docs/release-notes/_snippets/9.0.0/breaking-changes.md
% Description and impact of the breaking change. % For more information, check [PR #](PR link).
::::{dropdown} Set default Kafka version to 2.1.0 in Kafka output and Filebeat. For more information, check #41662. ::::
::::{dropdown} Replaced default Ubuntu-based images with UBI-minimal-based ones. For more information, check #42150. ::::
::::{dropdown} Removed support for a single "-" to precede multi-letter command line arguments. Use "--" instead. For more information, check #42117 #42209. ::::
::::{dropdown} Filebeat fails to start if there is any input with a duplicated ID. It logs the duplicated IDs and the offending inputs configurations. For more information, check #41731. ::::
::::{dropdown} Filestream inputs with duplicated IDs will fail to start. An error is logged showing the ID and the full input configuration. For more information, check #41938 #41954. ::::
::::{dropdown} Filestream inputs can define "allow_deprecated_id_duplication: true" to run keep the previous behaviour of running inputs with duplicated IDs. For more information, check #41938 #41954. ::::
::::{dropdown} Filestream inputs now starts ingesting files only if they are 1024 bytes or larger because the default file identity has changed from native to fingerprint.
At startup Filebeat automatically updates the state from known, active files (i.e: files that are still present on the disk and have not changed path since Filebeat was stopped) to use the new file identity. If Filebeat cannot migrate the state to the new file identity, the file will be re-ingested. To preserve the behaviour from 8.x, set file_identity.native: ~ and prospector.scanner.fingerprint.enabled: false.
Refer to the file identity documentation for more details. You can also check #40197 #41762. ::::
::::{dropdown} Filebeat fails to start when its configuration contains usage of the deprecated log or container inputs. However, they can still be used when "allow_deprecated_use: true" is set in their configuration. For more information, check #42295. ::::
::::{dropdown} Upgrade osquery version to 5.13.1. For more information, check #40849. ::::
::::{dropdown} Use base-16 for reporting serial_number value in TLS fields in line with the ECS recommendation. For more information, check #41542. ::::
::::{dropdown} Default to use raw API and delete older XML implementation. For more information, check #42275. ::::
::::{dropdown} The Beats logger and file output rotate files when necessary. The beat now forces a file rotation when unexpectedly writing to a file through a symbolic link. ::::
::::{dropdown} Remove kibana.settings metricset since the API was removed in 8.0 in Metricbeat. For more information, check #30592. #42937. ::::
::::{dropdown} Removed support for the Enterprise Search module in Metricbeat. For more information, check #42915. ::::
::::{dropdown} Allow faccessat(2) in seccomp. For more information, check #43322. ::::