Skip to content

Commit eb204df

Browse files
v1vv1v
authored
Merge branch 'master' into feature/use-arch-in-the-package-binareis
2 parents 83084a4 + 6ef54ee commit eb204df

422 files changed

Lines changed: 20890 additions & 14079 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.ci/jobs/beats.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
discover-pr-forks-strategy: 'merge-current'
1818
discover-pr-forks-trust: 'permission'
1919
discover-pr-origin: 'merge-current'
20-
head-filter-regex: '(master|6\.[89]|7\.[x789]|7\.1\d|8\.\d+|PR-.*|v\d+\.\d+\.\d+)'
20+
head-filter-regex: '(master|6\.[89]|7\.16|8\.\d+|PR-.*|v\d+\.\d+\.\d+)'
2121
discover-tags: true
2222
notification-context: "beats-ci"
2323
repo: 'beats'

‎.ci/schedule-daily.groovy‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,11 @@ pipeline {
2121
stage('Nighly beats builds') {
2222
steps {
2323
runBuild(quietPeriod: 0, job: 'Beats/beats/master')
24-
runBuild(quietPeriod: 2000, job: 'Beats/beats/7.16')
25-
runBuild(quietPeriod: 4000, job: 'Beats/beats/7.15')
24+
// This should be `current_8` bump.getCurrentMinorReleaseFor8
25+
runBuild(quietPeriod: 2000, job: 'Beats/beats/8.0')
26+
// This should be `current_7` bump.getCurrentMinorReleaseFor7 or
27+
// `next_minor_7` bump.getNextMinorReleaseFor7
28+
runBuild(quietPeriod: 4000, job: 'Beats/beats/7.16')
2629
}
2730
}
2831
}

‎.ci/schedule-weekly.groovy‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,8 +21,11 @@ pipeline {
2121
stage('Weekly beats builds') {
2222
steps {
2323
runBuild(quietPeriod: 0, job: 'Beats/beats/master')
24-
runBuild(quietPeriod: 1000, job: 'Beats/beats/7.16')
25-
runBuild(quietPeriod: 2000, job: 'Beats/beats/7.15')
24+
// This should be `current_8` bump.getCurrentMinorReleaseFor8
25+
runBuild(quietPeriod: 1000, job: 'Beats/beats/8.0')
26+
// This should be `current_7` bump.getCurrentMinorReleaseFor7 or
27+
// `next_minor_7` bump.getNextMinorReleaseFor7
28+
runBuild(quietPeriod: 2000, job: 'Beats/beats/7.16')
2629
}
2730
}
2831
}

‎.mergify.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,10 +101,24 @@ pull_request_rules:
101101
- files~=^\.mergify\.yml$
102102
actions:
103103
delete_head_branch:
104+
- name: notify the backport has not been merged yet
105+
conditions:
106+
- -merged
107+
- -closed
108+
- author=mergify[bot]
109+
- "#check-success>0"
110+
- schedule=Mon-Mon 06:00-10:00[Europe/Paris]
111+
- "#assignee>=1"
112+
actions:
113+
comment:
114+
message: |
115+
This pull request has not been merged yet. Could you please review and merge it @{{ assignee | join(', @') }}? 🙏
104116
- name: notify the backport policy
105117
conditions:
106118
- -label~=^backport
107119
- base=master
120+
- -merged
121+
- -closed
108122
actions:
109123
comment:
110124
message: |
@@ -120,6 +134,8 @@ pull_request_rules:
120134
- name: remove-backport label
121135
conditions:
122136
- label~=backport-v
137+
- -merged
138+
- -closed
123139
actions:
124140
label:
125141
remove:

‎CHANGELOG.asciidoc‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,11 @@
33
:issue: https://github.com/elastic/beats/issues/
44
:pull: https://github.com/elastic/beats/pull/
55

6+
[[release-notes-8.0.0-beta1]]
7+
=== Beats version 8.0.0-beta1
8+
9+
Changes will be described in a later RC / GA.
10+
611
[[release-notes-8.0.0-alpha2]]
712
=== Beats version 8.0.0-alpha2
813

@@ -12,6 +17,37 @@ Changes will be described in a later alpha / beta.
1217
=== Beats version 8.0.0-alpha1
1318

1419
Changes will be described in a later alpha / beta.
20+
[[release-notes-7.15.2]]
21+
=== Beats version 7.15.2
22+
https://github.com/elastic/beats/compare/v7.15.1...v7.15.2[View commits]
23+
24+
==== Bugfixes
25+
26+
*Affecting all Beats*
27+
28+
- Beats dashboards use custom index when `setup.dashboards.index` is set. {issue}21232[21232] {pull}27901[27901]
29+
- Fix handling of float data types within processors. {issue}28279[28279] {pull}28280[28280]
30+
- Allow `clone3` syscall in seccomp filters. {pull}28117[28117]
31+
- Remove unnecessary escaping step in dashboard loading, so they can be displayed in Kibana. {pull}28395[28395]
32+
- Fix AWS proxy_url config from url to string type. {pull}28725[28725]
33+
- Fix `fingerprint` processor to give it access to the `@timestamp` field. {issue}28683[28683]
34+
35+
*Filebeat*
36+
37+
- Fix initialization of http client in Cloudfoundry input. {issue}28271[28271] {pull}28277[28277]
38+
- Fix aws-s3 input by checking if GetObject API call response content type exists. {pull}28457[28457]
39+
- Set `url` as a pointer in the `httpjson` template context to ensure access to all methods. {pull}28695[28695]
40+
- Fix `google_workspace` documentation links. {pull}28657[28657]
41+
42+
*Metricbeat*
43+
44+
- Divide RDS metric cpu.total.pct by 100. {pull}28456[28456]
45+
46+
*Packetbeat*
47+
48+
- Handle truncated DNS records more gracefully. {issue}21495[21495] {pull}28297[28297]
49+
- Fix data stream name for network flows when running under Elastic Agent and Fleet. {pull}28408[28408]
50+
1551
[[release-notes-7.15.1]]
1652
=== Beats version 7.15.1
1753
https://github.com/elastic/beats/compare/v7.15.0...v7.15.1[View commits]

‎CHANGELOG.next.asciidoc‎

Lines changed: 27 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
2828
- add_docker_metadata processor: Replace usage of deprecated `process.ppid` field with `process.parent.pid`. {pull}28620[28620]
2929
- Index template's default_fields setting is only populated with ECS fields. {pull}28596[28596] {issue}28215[28215]
3030
- tar.gz packages for ARM64 will now use the suffix `aarch64` rather than `arm64`. {pull}28813[28813]
31+
- Remove deprecated `--template` and `--ilm-policy` flags. Use `--index-management` instead. {pull}28870[28870]
32+
- Remove options `logging.files.suffix` and default to datetime endings. {pull}28927[28927]
3133

3234
*Auditbeat*
3335

@@ -38,6 +40,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
3840
- Fix handling of long file names on Windows. {issue}25334[25334] {pull}28517[28517]
3941
- System/socket dataset: Fix uninstallation of return kprobes. {issue}28608[28608] {pull}28609[28609]
4042
- Replace usage of deprecated `process.ppid` field with `process.parent.pid`. {pull}28620[28620]
43+
- Fix auditbeat tracing struct decoding. {pull}28580[28580]
4144

4245
*Filebeat*
4346

@@ -62,8 +65,11 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
6265
- All modules: Replace usages of deprecated ECS fields `process.ppid` and `log.original` with `process.parent.pid` and `event.original`. {pull}28620[28620]
6366
- Replace usages of `host.user.*` fields with `user.*` in `cisco`, `microsoft` and `oracle` modules. {pull}28620[28620]
6467
- Remove `docker` input. Please use `filestream` input with `container` parser or `container` input. {pull}28817[28817]
68+
- Change `threatintel` module to use new `threat.*` ECS fields. {pull}29014[29014]
69+
- `filestream` and `log` inputs accept null (`\u0000`) as line terminator. {pull}28998[28998]
6570

6671
*Heartbeat*
72+
- Change behavior in case of duplicate monitor IDs in configs to be last monitor wins. {pull}29041[29041]
6773

6874
*Journalbeat*
6975

@@ -135,15 +141,11 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
135141
- Output errors when Kibana index pattern setup fails. {pull}20121[20121]
136142
- Fix issue in autodiscover that kept inputs stopped after config updates. {pull}20305[20305]
137143
- Add service resource in k8s cluster role. {pull}20546[20546]
138-
- Fixed documentation for commands in beats dev guide {pull}22194[22194]
139-
- Periodic metrics in logs will now report `libbeat.output.events.active` and `beat.memstats.rss`
140-
- Beats dashboards use custom index when `setup.dashboards.index` is set. {issue}21232[21232] {pull}27901[27901]
141-
- Fix handling of float data types within processors. {issue}28279[28279] {pull}28280[28280]
142-
- Allow `clone3` syscall in seccomp filters. {pull}28117[28117]
143-
- Remove unnecessary escaping step in dashboard loading, so they can be displayed in Kibana. {pull}28395[28395]
144+
- Periodic metrics in logs will now report `libbeat.output.events.active` and `beat.memstats.rss` as gauges (rather than counters). {pull}22877[22877]
145+
- Fix discovery of Nomad allocations with multiple events during startup. {pull}28700[28700]
144146
- Allows disable pod events enrichment with deployment name {pull}28521[28521]
145-
- Fix AWS proxy_url config from url to string type. {pull}28725[28725]
146147
- Fix `fingerprint` processor to give it access to the `@timestamp` field. {issue}28683[28683]
148+
- Fix the wrong beat name on monitoring and state endpoint {issue}27755[27755]
147149

148150
*Auditbeat*
149151

@@ -185,17 +187,20 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
185187
- Add support for username in cisco asa security negotiation logs {pull}26975[26975]
186188
- Relax time parsing and capture group and session type in Cisco ASA module {issue}24710[24710] {pull}28325[28325]
187189
- Correctly track bytes read when max_bytes is exceeded. {issue}28317[28317] {pull}28352[28352]
188-
- Fix initialization of http client in Cloudfoundry input. {issue}28271[28271] {pull}28277[28277]
189-
- Fix aws-s3 input by checking if GetObject API call response content type exists. {pull}28457[28457]
190-
- Set `url` as a pointer in the `httpjson` template context to ensure access to all methods. {pull}28695[28695]
191-
- Fix `google_workspace` documentation links. {pull}28657[28657]
190+
- Fix parsing of apache log levels including numbers. {pull}28717[28717]
191+
- Upgrade azure-eventhub sdk reference, contains potential checkpoint fixes. {pull}28919[28919]
192+
- Revert usageDetails api version to 2019-01-01. {pull}28995[28995]
193+
- Fix in `aws-s3` input regarding provider discovery through endpoint {pull}28963[28963]
194+
- Fix `threatintel.misp` filters configuration. {issue}27970[27970]
192195

193196
*Heartbeat*
194197

195198
- Fix broken seccomp filtering and improve security via `setcap` and `setuid` when running as root on linux in containers. {pull}27878[27878]
196199
- Log browser `zip_url` download failures as `warn` instead of as `info`. {pull}28440[28440]
197200
- Properly locate base stream in fleet configs. {pull}28455[28455]
198201
- Stop logging params values. {pull}28774[28774]
202+
- Remove accidentally included cups library in docker images. {pull}28853[pull]
203+
- Fix broken monitors with newer versions of image relying on dup3. {pull}28938[pull]
199204

200205
*Journalbeat*
201206

@@ -231,19 +236,19 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
231236
- Groups same timestamp metric values to one event in the app_insights metricset. {pull}20403[20403]
232237
- `beat` module respects `basepath` config option. {pull}28162[28162]
233238
- Fix list_docker.go {pull}28374[28374]
234-
- Divide RDS metric cpu.total.pct by 100. {pull}28456[28456]
235239
- Use xpack.enabled on SM modules to write into .monitoring indices when using Metricbeat standalone {pull}28365[28365]
240+
- Fix in rename processor to ingest metrics for `write.iops` to proper field instead of `write_iops` in rds metricset. {pull}28960[28960]
236241

237242
*Packetbeat*
238243

239-
- Handle truncated DNS records more gracefully. {issue}21495[21495] {pull}28297[28297]
240-
- Fix data stream name for network flows when running under Elastic Agent and Fleet. {pull}28408[28408]
241244

242245
*Winlogbeat*
243246

244247
- Add source.ip validation for event ID 4778 in the Security module. {issue}19627[19627]
245248
- Tolerate faults when Windows Event Log session is interrupted {issue}27947[27947] {pull}28191[28191]
246249
- Add ECS 1.9 new users fields {pull}26509[26509]
250+
- Don't split hyphenated tokens {pull}28483[28483]
251+
- Correctly handle AccessMask if it is an integer or list of masks. {pull}29016[29016]
247252

248253
*Functionbeat*
249254

@@ -283,6 +288,8 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
283288
- Update kubernetes scheduler and controllermanager endpoints in elastic-agent-standalone-kubernetes.yaml with secure ports {pull}28675[28675]
284289
- Add options to configure k8s client qps/burst. {pull}28151[28151]
285290
- Update to ECS 8.0 fields. {pull}28620[28620]
291+
- Add http.pprof.enabled option to libbeat to allow http/pprof endpoints on the socket that libbeat creates for metrics. {issue}21965[21965]
292+
- Support custom analyzers in fields.yml. {issue}28540[28540] {pull}28926[28926]
286293

287294
*Auditbeat*
288295

@@ -336,6 +343,11 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
336343
- Update `aws-s3` input to connect to non AWS S3 buckets {issue}28222[28222] {pull}28234[28234]
337344
- Sophos UTM: Support logs containing hostname in syslog header. {pull}28638[28638]
338345
- Moving Oracle Filebeat module to GA. {pull}28754[28754]
346+
- Add support for '/var/log/pods/' path for add_kubernetes_metadata processor with `resource_type: pod`. {pull}28868[28868]
347+
- Add documentation for add_kubernetes_metadata processors `log_path` matcher. {pull}28868[28868]
348+
- Add support in aws-s3 input for s3 notification from SNS to SQS. {pull}28800[28800]
349+
- Add support in aws-s3 input for custom script parsing of s3 notifications. {pull}28946[28946]
350+
- Improve error handling in aws-s3 input for malformed s3 notifications. {issue}28828[28828] {pull}28946[28946]
339351

340352
*Heartbeat*
341353

@@ -360,6 +372,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
360372
- Added a new beta `enterprisesearch` module for Elastic Enterprise Search {pull}27549[27549]
361373
- Preliminary AIX support {pull}27954[27954]
362374
- Register additional name for `storage` metricset in the azure module. {pull}28447[28447]
375+
- Update reference to gosigar pacakge for filesystem windows fix. {pull}28909[28909]
363376

364377
*Packetbeat*
365378

‎Jenkinsfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -836,7 +836,7 @@ def archiveTestOutput(Map args = [:]) {
836836
def fileName = 'build/system-tests-*.tar.gz' // see dev-tools/mage/target/common/package.go#PackageSystemTests method
837837
def files = findFiles(glob: "${fileName}")
838838

839-
if (files?.length() > 0) {
839+
if (files?.length > 0) {
840840
googleStorageUploadExt(
841841
bucket: "gs://${JOB_GCS_BUCKET}/${env.JOB_NAME}-${env.BUILD_ID}",
842842
credentialsId: "${JOB_GCS_EXT_CREDENTIALS}",

‎NOTICE.txt‎

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -832,11 +832,11 @@ Contents of probable licence file $GOMODCACHE/code.cloudfoundry.org/go-loggregat
832832

833833
--------------------------------------------------------------------------------
834834
Dependency : github.com/Azure/azure-event-hubs-go/v3
835-
Version: v3.1.2
835+
Version: v3.3.15
836836
Licence type (autodetected): MIT
837837
--------------------------------------------------------------------------------
838838

839-
Contents of probable licence file $GOMODCACHE/github.com/!azure/azure-event-hubs-go/v3@v3.1.2/LICENSE:
839+
Contents of probable licence file $GOMODCACHE/github.com/!azure/azure-event-hubs-go/v3@v3.3.15/LICENSE:
840840

841841
MIT License
842842

@@ -863,15 +863,15 @@ Contents of probable licence file $GOMODCACHE/github.com/!azure/azure-event-hubs
863863

864864
--------------------------------------------------------------------------------
865865
Dependency : github.com/Azure/azure-sdk-for-go
866-
Version: v57.0.0+incompatible
866+
Version: v59.0.0+incompatible
867867
Licence type (autodetected): MIT
868868
--------------------------------------------------------------------------------
869869

870-
Contents of probable licence file $GOMODCACHE/github.com/!azure/azure-sdk-for-go@v57.0.0+incompatible/LICENSE.txt:
870+
Contents of probable licence file $GOMODCACHE/github.com/!azure/azure-sdk-for-go@v59.0.0+incompatible/LICENSE.txt:
871871

872872
The MIT License (MIT)
873873

874-
Copyright (c) 2021 Microsoft
874+
Copyright (c) Microsoft Corporation.
875875

876876
Permission is hereby granted, free of charge, to any person obtaining a copy
877877
of this software and associated documentation files (the "Software"), to deal
@@ -891,6 +891,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
891891
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
892892
SOFTWARE.
893893

894+
894895
--------------------------------------------------------------------------------
895896
Dependency : github.com/Azure/azure-storage-blob-go
896897
Version: v0.8.0
@@ -8276,11 +8277,11 @@ Contents of probable licence file $GOMODCACHE/github.com/elastic/go-windows@v1.0
82768277

82778278
--------------------------------------------------------------------------------
82788279
Dependency : github.com/elastic/gosigar
8279-
Version: v0.14.1
8280+
Version: v0.14.2
82808281
Licence type (autodetected): Apache-2.0
82818282
--------------------------------------------------------------------------------
82828283

8283-
Contents of probable licence file $GOMODCACHE/github.com/elastic/gosigar@v0.14.1/LICENSE:
8284+
Contents of probable licence file $GOMODCACHE/github.com/elastic/gosigar@v0.14.2/LICENSE:
82848285

82858286
Apache License
82868287
Version 2.0, January 2004
@@ -20250,11 +20251,11 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
2025020251

2025120252
--------------------------------------------------------------------------------
2025220253
Dependency : github.com/Azure/azure-amqp-common-go/v3
20253-
Version: v3.0.0
20254+
Version: v3.2.1
2025420255
Licence type (autodetected): MIT
2025520256
--------------------------------------------------------------------------------
2025620257

20257-
Contents of probable licence file $GOMODCACHE/github.com/!azure/azure-amqp-common-go/v3@v3.0.0/LICENSE:
20258+
Contents of probable licence file $GOMODCACHE/github.com/!azure/azure-amqp-common-go/v3@v3.2.1/LICENSE:
2025820259

2025920260
MIT License
2026020261

@@ -20311,15 +20312,16 @@ Contents of probable licence file $GOMODCACHE/github.com/!azure/azure-pipeline-g
2031120312

2031220313
--------------------------------------------------------------------------------
2031320314
Dependency : github.com/Azure/go-amqp
20314-
Version: v0.12.6
20315+
Version: v0.16.0
2031520316
Licence type (autodetected): MIT
2031620317
--------------------------------------------------------------------------------
2031720318

20318-
Contents of probable licence file $GOMODCACHE/github.com/!azure/go-amqp@v0.12.6/LICENSE:
20319+
Contents of probable licence file $GOMODCACHE/github.com/!azure/go-amqp@v0.16.0/LICENSE:
2031920320

2032020321
MIT License
2032120322

20322-
Copyright (c) Microsoft Corporation.
20323+
Copyright (C) 2017 Kale Blankenship
20324+
Portions Copyright (C) Microsoft Corporation
2032320325

2032420326
Permission is hereby granted, free of charge, to any person obtaining a copy
2032520327
of this software and associated documentation files (the "Software"), to deal

‎README.md‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -74,14 +74,6 @@ create your own Beat.
7474

7575
Please start by reading our [CONTRIBUTING](CONTRIBUTING.md) file.
7676

77-
If you are creating a new Beat, you don't need to submit the code to this
78-
repository. You can simply start working in a new repository and make use of the
79-
libbeat packages, by following our [developer
80-
guide](https://www.elastic.co/guide/en/beats/libbeat/current/new-beat.html).
81-
After you have a working prototype, open a pull request to add your Beat to the
82-
list of [community
83-
Beats](https://github.com/elastic/beats/blob/master/libbeat/docs/communitybeats.asciidoc).
84-
8577
## Building Beats from the Source
8678

8779
See our [CONTRIBUTING](CONTRIBUTING.md) file for information about setting up

‎auditbeat/auditbeat.reference.yml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1443,11 +1443,6 @@ logging.files:
14431443
# file. Defaults to true.
14441444
# rotateonstartup: true
14451445

1446-
# Rotated files are either suffixed with a number e.g. auditbeat.1 when
1447-
# renamed during rotation. Or when set to date, the date is added to
1448-
# the end of the file. On rotation a new file is created, older files are untouched.
1449-
#suffix: count
1450-
14511446
# ============================= X-Pack Monitoring ==============================
14521447
# Auditbeat can export internal metrics to a central Elasticsearch monitoring
14531448
# cluster. This requires xpack monitoring to be enabled in Elasticsearch. The
@@ -1632,6 +1627,10 @@ logging.files:
16321627
# `http.user`.
16331628
#http.named_pipe.security_descriptor:
16341629

1630+
# Defines if the HTTP pprof endpoints are enabled.
1631+
# It is recommended that this is only enabled on localhost as these endpoints may leak data.
1632+
#http.pprof.enabled: false
1633+
16351634
# ============================== Process Security ==============================
16361635

16371636
# Enable or disable seccomp system call filtering on Linux. Default is enabled.

0 commit comments

Comments
 (0)