Index

9.4.4 [beats-release-notes-9.4.4]

Features and enhancements [beats-9.4.4-features-enhancements]

All

• Use native Go for Linux FIPS builds. #51345

Filebeat

• Add sign-in activity enrichment for Azure AD users via enrich_with: sign_in_activity. #51390
• Optimize filestream logger performance. #50118
• Add an input_type resource attribute to CEL input OTel metrics for consistent filtering across custom and HTTP client metrics. #50645
• Add consumer-group and network timeout options to the Filebeat Kafka input. #51173 #51172
• Upgrade github.com/elastic/go-lumber to v0.2.0. #51518
• Add a configurable retry policy to the Azure Blob Storage input. #51701 #44629
• Add group_instance_id (KIP-345 static group membership) to the Filebeat Kafka input. #51772 #51768

Heartbeat

• Remove unsupported ciphers for FIPS mode. #51326

Fixes [beats-9.4.4-fixes]

All

• Fix goroutine leak when processor construction fails. #51687

• Fix data races in the add_docker_metadata cache initialization. #51688

• Close Beat processors on Beat OTel processor shutdown to avoid leaking resources on collector reloads. #51743

• Update elastic-agent-libs to v0.46.1. #51921

  Fixed an issue where malformed TLS keys could be printed in the error logs during loading failures.

Auditbeat

• Fix data races in the backoff accounting of the add_session_metadata processor's kernel_tracing provider. #51745

Elastic agent

• Fix data race in the elasticsearch_storage OTel extension. #51501
• Fix registry corruption issue with multiple metricbeat receivers. #51591 #15154

Filebeat

• Filestream now defers shutdown until it reaches EOF or a configurable timeout. The new read_until_eof option (enabled by default) lets you opt out. #50324 #40447
• Fix DPoP resource client signing method assignment in CEL and HTTP JSON input. #51433
• Validate CrowdStrike streaming resource URL origins against the configured discover URL. #51435
• Use constant-time comparison for http_endpoint basic auth and secret header validation. #51436
• Validate that HTTPJSON pagination URLs share the configured request URL origin. #51437
• Fix Filebeat duplicating events after a normal shutdown caused by a race in the registrar. #51517
• Avoid slice-bounds panic when sorting copytruncate rotated files by date. #51570
• Fix type loss in HTTP JSON template transform handling. #51593
• Fix filestream data loss when a harvester closes before ingesting any data. #51675
• Fix CrowdStrike streaming input retry cap so max_attempts and infinite_retries are honoured. #51712
• Fix winlog input crash and event loss during shutdown. #51728
• Make the CrowdStrike streaming input self-heal from transient discover failures. #51737
• Prevent Filebeat startup failure when meta.json is left empty after migration. #51791
• Synchronize Filebeat Run and Shutdown functions. #51800
• Fix aws-s3 input not performing backup_to_bucket and delete_after_backup in polling mode. #49734 #46672
• Fix goroutine leak in request trace logging infrastructure. #51950

Libbeat

• Fix a data race in the rate_limit processor when configured with fields and run concurrently. #51736
• Fix a startup data race in the add_kubernetes_metadata processor. #51739
• Prevent statestore startup failure when meta.json is left empty after an unclean shutdown. #51897

Metricbeat

• Fix a race condition during metricset closure. #50834
• Fix missing state_service and state_storageclass events when kube-state-metrics denylists *_created. #51255 #34074

Osquerybeat

• Fix a rare crash when Osquery restarts after a configuration change. #51520
• Emit pack_name and query_name in Osquerybeat scheduled query results. #51781

Packetbeat

• Load the Npcap wpcap.dll lazily to avoid blocking Npcap upgrades on Windows. #51716 #14517