logical_availability_zone and instance_configuration node attributes in the autoops_es node_stats metricset. #53119 #48923
- Collect the frozen flood stage disk watermark in AutoOps cluster settings. #53114 #52341
Fixes
Filebeat
- Wire Sarama client logs in the Filebeat Kafka input so consumer-group lifecycle is visible. #52980 #51305
- Prevent httpjson chain pagination from advancing the cursor when a chained request fails. #53063 #48923
- Follow every CrowdStrike discover resource instead of only the first feed. #53060 #48923
- Update github.com/elastic/entcollect to fix bugs in the EntraID and Okta providers. #52971 #48923
Heartbeat
- Align maintenance window recurrence handling with Kibana, including nth-weekday rules, tzid timezone evaluation, until end bounds, hourly recurrences, inclusive duration behavior, and legacy dtstart formats. #52957 #52571
Metricbeat
- Fix Kubernetes metadata watcher deadlock that blocked metricset shutdown. #53040 #48923
Osquerybeat
- Restart osqueryd instead of terminating Osquerybeat when the extension manager ping times out. #52993 #48923

Features and enhancements
All
- Update Go to 1.26.7. #52750
Filebeat
- Reduce filestream memory usage with multiple Filebeat receivers. #52326
Packetbeat
- Log Npcap installer diagnostic files on installation failure. #52667
Fixes
Filebeat
- Fix the auditd filestream parser to emit unset for unset auid and ses fields. #52614
- Fix CEL input panic on nil rate-limit fields and 429 retry hot-loop. #52684
- Scope the aws-s3 polling state registry to the input's bucket. #52728 #52721
- Log entity analytics sync interruption by input shutdown or reconfiguration at info level instead of error, and no longer mark the input as degraded. #52950 #52945
Osquerybeat
- Emit pack_name and query_name in Osquerybeat scheduled query results. #51781
- Rename log key component to log.logger to prevent mapping conflict on Elasticsearch. #52912 #52888
- Stamp space_id on Osquerybeat live query result and profile documents so results are visible in non-default Kibana spaces. #52915
Packetbeat
- Censor HTTP parameters for mixed-case hide_keywords entries. #52650
- Fix bounds-check panics in Packetbeat TLS and Cassandra protocol parsers. #52870
- Fix network flow collection under the Elastic Agent OTel runtime. #52932 #52931

Features and enhancements
Filebeat
- Update github.com/apache/thrift to v0.24.0. #52330
Fixes
All
- Add support for index in inputs for Beat receivers. #52662
Filebeat
- Add User-Agent to httpjson pagination requests. #52484
Metricbeat
- Recreate Kubernetes metadata watchers after their final metricset owner stops. #52028 #51833

Fixes
All
- Fix unknown type for map[string]string in otelmap. #52464
Filebeat
- Fix offset commits when using multiline in Journald and Kafka inputs. #52342 #51981
Heartbeat
- Bake Synthetics browser binaries into the Heartbeat Docker image. #52443 #52439
Libbeat
- Prevent stale autodiscover resources after Kubernetes leadership changes. #52425
Metricbeat
- Fix Azure module authentication on sovereign clouds (Government, China). #52432

Features and enhancements
All
- Use native Go for Linux FIPS builds. #51345
Filebeat
- Add sign-in activity enrichment for Azure AD users via enrich_with: sign_in_activity. #51390
- Optimize filestream logger performance. #50118
- Add an input_type resource attribute to CEL input OTel metrics for consistent filtering across custom and HTTP client metrics. #50645
- Add consumer-group and network timeout options to the Filebeat Kafka input. #51173 #51172
- Upgrade github.com/elastic/go-lumber to v0.2.0. #51518
- Add a configurable retry policy to the Azure Blob Storage input. #51701 #44629
- Add group_instance_id (KIP-345 static group membership) to the Filebeat Kafka input. #51772 #51768
Heartbeat
- Remove unsupported ciphers for FIPS mode. #51326
Fixes
All
- Fix goroutine leak when processor construction fails. #51687
- Fix data races in the add_docker_metadata cache initialization. #51688
- Close Beat processors on Beat OTel processor shutdown to avoid leaking resources on collector reloads. #51743
- Update elastic-agent-libs to v0.46.1. #51921
Fixed an issue where malformed TLS keys could be printed in the error logs during loading failures.
Auditbeat
- Fix data races in the backoff accounting of the add_session_metadata processor's kernel_tracing provider. #51745
Elastic agent
- Fix data race in the elasticsearch_storage OTel extension. #51501
- Fix registry corruption issue with multiple metricbeat receivers. #51591 #15154
Filebeat
- Filestream now defers shutdown until it reaches EOF or a configurable timeout. The new read_until_eof option (enabled by default) lets you opt out. #50324 #40447
- Fix DPoP resource client signing method assignment in CEL and HTTP JSON input. #51433
- Validate CrowdStrike streaming resource URL origins against the configured discover URL. #51435
- Use constant-time comparison for http_endpoint basic auth and secret header validation. #51436
- Validate that HTTPJSON pagination URLs share the configured request URL origin. #51437
- Fix Filebeat duplicating events after a normal shutdown caused by a race in the registrar. #51517
- Avoid slice-bounds panic when sorting copytruncate rotated files by date. #51570
- Fix type loss in HTTP JSON template transform handling. #51593
- Fix filestream data loss when a harvester closes before ingesting any data. #51675
- Fix CrowdStrike streaming input retry cap so max_attempts and infinite_retries are honoured. #51712
- Fix winlog input crash and event loss during shutdown. #51728
- Make the CrowdStrike streaming input self-heal from transient discover failures. #51737
- Prevent Filebeat startup failure when meta.json is left empty after migration. #51791
- Synchronize Filebeat Run and Shutdown functions. #51800
- Fix aws-s3 input not performing backup_to_bucket and delete_after_backup in polling mode. #49734 #46672
- Fix goroutine leak in request trace logging infrastructure. #51950
Libbeat
- Fix a data race in the rate_limit processor when configured with fields and run concurrently. #51736
- Fix a startup data race in the add_kubernetes_metadata processor. #51739
- Prevent statestore startup failure when meta.json is left empty after an unclean shutdown. #51897
Metricbeat
- Fix a race condition during metricset closure. #50834
- Fix missing state_service and state_storageclass events when kube-state-metrics denylists *_created. #51255 #34074
Osquerybeat
- Fix a rare crash when Osquery restarts after a configuration change. #51520
- Emit pack_name and query_name in Osquerybeat scheduled query results. #51781
Packetbeat
- Load the Npcap wpcap.dll lazily to avoid blocking Npcap upgrades on Windows. #51716 #14517

This release also includes: Deprecations.
Features and enhancements
All
- Migrate from the deprecated github.com/docker/docker module to the github.com/moby/moby split modules. #50300
Beats
- Allow TLS certificate and CA hot-reload without restarting. #50444
Metricbeat
- Add data_stream field alongside aliases in cat_shards for the Metricbeat autoops_es module.
Fixes
All
- Upgrade Go to v1.26.4.
Beats
- Disable TLS certificate hot-reload by default on patch branches. #51104
- Fix panic in the Elastic Agent V2 manager when reloading with no output unit.
Elastic agent
- Fix Beat receivers adding .0 to whole floating point numbers when encoding to JSON. #14610
Filebeat
- Fix request tracer path validation for the cel, httpjson, http_endpoint, and entityanalytics inputs when Filebeat runs as an OTel receiver. #50581
- Fix goroutine leak in filestream task group. #50839 #50824
- Fix Okta entity analytics OAuth2 jwk_json token refresh failure. #50949
- Cache Okta OAuth2 token in cel and httpjson to avoid unnecessary JWT regeneration.
- Fix WebSocket reconnect loop ignoring context cancellation with infinite retries.
- Fix filestream registry leak on file renames.
- Fix WebSocket input hanging on shutdown when server stalls and keep_alive is disabled.
- Fix handling of User-Agent header when using OAuth 2.0 authentication.
- Guard event.original rename in Azure module ingest pipelines to prevent a "field already exists" error when the field is pre-populated. #51271
Libbeat
- Fix bulk indexing failures that could occur when using the Elasticsearch output with some non-Elastic backends. #49557
- Fix a data race in the add_cloud_metadata processor when fetching metadata from multiple providers concurrently.
Metricbeat
- Clamp autoops_es *_latency_in_millis metrics to the sampling interval so a single-sample latency can never exceed the wall-clock time between samples. #50688
Osquerybeat
- Respect Osquery pack query platform filters for Live Query actions. #50585
Winlogbeat
- Treat RPC_S_UNKNOWN_IF (1717) as a recoverable error so Winlogbeat reopens the event log session instead of exiting on this transient RPC error.
- Fix Winlogbeat record ID gap retries reopening from stale checkpoints.
- Fix winlog XML rendering on Windows arm64.

Features and enhancements
Filebeat
- Match http.ServeMux redirect status code for path cleaning in http_endpoint mux. #50686
Libbeat
- Update ebpfevents to v0.9.0. #50609
Metricbeat
- Add failure_store metric to the stats metricset in the Beat module. #49452
- Add elasticsearch/security_stats metricset to the Elasticsearch module. #50674
- Migrate azure/app_insights metricset off the deprecated track-1 Azure SDK and go-autorest, and use azcore directly. #50392
Fixes
All
- Initialize disk queue frame IDs from persisted state. #50534
- Fix race in pipeline client between Publish and Close that could skip waiting for events to be acknowledged. #50625 #49390
Auditbeat
- Release the bolt file lock when the last datastore bucket is closed. #50386 #50381
Filebeat
- Fix token refresh for jwk_pem/jwk_file in the cel, httpjson, and okta inputs. #50433 #50426
- Accept string values for secret_state to support Fleet secret resolution. #50508
- Respect max_bytes/message_max_bytes when reading the first chunk of CRI partial lines. #50552
- When Filestream is migrating the registry key from inputs that did not have an ID, match files by path and file identity instead of only path. #50599
- Fixes UDP input crashes on Windows when oversized datagrams are received. #50770 #50718
- Make CrowdStrike streaming input cancel refresh goroutines on session reconnect. #50803
Heartbeat
- Upgrade npm to v11 in non-wolfi Heartbeat Docker images. #50598
Metricbeat
- Fix panic in Azure module when all configured resources match no Azure resources. #50498
- Elasticsearch module cluster state requests no longer append local=true. #50723 #50722

Features and enhancements
Libbeat
- Cache add_locale processor and refresh only when zone or offset changes. #50343 #50322
Fixes
All
- Update go-ntlmssp to v0.1.1. #50497
- Fix a deadlock between shutdown and metrics collection in the OpenTelemetry telemetry bridge. #50528
- Fix OTel Beat processor to honor when conditions. #50555 #50549
Filebeat
- Fix a race condition during multiline parser shutdown. #49980
- Fix Okta entity analytics OAuth2 config unpacking for jwk_json and jwk_pem fields. #50406
- Fix Active Directory entity analytics to emit device attributes under activedirectory.device. #50472 #50471
- Fix handling of OAuth2.0 timeouts in CrowdStrike streaming input. #50492 #49988
Libbeat
- Fix OTel map conversion for []time.Duration fields to avoid dropping duration slices. #50486 #50474
Winlogbeat
- Fix Long.decode failures in the Painless script for the Windows security ingest pipeline. #49869
- Disable Winlogbeat record ID gap detection when using xml_query so filtered queries do not loop on non-contiguous record IDs. #50443

Features and enhancements
All
- Export all Beat receiver metrics to OTel telemetry. #49300
- Add add_agent_metadata processor to inject agent metadata efficiently. #49667
- Update OTel Collector components to v0.149.0/v1.55.0. #50057
Elastic agent
- Logstash exporter now reports accurate error status to EDOT. #49169
Filebeat
- Add a lexicographical polling mode to the AWS-S3 input. #48310 #47926
- Optimize opening files in filestream for better performance. #48506
- Instruments the CEL input with OpenTelemetry tracing. #48440
- Add ES state store routing for lexicographical mode. #48944
- Add an experimental bbolt-based registry backend for Filebeat. #48879
- Add MFA enrichment support to the azure-ad entity analytics provider. #49843
- Add a querylog fileset to the Filebeat elasticsearch module for NDJSON query logs. #49914 #43622
- Optimize filestream to allocate less memory when applying include/exclude line filters. #49013
- Add capacity to collect empty Active Directory groups to entity analytics input. #49093
- Add input redirection support through a new Redirector mechanism. #49613
- Allow HTTP JSON input redirection to the CEL input. #49614
- Update mito CEL library to v1.25.1 and cel-go runtime to v0.27.0. #49683
- Add perms enrichment option to the Okta entity analytics provider to collect permissions for custom roles. #49805 #49779
- Add a devices enrichment option to the Okta entity analytics provider. #49813 #49780
- Add a supervises enrichment option to the Okta entity analytics provider. #49825 #49781
Filebeat, metricbeat
- Add NewFactoryWithSettings for Beat receivers to provide default home and path directories. #49327 #11734
Heartbeat
- Add custom policy hashing and live-update functionality to integrations, allowing parameters to be updated without restarting the monitor. #49326 #47511
Metricbeat
- Add cursor-based incremental data fetching to the SQL module query metricset. #48722
- Add switchport_statuses config option to filter Meraki switchports by status. #47993
- Add the subexpiry field to the Redis INFO Keyspace (Redis ≥ 7.4). #47971 #26555
- Add Redis 6.0/7.0 info fields and deprecate used_memory_lua. #48246
- Add state field to IPSec tunnel metrics in panw module. #48403
- Map Docker network metrics to different types for better usability. #47792
- Add observer.hostname field to panw module. #48825
- Bump azure-sdk-for-go armmonitor from v0.8.0 to v0.11.0. #49866
Osquerybeat
- Add an elastic_jumplists table to the Osquery extension. #47759
- Add a code generator for creating typed Go packages from YAML table/view specifications. #48533
- Add automatic jumplists to the elastic_jumplists table. #48032
- Add elastic_host_processes and elastic_host_users tables and host_processes and host_users views. #48794
- Add optional query profiling for scheduled and live Osquery runs. #49514
- Updates Osquerybeat filters to avoid reliance on type assertion. #48540
- Allow for passing of osqueryd client to extension tables. #48544
- Improve gentables and add elastic_browser_history specification with registry integration. #48733
- Migrate elastic_file_analysis table to Osquery table specification and a dedicated package. #48774
- Add elastic_host_groups table, host_groups view, and default view hooks in generator. #48775
- Add amcache table, view specifications and generated tables/view for Osquery extension. #48802
- Add native scheduled query metadata and schedule_id correlation fields. #49040
- Add elastic_jumplists specification integration and harden Osquerybeat generation workflow. #49058
- Add support for per-platform custom osqueryd artifact install in Osquerybeat. #49306 #48955
Fixes
Agentbeat
- Update transient dependency github.com/go-jose/go-jose/v4 to v4.1.4. #49975
All
- Update Go to v1.25.9. #50049
- Bump aws-sdk-go-v2/service/cloudwatchlogs to v1.65.0 to fix GHSA-xmrv-pmrh-hhx2. #50215
Filebeat
- Support abuse.ch auth key usage in the Threat Intel module. #45212 #45206
- Fix max_body_bytes setting 

Features and enhancements
All
- Update OTel Collector components to v0.149.0/v1.55.0. #50057
Metricbeat
- Bump azure-sdk-for-go armmonitor from v0.8.0 to v0.11.0. #49866
Fixes
Agentbeat
- Update transient dependency github.com/go-jose/go-jose/v4 to v4.1.4. #49975
Filebeat
- Fix http_endpoint input shared server lifecycle causing joiner deadlock and creator killing unrelated inputs. #49415
Decouple the shared HTTP server lifetime from any single input. Previously, the server context was derived from the creator input, so cancelling a joiner blocked forever (deadlock) and cancelling the creator shut down all inputs on the same port. The server now lives until the last input deregisters.
- Fix container input not respecting max bytes when parsing CRI partial lines. #49743 #49259
- Fix CSV decoder producing malformed JSON when field values contain double quotes in azure-blob-storage input. #50097
The azure-blob-storage input's decode path only matched the decoder.Decoder interface, which builds JSON via string concatenation without escaping field values. CSV values containing double quotes (e.g. RFC 2045 MIME type parameters) produce malformed JSON, causing downstream ingest pipeline failures. Add a decoder.ValueDecoder switch case which uses json.Marshal for correct escaping, matching the pattern already used by the GCS input.
- Fix conflicting CEL periodic OTel metric field names. #50135 #49180
Rename the CEL periodic run counter from input.cel.periodic.run to input.cel.periodic.run.count so the run namespace stays consistent alongside input.cel.periodic.run.duration in Elasticsearch mappings. Also correct related metric documentation and instrument creation error messages.
- Update mito to v1.24.2, fixing runtime error location reporting. #50222

Features and enhancements
All
- Update OTel Collector components to v0.148.0. #49578
Filebeat
- Add retry back-off logic to streaming input CrowdStrike follower. #48542 #46072
- Add secret_state config to CEL input for encrypted storage of secrets accessible as state.secret. #49207
Add a secret_state configuration field to the CEL input. When configured in a Fleet integration package with secret: true, the values are stored encrypted by Fleet. At runtime, the contents are placed at state.secret and unconditionally redacted in debug logs. The key secret in the plain-text state configuration is reserved and rejected by validation to prevent accidental unencrypted storage of values intended to be secret.
- Allow string and number arrays in httpjson chained configurations. #49391 #16662
- Add support for URL and URL query parsing and formatting in the Streaming input CEL environment. #49653 #17875
Metricbeat
- Add client secret authentication support to Azure App Insights module. #48880
Fixes
Elastic Agent
- Fix an issue that could delay reporting shutdown of Agent components. #49414 #49388
- Reduce AutoOps logging from info to debug for polling. #49507 #49506
Filebeat
- Fix Filestream take_over causing file re-ingestion when used with autodiscover. #49632 #49579
- Fix compatibility of the Journald input with journald/systemd versions < 242. #49445 #48152
- Add rate-limit backoff to CrowdStrike streaming input oauth2 transport. #49453
Wrap the oauth2 HTTP transport used by the CrowdStrike falcon streaming input with a rate-limit-aware transport that intercepts 429 responses, reads the Retry-After header, and backs off before retrying. This prevents the oauth2 token refresh from generating a burst of unauthorized requests that triggers CrowdStrike's 15-per-minute rate limit. The discover endpoint also returns a retry-after hint to the session-level retry loop as a minimum wait floor.
- Skip request tracer path validation when tracing is disabled to prevent input startup failures. #49655
The startup path validation in cel, httpjson, http_endpoint, and entity analytics inputs checked whether the tracer config struct was non-nil rather than whether tracing was enabled. Integration package templates always include a tracer block (with enabled defaulting to false), so the struct is never nil. Under the agentless/otel runtime the relative tracer path resolves outside the permitted directory, causing all affected inputs to fail immediately even though tracing was disabled. The config-level Validate methods already used the correct enabled() guard; the startup paths now do the same.
- Fix Filebeat crash loop when running under Elastic Agent and taking too long to initialise. #49796 #49512
Libbeat
- Fix a bug where escaped characters in syslog structured data caused an EOF error. #49392 #43944
Metricbeat
- Fix unnecessary Windows filesystem metricset errors from non-existent volumes. #49553
Fix an issue where filesystem metric collection on Windows could report errors for volumes that are no longer present. Update to gosigar v0.14.4.
Winlogbeat
- Skip record ID gap detection for forwarded Windows events. #49819

Features and enhancements
Elastic Agent
- Fix a bug that could report stopped inputs as still running. #49285 #47769
Filebeat
- Add optional token_url support for JWT Bearer Flow in Salesforce input. #43933 #43963
The Salesforce input now supports a separate token_url configuration for JWT Bearer Flow authentication. This allows users with custom Salesforce domains or restrictions on default endpoints (login.salesforce.com/test.salesforce.com) to specify a different token endpoint URL while keeping the audience URL separate. If token_url is not provided, the existing behavior of using the audience URL as the token endpoint is maintained.
- Empty files are excluded from processing in filestream as early as possible. #49196 #48891
Metricbeat
- Add zswap compressed swap cache metrics to system memory metricset. #49098 #47605
- Add Elasticsearch index mode and codec settings in Metricbeat index stats module. #49237
- Add cgroupv2 CPU metrics to system.process dataset. #49098 #47708
- Add swap field to system.process.memory metric set in Metricbeat. #48334
- Add new TBS metrics to monitor mappings. #48432
- Add a config to improve wildcard handling to report actual object names. #48644 #48502
- Read Kibana status response body on 503 so monitoring captures the reason for outage. #48913
Packetbeat
- Improves resiliency of the AMQP parser against invalid or corrupt data frames. #48033
- Bump bundled Windows Npcap OEM installer to v1.87. #49167
Winlogbeat
- Move winlog filtering to Go-side evaluation and harden recovery paths. #49257
Winlogbeat and Filebeat winlog input now subscribe with unfiltered queries for non-custom configurations and apply ignore_older, provider, event_id, and level filtering in code. This avoids unreliable Windows query-filter behavior in affected environments while preserving custom xml_query passthrough. The change also improves read/iterator recovery behavior, keeps final-batch publish semantics on EOF, and adds a retry circuit-breaker for persistent render failures without partial events.
Fixes
All
- Update elastic-agent-system-metrics to v0.14.0. #48816
- Update elastic-agent-autodiscover to v0.10.2. #48817
- Update elastic-agent-libs to v0.32.2. #48857
- Update OpenTelemetry SDK to v1.40.0. #49126
- Improve append processor behavior when merging values and removing duplicates. #49021 #49020
The append processor now appends values more consistently, avoiding nested entries in the target field. Duplicate removal is also more reliable, reducing processing errors and keeping output stable.
- Kafka client will avoid having more than a single metadata request to each broker in-flight at any given time. #49307 #49210
Beatreceiver
- Fix reporting of beatreceiver 30s metrics. #49236
Filebeat
- Improve in-flight byte accounting in the HTTP Endpoint input. #48571 #48456
- Honor non-fingerprint file_identity defaults in filestream. #48579
- Fix handling of Crowdstrike streaming input state in retryable errors. #49077 #49076
- Fix incremental group updates in Active Directory entity analytics provider. #49089 #49053
- Demote missing user/device state lookup to debug log in Azure entity analytics provider. #49127 #36447
- Fix CrowdStrike streaming session refresh scheduling to avoid tight refresh loops. #49175 #49158
Metricbeat
- Update transient dependency filippo.io/edwards25519 to v1.1.1. #49070
Osquerybeat
- Update osquery-go dependency to v0.0.0-20260226222546-0cc22f415e57. #49280
Winlogbeat
- Restore suppression of repeated channel-not-found open errors in Winlogbeat eventlog runner. #48999 #48979
Reintroduces channel-not-found retry log suppression that was lost during the eventlog runner refactor. The first channel-not-found open error is logged at WARN, subsequent retries are logged at DEBUG, and the suppression state is reset after a successful open. This prevents repeated WARN/ERROR log noise when a configured channel is missing.

Features and enhancements
Filebeat
- Add support for managed identity authentication to the azure-eventhub input. #48655 #48680
- Improve log path sanitization for request trace logging. #48719
- Add descriptions and units to CEL input OpenTelemetry metrics. #48684
- Don't print warning about small files on each file system scan. #48704 #45642
- Allow the configuration of OTLP histogram aggregation through the OTEL_EXPORTER_OTLP_METRICS_DEFAULT_HISTOGRAM_AGGREGATION environment variable in CEL input. #48731 #48730
- Tighten request trace logging destination path checks in CEL, Entity Analytics, HTTP Endpoint and HTTP JSON inputs. #48863
Fixes
All
- Updates the translate_ldap_attribute processor discovery to try both LDAP and LDAPS per host, starting with LDAPS. #48818
Elastic Agent
- Fix a bug which could report an invalid number of active otelconsumer events. #48720 #12515
Filebeat
- Enforce region configuration when non_aws_bucket_name is defined for the awss3 input. #48534 #47847
- Fix Log to Filestream state migration removing states from non-harvested files. #48570
- Fix CEL input incorrectly counting degraded program runs as successful executions in OpenTelemetry metrics. #48734 #48714
- Fix Active Directory Entity Analytics to resolve nested group membership and escape Base DN filter values. #48815
- Fix Entity Analytics Okta OAuth2 token requests ignoring custom TLS/SSL configuration. #48866
- Fix an issue where the azure-blob-storage input was failing with the Storage Blob Data Reader RBAC role. #48886 #48890
Filebeat, Metricbeat
- Add 30s metric logging to Beat receivers. #48541
Heartbeat
- Add a missing dependency for Synthetics on Wolfi Docker image. #48569
Libbeat
- Add SSPI bind timeout and document Windows account requirements for the translate_ldap_attribute processor. #48444
- Fix otelconsumer logging hundreds of errors per second when queue is full. #48807 #48803
Osquerybeat
- Fix differential results using wrong data source for removed events. #48438 #48427
Packetbeat
- Refactor the DHCPv4 parsers and fix parsing issues. The DHCP router field is now a list, as is specified in RFC2132. #48414
- Fix procfs network parsers. #48428
- Fix a panic in the Thrift struct parser triggered by malformed packets. #48498
- Add array access checks to SIP parser. #48514
- Fix potential array access panics and infinite loops in PostgreSQL parser. #48528
- Clean up int overflows and array access issues in MySQL parsers. #48543
- Add int overflow checks to the http parser. #48563

This release also includes: Deprecations.
Features and enhancements
All
- Introduce cloud connectors flow. #47587
- Make beats receivers emit status for their subcomponents. #48015
- Add GUID translation, base DN inference, and SSPI authentication to LDAP processor. #47827
- Add events.failure_store metric to track events sent to Elasticsearch failure store. #48068 #47164
Filebeat
- Add support for direct HTTP request rate limit setting in CEL input. #46953
- Allow adding file owner and group to the events' meta fields on Unix systems. #47331 #43226
- Add AWS auth method for CEL and HTTP JSON inputs. #47260
- Add client secret authentication method for Azure Event Hub and storage in Filebeat. #47256
- Add client address and name to submitted Redis slowlogs. #41507
- Log unpublished event count and exit publish loop on input context cancellation. #47730
- Upgrade CEL mito library version to v1.24.0. #47762
- Add OTEL metrics to CEL inputs. #47014
- Improve input error reporting to Elastic Agent, specially when pipeline configurations are incorrect. #47905 #45649
- Azure EventHub input v2 - Add support for AMQP over WebSocket and HTTPS proxy. #47956 #47823
- The Journald input now supports setting a chroot to use when calling the journalctl binary, thus allowing the journald input to be used with the wolfi container variant and in environments where the host's Journald is not compatible with the journalctl version shipped with the container. . #48008 #47164
Add support in the journald inpur for using chroot when calling journalctl. In a container environment this allows to mount the host file system into the container and use its journalctl, which prevents any sort of incompatibility between the journalctl in the container image and the host Journald. Allows using the journald input with Wolfi based Docker containers.
- GZIP support is GA and always enabled on filestream. #47893 #47880
Ingesting GZIP-compressed files is now GA. The gzip_experimental configuration option has been deprecated. Users should use compression instead. Refer to the documentation for more details.
- Filebeat deploy on kubernetes examples use compression instead of gzip_experimental. #48079 #47882
- Add file-based auth provider for CEL and HTTP JSON inputs. #47507 #47506
The CEL and HTTP JSON inputs now support reading authentication tokens from files, enabling integration with various secret providers like Vault, Kubernetes secret projections, etc. Tokens are automatically refreshed based on a configurable interval without requiring restarts.
Metricbeat
- Change calculation of CPU/Memory for Kubernetes to allocatable values. #47815
Update kubernetes cpu and memory metrics to use allocatable values instead of capacity values.
- Add extra debug logging to simplify troubleshooting in prometheus module. #47477 #15693
- Add resource pool id to vsphere cluster metricset. #47883
- Add last_terminated_exitcode to kubernetes.container.status. #47968
- Report memory pressure stall information (PSI) for cgroup v2. #48054
Add memory PSI metrics to system.process.cgroup, complementing existing CPU and IO pressure metrics for cgroupv2.
Osquerybeat
- Add browser_history table to Osquery extension for cross-platform browser history analysis. #47117
- Add amcache hive support for osquery extension in Windows. #46996
- Add status reporting for osquerybeat lifecycle and osqueryd management. #47472
- Add osqueryd process health monitoring with metrics exposed via beats monitoring endpoint. #47474
- Upgrade osquery version to 5.19.0. #48040
- Add record filtering/scoping support to the osquery extension. #47396
- Update documentation for the amcache tables in the osquery extension. #47748
- Add marshalling support for embedded structs in the osquery extension. #47746
- Update column definition encoding to support embedded structs. #47758
Packetbeat
- Add status reporter interface to packetbeat. #45732
Winlogbeat
- Add 'process.args_count' to winlogbeat windows security inges

Features and enhancements
Filebeat
- Add client secret authentication method for Azure Event Hub and storage in Filebeat. #47256
- Add support for AMQP-over-WebSocket transport in the processor v2. #47956 #47823
Metricbeat
- Add last_terminated_exitcode to kubernetes.container.status. #47968
Fixes
All
- Upgrade opentelemtry-collector-contrib to 0.141.0 and opentelemetry-collector to 1.47.0. #48122
- Add msync syscall to seccomp whitelist for BadgerDB persistent cache. #48229
Metricbeat
- Harden Prometheus metrics parser against panics caused by malformed input data. #47914
- Add bounds checking to Zookeeper server module to prevent index-out-of-range panics. #47915
- Fix panic in graphite server metricset when metric has fewer parts than template expects. #47916
- Skip regions with no permission to query for AWS CloudWatch metrics. #48135
Packetbeat
- Fix bounds checking in MongoDB protocol parser to prevent panics. #47925

Features and enhancements
All
- Make beats receivers emit status for their subcomponents. #48015
- Add GUID translation, base DN inference, and SSPI authentication to LDAP processor. #47827
Filebeat
- Log unpublished event count and exit publish loop on input context cancellation. #47730 #47717
- Improving input error reporting to Elastic Agent, specially when pipeline configurations are incorrect. #47905 #45649
Metricbeat
- K8s_container_allocatable. #47815 #40701
Updates kubernetes cpu and memory metrics to use allocatable values instead of capacity values.
- Add resource pool id to vsphere cluster metricset. #47883
Packetbeat
- Ipfrag2. #47970
Fixes
Filebeat
- Prevent panic during startup if dissect processor has invalid field name in tokenizer. #47839
Metricbeat
- Improve defensive checks to prevent panics in meraki module. #47950
- Remove GCP Billing timestamp functions. #47963 #47967
Packetbeat
- Rpc_fragment_sanitization. #47803
- Verify and cap memcache udp fragment counts. #47874

This release also includes: Breaking changes.
Features and enhancements
All
- Include whether Beat is running from a FIPS distribution in User Agent. #47409
Filebeat
- Add support for DPoP authentication for the CEL and HTTP JSON inputs. #47441
- Improve logging of cache processor and add ignore failure option. #47565
Fixes
All
- Fix a fatal startup error in Beats Receivers caused by truncation of long UTF-8 hostnames. #47713
- Not being able to start the add_docker_metadata processor is now consistently a non-fatal error when Docker is not available. #47760
Filebeat
- [Filestream] Ensure harvester always restarts if the file has not been fully ingested. #47107 #46923
- Handle and remove BOM during JSON parsing in Azure Blob Storage and GCS inputs. #47508
- Fix an issue where Filebeat could hang during shutdown when using the filestream input. #47518
- Fix double locking in translate_ldap_attribute processor and improve logging. #47585
- Fix possible data corruption in TCP, Syslog and Unix inputs. #47618
- Skip AWS S3 test events in Filebeat AWS S3 input. #47635
Metricbeat
- [Cloud Connect] Use cluster.metadata.display_name as cluster name if set. #47440

Features and enhancements
Filebeat
- Add data stream identification to Fleet health status updates. #47229
Metricbeat
- Enhance GCP Billing metricset with additional fields. #47059
Fixes
All
- Add close to conditional processors if underlying processors have a close method. #46653 #46575
- Fix a bug where Kerberos authentication could be disabled when server supports multiple authentication types. #47444 #47443 #47110
Filebeat
- Fix potential Filebeat panic during memory queue shutdown. #47248

Features and enhancements
Affecting all Beats
- Update Go version to v1.24.3. 44270
Filebeat
- Add support for collecting device entities in the Active Directory entity analytics provider. 44309
- The add_cloudfoundry_metadata processor now uses xxhash instead of SHA1 for sanitizing persistent cache filenames. Existing users will experience a one-time cache invalidation as the cache store will be recreated with the new filename format. 43964
Metricbeat
- Add checks for the Resty response object in all Meraki module API calls to ensure proper handling of nil responses. 44193
- Add a latency configuration option to the Azure Monitor module. 44366
Osquerybeat
- Update osquery version to v5.15.0. 43426
Fixes
Affecting all Beats
- Fix the 'add_cloud_metadata' processor to better support custom certificate bundles by improving how the AWS provider HTTP client is overridden. 44189
Auditbeat
- Fix a potential error in the system/package component that could occur during internal package database schema migration. 44294 44296
Filebeat
- Fix endpoint path typo in the Okta entity analytics provider. 44147
- Fix a WebSocket panic scenario that occured after exhausting the maximum number of retries. 44342
Metricbeat
- Add AWS OwningAccount support for cross-account monitoring. 40570 40691
- Use namespace for GetListMetrics calls in AWS when available. 41022
- Limit index stats collection to cluster-level summaries. 36019 42901
- Omit tier_preference, creation_date and version fields in output documents when not pulled from source indices. 43637
- Add support for _nodes/stats URIs compatible with legacy Elasticsearch versions. 44307
9.0.1
Features and enhancements
- For all Beats: Publish cloud.availability_zone by add_cloud_metadata processor in Azure environments. #42601 #43618
- Add pagination batch size support to Entity Analytics input's Okta provider in Filebeat. #43655
- Update CEL mito extensions version to v1.19.0 in Filebeat. #44098
- Upgrade node version to latest LTS v18.20.7 in Heartbeat. #43511
- Add enable_batch_api option in Azure monitor to allow metrics collection of multiple resources using Azure batch API in Metricbeat. #41790
Fixes
- For all Beats: Handle permission errors while collecting data from Windows services and don't interrupt the overall collection by skipping affected services. #40765 #43665.
- Fixed WebSocket input panic on sudden network error or server crash in Filebeat. #44063 44068.
- [Filestream] Log the "reader closed" message on the debug level to avoid log spam in Filebeat. #44051
- Fix links to CEL mito extension functions in input documentation in Filebeat. #44098
9.0.0
Features and enhancements
- Improves logging in system/socket in Auditbeat. #41571
- Adds out of the box support for Amazon EventBridge notifications over SQS to S3 input in Filebeat. #40006
- Update CEL mito extensions to v1.16.0 in Filebeat. #41727
- Filebeat's registry is now added to the Elastic-Agent diagnostics bundle. #33238 and #41795
- Adds unifiedlogs input for MacOS in Filebeat. #41791
- Adds evaluation state dump debugging option to CEL input in Filebeat. #41335
- Rate limiting operability improvements in the Okta provider of the Entity Analytics input in Filebeat. #40106 and #41977
- Rate limiting fault tolerance improvements in the Okta provider of the Entity Analytics input in Filebeat. #40106 #42094
- Introduces ignore older and start timestamp filters for AWS S3 input in Filebeat. #41804
- Journald input now can report its status to Elastic-Agent in Filebeat. #39791 and #42462
- Publish events progressively in the Okta provider of the Entity Analytics input in Filebeat. #40106 and #42567
- Journald include_matches.match now accepts + to represent a logical disjunction (OR) in Filebeat. #40185 and #42517
- The journald input is now generally available in Filebeat. #42107
- Adds support for RFC7231 methods to HTTP monitors in Heartbeat. #41975
- Adds use_kubeadm config option in kubernetes module in order to toggle ku

Features and enhancements
- For all Beats: Publish cloud.availability_zone by add_cloud_metadata processor in Azure environments. #42601 #43618
- Add pagination batch size support to Entity Analytics input's Okta provider in Filebeat. #43655
- Update CEL mito extensions version to v1.19.0 in Filebeat. #44098
- Upgrade node version to latest LTS v18.20.7 in Heartbeat. #43511
- Add enable_batch_api option in Azure monitor to allow metrics collection of multiple resources using Azure batch API in Metricbeat. #41790
Fixes
- For all Beats: Handle permission errors while collecting data from Windows services and don't interrupt the overall collection by skipping affected services. #40765 #43665.
- Fixed websocket input panic on sudden network error or server crash in Filebeat. #44063 44068.
- [Filestream] Log the "reader closed" message on the debug level to avoid log spam in Filebeat. #44051
- Fix links to CEL mito extension functions in input documentation in Filebeat. #44098
9.0.0
Features and enhancements
- Improves logging in system/socket in Auditbeat. #41571
- Adds out of the box support for Amazon EventBridge notifications over SQS to S3 input in Filebeat. #40006
- Update CEL mito extensions to v1.16.0 in Filebeat. #41727
- Filebeat's registry is now added to the Elastic-Agent diagnostics bundle. #33238 and #41795
- Adds unifiedlogs input for MacOS in Filebeat. #41791
- Adds evaluation state dump debugging option to CEL input in Filebeat. #41335
- Rate limiting operability improvements in the Okta provider of the Entity Analytics input in Filebeat. #40106 and #41977
- Rate limiting fault tolerance improvements in the Okta provider of the Entity Analytics input in Filebeat. #40106 #42094
- Introduces ignore older and start timestamp filters for AWS S3 input in Filebeat. #41804
- Journald input now can report its status to Elastic-Agent in Filebeat. #39791 and #42462
- Publish events progressively in the Okta provider of the Entity Analytics input in Filebeat. #40106 and #42567
- Journald include_matches.match now accepts + to represent a logical disjunction (OR) in Filebeat. #40185 and #42517
- The journald input is now generally available in Filebeat. #42107
- Adds support for RFC7231 methods to HTTP monitors in Heartbeat. #41975
- Adds use_kubeadm config option in kubernetes module in order to toggle kubeadm-config API requests in Metricbeat. #40086
- Preserve queries for debugging when merge_results: true in SQL module in Metricbeat. #42271
- Collect more fields from ES node/stats metrics and only those that are necessary in Metricbeat. #42421
- Adds benchmark module in Metricbeat. #41801
- Increase maximum query timeout to 24 hours in Osquerybeat. 42356
- Properly set events UserData when experimental API is used in Winlogbeat. #41525
- Include XML is respected for experimental API in Winlogbeat. #41525
- Forwarded events use renderedtext info for experimental API in Winlogbeat. #41525
- Language setting is respected for experimental API in Winlogbeat. #41525
- Language setting also added to decode XML wineventlog processor in Winlogbeat. #41525
- Format embedded messages in the experimental API in Winlogbeat. #41525
- Make the experimental API GA and rename it to winlogbeat-raw in Winlogbeat. #39580 and #41770
- Removes 22 clause limitation in Winlogbeat. #35047 and #42187
- Adds handling for recoverable publisher disabled errorsin Winlogbeat. #35316 and #42187
- Removes Functionbeat binaries from CI pipelines. #40745 and #41506
- Update Go version to 1.24.0. #42705
- Add etw input fallback to attach an already existing session in Filebeat. #42847
- Update CEL mito extensions to v1.17.0 in Filebeat. #42851
- Winlog input in Filebeat cam now report its status to Elastic Agent. #43089
- Add configuration option to limit HTTP Endpoint body size in Filebeat. #43171
- Add a new match_by_parent_instance option to perfmon module in Metricbeat. #43002
- Add a warning log to metricbeat.vsphere in Metricbeat in case vSphere connec

Features and enhancements
- Improves logging in system/socket in Auditbeat. #41571
- Adds out of the box support for Amazon EventBridge notifications over SQS to S3 input in Filebeat. #40006
- Update CEL mito extensions to v1.16.0 in Filebeat. #41727
- Filebeat's registry is now added to the Elastic-Agent diagnostics bundle. #33238 and #41795
- Adds unifiedlogs input for MacOS in Filebeat. #41791
- Adds evaluation state dump debugging option to CEL input in Filebeat. #41335
- Rate limiting operability improvements in the Okta provider of the Entity Analytics input in Filebeat. #40106 and #41977
- Rate limiting fault tolerance improvements in the Okta provider of the Entity Analytics input in Filebeat. #40106 #42094
- Introduces ignore older and start timestamp filters for AWS S3 input in Filebeat. #41804
- Journald input now can report its status to Elastic-Agent in Filebeat. #39791 and #42462
- Publish events progressively in the Okta provider of the Entity Analytics input in Filebeat. #40106 and #42567
- Journald include_matches.match now accepts + to represent a logical disjunction (OR) in Filebeat. #40185 and #42517
- The journald input is now generally available in Filebeat. #42107
- Adds support for RFC7231 methods to HTTP monitors in Heartbeat. #41975
- Adds use_kubeadm config option in kubernetes module in order to toggle kubeadm-config API requests in Metricbeat. #40086
- Preserve queries for debugging when merge_results: true in SQL module in Metricbeat. #42271
- Collect more fields from ES node/stats metrics and only those that are necessary in Metricbeat. #42421
- Adds benchmark module in Metricbeat. #41801
- Increase maximum query timeout to 24 hours in Osquerybeat. 42356
- Properly set events UserData when experimental API is used in Winlogbeat. #41525
- Include XML is respected for experimental API in Winlogbeat. #41525
- Forwarded events use renderedtext info for experimental API in Winlogbeat. #41525
- Language setting is respected for experimental API in Winlogbeat. #41525
- Language setting also added to decode XML wineventlog processor in Winlogbeat. #41525
- Format embedded messages in the experimental API in Winlogbeat. #41525
- Make the experimental API GA and rename it to winlogbeat-raw in Winlogbeat. #39580 and #41770
- Removes 22 clause limitation in Winlogbeat. #35047 and #42187
- Adds handling for recoverable publisher disabled errorsin Winlogbeat. #35316 and #42187
- Removes Functionbeat binaries from CI pipelines. #40745 and #41506
- Update Go version to 1.24.0. #42705
- Add etw input fallback to attach an already existing session in Filebeat. #42847
- Update CEL mito extensions to v1.17.0 in Filebeat. #42851
- Winlog input in Filebeat cam now report its status to Elastic Agent. #43089
- Add configuration option to limit HTTP Endpoint body size in Filebeat. #43171
- Add a new match_by_parent_instance option to perfmon module in Metricbeat. #43002
- Add a warning log to metricbeat.vsphere in Metricbeat in case vSphere connection has been configured as insecure. #43104
Fixes
- hasher: Add a cached hasher for upcoming backend in Auditbeat. #41952
- Split common tty definitions in Auditbeat. #42004
- Redact authorization headers in HTTPJSON debug logs in Filebeat. #41920
- Further rate limiting fix in the Okta provider of the Entity Analytics input in Filebeat. #40106 and #41977
- The _id generation process for S3 events has been updated to incorporate the LastModified field. This enhancement ensures that the _id is unique in Filebeat. #42078
- Fixes truncation of bodies in request tracing by limiting bodies to 10% of the maximum file size in Filebeat. #42327
- [Journald] Fixes handling of journalctl restart. A known symptom was broken multiline messages when there was a restart of journalctl while aggregating the lines in Filebeat. #41331 and #42595
- Fixwa bug where Metricbeat unintentionally triggers Windows ASR in Metricbeat. #42177
- Removes hostname field from ZooKeeper's mntr data stream in Met