Index

9.2.0 [beats-release-notes-9.2.0]

This release also includes: Breaking changes.

Features and enhancements [beats-9.2.0-features-enhancements]

All

• The following output latency_delta metrics are now included when logging.metrics is enabled: output.latency_delta.{count, max, median, min, p99}. This only includes data collected since the last internal metrics was logged. #45749

Auditbeat

• Add new ETW FIM backend for Windows. #45887

Filebeat

• TCP and UDP inputs now support multiple pipeline workers configured using number_of_workers. Increasing the number of workers improves performance when slow processors are used by decoupling reading from the network connection and publishing. #45124 #43674
• Add beta support for GZIP file ingestion in filestream. #45301
• Update the parse_aws_vpc_flow_log processor to support AWS VPC flow log versions 6–8. #45746
• Add OAuth2 support for Okta provider in Entity Analytics input. #45753
• Improve error reporting for schemeless URLs in HTTP JSON input. #45953
• Add remaining_executions global to the CEL input evaluation context. #46210
• Journald input now supports reading from multiple journals, including remote ones. #46722 #46656

Metricbeat

• Improve the Prometheus helper to handle multiple content types including blank and invalid headers. #47085

Osquerybeat

• Upgrade osquery version to 5.18.1. #46624

Packetbeat

• Bump Windows Npcap version to v1.83. #46809

Fixes [beats-9.2.0-fixes]

All

• Make data updates in add_host_metadata processor synchronous. #46546
• Prevent panic in Logstash output when trying to send events while shutting down. #46960 #46889
• Prevent panic in the replace processor for non-string values. #47009 #42308
• Ensure Autodiscover correctly updates Kubernetes metadata on node and pod label changes. #47034 #46979
• Prevent a 3s startup delay when add_cloud_metadata is used with debug logs. #47058 #44203
• Update elastic-agent-system-metrics to version v0.13.3. #47104
• Remove “Accurate CPU counts not available on platform” log spam at the debug level. #47054
• Allow users to customize their data stream namespace to generic. #47140

Filebeat

• Fix defer usage for stopped status reporting. #46916

Metricbeat

• Fix missing AWS cloudwatch metrics with linked accounts and same dimensions. #46978 #15362
• Add a fix to handle blank content-type headers in HTTP responses for Prometheus. #47027
• Add pagination support to the device_health metricset in the meraki module. #46938 #15551