docs/release-notes/_snippets/9.2.8/index.md
Filebeat
Add retry back-off logic to streaming input CrowdStrike follower. #48542
Add secret_state config to CEL input for encrypted storage of secrets accessible as state.secret. #49207
Add a secret_state configuration field to the CEL input. When configured in a
Fleet integration package with secret: true, the values are stored encrypted by
Fleet. At runtime, the contents are placed at state.secret and unconditionally
redacted in debug logs. The key secret in the plain-text state configuration
is reserved and rejected by validation to prevent accidental unencrypted storage
of values intended to be secret.
Allow string and number arrays in httpjson chained configurations. #49391 #16662
Add support for URL and URL query parsing and formatting in the Streaming input CEL environment. #49653
Metricbeat
Elastic Agent
info to debug for polling. #49507Filebeat
Fix Filestream take_over causing file re-ingestion when used with autodiscover. #49632 #49579
Fix compatibility of the Journald input with journald/systemd versions < 242. #49445
Add rate-limit backoff to CrowdStrike streaming input oauth2 transport. #49453
Wrap the oauth2 HTTP transport used by the CrowdStrike falcon streaming input with a rate-limit-aware transport that intercepts 429 responses, reads the Retry-After header, and backs off before retrying. This prevents the oauth2 token refresh from generating a burst of unauthorized requests that triggers CrowdStrike's 15-per-minute rate limit. The discover endpoint also returns a retry-after hint to the session-level retry loop as a minimum wait floor.
Skip request tracer path validation when tracing is disabled to prevent input startup failures. #49655
The startup path validation in cel, httpjson, http_endpoint, and entity analytics inputs checked whether the tracer config struct was non-nil rather than whether tracing was enabled. Integration package templates always include a tracer block (with enabled defaulting to false), so the struct is never nil. Under the agentless/otel runtime the relative tracer path resolves outside the permitted directory, causing all affected inputs to fail immediately even though tracing was disabled. The config-level Validate methods already used the correct enabled() guard; the startup paths now do the same.
Fix Filebeat crash loop when running under Elastic Agent and taking too long to initialise. #49796
Libbeat
Metricbeat
Fix unnecessary Windows filesystem metricset errors from non-existent volumes. #49553
Fix an issue where filesystem metric collection on Windows could report errors for volumes that are no longer present. Update to gosigar v0.14.4.
Winlogbeat