Index

9.4.2 [beats-release-notes-9.4.2]

Features and enhancements [beats-9.4.2-features-enhancements]

Filebeat

• Match http.ServeMux redirect status code for path cleaning in http_endpoint mux. #50686

Libbeat

• Update ebpfevents to v0.9.0. #50609

Metricbeat

• Add failure_store metric to the stats metricset in the Beat module. #49452
• Add elasticsearch/security_stats metricset to the Elasticsearch module. #50674
• Migrate azure/app_insights metricset off the deprecated track-1 Azure SDK and go-autorest, and use azcore directly. #50392

Fixes [beats-9.4.2-fixes]

All

• Initialize disk queue frame IDs from persisted state. #50534
• Fix race in pipeline client between Publish and Close that could skip waiting for events to be acknowledged. #50625 #49390

Auditbeat

• Release the bolt file lock when the last datastore bucket is closed. #50386 #50381

Filebeat

• Fix token refresh for jwk_pem/jwk_file in the cel, httpjson, and okta inputs. #50433 #50426
• Accept string values for secret_state to support Fleet secret resolution. #50508
• Respect max_bytes/message_max_bytes when reading the first chunk of CRI partial lines. #50552
• When Filestream is migrating the registry key from inputs that did not have an ID, match files by path and file identity instead of only path. #50599
• Fixes UDP input crashes on Windows when oversized datagrams are received. #50770 #50718
• Make CrowdStrike streaming input cancel refresh goroutines on session reconnect. #50803

Heartbeat

• Upgrade npm to v11 in non-wolfi Heartbeat Docker images. #50598

Metricbeat

• Fix panic in Azure module when all configured resources match no Azure resources. #50498
• Elasticsearch module cluster state requests no longer append local=true. #50723 #50722