You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Performance regression in AWS S3 inputs using SQS notification.
15
+
16
+
In 8.12 the default memory queue flush interval was raised from 1 second to 10 seconds. In many configurations this improves performance because it allows the output to batch more events per round trip, which improves efficiency. However, the SQS input has an extra bottleneck that interacts badly with the new value. For more details see {issue}37754[37754].
17
+
18
+
If you are using the Elasticsearch output, and your output configuration uses a performance preset, switch it to `preset: latency`. If you use no preset or use `preset: custom`, then set `queue.mem.flush.timeout: 1s` in your queue or output configuration.
19
+
20
+
==== Breaking changes
21
+
22
+
*Affecting all Beats*
23
+
24
+
- add_cloud_metadata processor: `huawei` provider is now treated as `openstack`. Huawei cloud runs on OpenStack
25
+
platform, and when viewed from a metadata API standpoint, it is impossible to differentiate it from OpenStack. If you
26
+
know that your deployments run on Huawei Cloud exclusively, and you wish to have `cloud.provider` value as `huawei`,
27
+
you can achieve this by overwriting the value using an `add_fields` processor. {pull}35184[35184]
28
+
29
+
==== Bugfixes
30
+
31
+
*Affecting all Beats*
32
+
33
+
- aws: Add credential caching for `AssumeRole` session tokens. {issue}37787[37787]
34
+
- Lower logging level to debug when attempting to configure beats with unknown fields from autodiscovered events/environments. {pull}[37816][37816]
35
+
36
+
*Filebeat*
37
+
38
+
- Fix nil pointer dereference in the httpjson input. {pull}37591[37591]
Copy file name to clipboardexpand all lines: CHANGELOG.next.asciidoc
+4-78
Original file line number
Diff line number
Diff line change
@@ -10,10 +10,6 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
10
10
11
11
*Affecting all Beats*
12
12
13
-
- add_cloud_metadata processor: `huawei` provider is now treated as `openstack`. Huawei cloud runs on OpenStack
14
-
platform, and when viewed from a metadata API standpoint, it is impossible to differentiate it from OpenStack. If you
15
-
know that your deployments run on Huawei Cloud exclusively, and you wish to have `cloud.provider` value as `huawei`,
16
-
you can achieve this by overwriting the value using an `add_fields` processor. {pull}35184[35184]
17
13
18
14
*Auditbeat*
19
15
@@ -34,7 +30,6 @@ you can achieve this by overwriting the value using an `add_fields` processor. {
34
30
35
31
*Winlogbeat*
36
32
37
-
- Add "event.category" and "event.type" to Sysmon module for EventIDs 8, 9, 19, 20, 27, 28, 255 {pull}35193[35193]
38
33
39
34
*Functionbeat*
40
35
@@ -45,64 +40,19 @@ you can achieve this by overwriting the value using an `add_fields` processor. {
45
40
==== Bugfixes
46
41
47
42
*Affecting all Beats*
48
-
- Support for multiline zookeeper logs {issue}2496[2496]
49
-
- Add checks to ensure reloading of units if the configuration actually changed. {pull}34346[34346]
50
-
- Fix namespacing on self-monitoring {pull}32336[32336]
51
-
- Fix namespacing on self-monitoring {pull}32336[32336]
52
-
- Fix Beats started by agent do not respect the allow_older_versions: true configuration flag {issue}34227[34227] {pull}34964[34964]
53
-
- Fix performance issues when we have a lot of inputs starting and stopping by allowing to disable global processors under fleet. {issue}35000[35000] {pull}35031[35031]
54
-
- 'add_cloud_metadata' processor - add cloud.region field for GCE cloud provider
55
-
- 'add_cloud_metadata' processor - update azure metadata api version to get missing `cloud.account.id` field
56
-
- Upgraded apache arrow library used in x-pack/libbeat/reader/parquet from v11 to v12.0.1 in order to fix cross-compilation issues {pull}35640[35640]
57
-
- Fix panic when MaxRetryInterval is specified, but RetryInterval is not {pull}35820[35820]
58
-
- Support build of projects outside of beats directory {pull}36126[36126]
59
-
- aws: Add credential caching for `AssumeRole` session tokens. {issue}37787[37787]
60
-
- Lower logging level to debug when attempting to configure beats with unknown fields from autodiscovered events/environments {pull}[37816][37816]
61
-
- Set timeout of 1 minute for FQDN requests {pull}37756[37756]
43
+
62
44
63
45
*Auditbeat*
64
46
65
47
66
48
*Filebeat*
67
49
68
-
- Fix nil pointer dereference in the httpjson input {pull}37591[37591]
- Fix the ignore_inactive option being ignored in Filebeat's filestream input {pull}34770[34770]
71
-
- Fix TestMultiEventForEOFRetryHandlerInput unit test of CometD input {pull}34903[34903]
72
-
- Add input instance id to request trace filename for httpjson and cel inputs {pull}35024[35024]
73
-
- Fixes "Can only start an input when all related states are finished" error when running under Elastic-Agent {pull}35250[35250] {issue}33653[33653]
74
-
- [system] sync system/auth dataset with system integration 1.29.0. {pull}35581[35581]
75
-
- [GCS Input] - Fixed an issue where bucket_timeout was being applied to the entire bucket poll interval and not individual bucket object read operations. Fixed a map write concurrency issue arising from data races when using a high number of workers. Fixed the flaky tests that were present in the GCS test suit. {pull}35605[35605]
76
-
- Fixed concurrency and flakey tests issue in azure blob storage input. {issue}35983[35983] {pull}36124[36124]
77
-
- Fix panic when sqs input metrics getter is invoked {pull}36101[36101] {issue}36077[36077]
78
-
- Fix handling of Juniper SRX structured data when there is no leading junos element. {issue}36270[36270] {pull}36308[36308]
79
-
- Fix Filebeat Cisco module with missing escape character {issue}36325[36325] {pull}36326[36326]
80
-
- Added a fix for Crowdstrike pipeline handling process arrays {pull}36496[36496]
0 commit comments