docs/release-notes/index.md
Review the changes, fixes, and more in each version of Logstash.
To check for security updates, go to Security announcements for the Elastic stack.
% Release notes include only features, enhancements, and fixes. Add breaking changes, deprecations, and known issues to the applicable release notes sections.
% ## version.next [logstash-next-release-notes]
% ### Features and enhancements [logstash-next-features-enhancements] % *
% ### Fixes [logstash-next-fixes] % *
Azure_event_hubs Input - 1.5.5
Beats Input - 7.0.8
Http Input - 4.1.7
Tcp Input - 7.0.7
Kafka Integration - 11.8.7
Upgrade Avro dependency to 1.11.5 #242
[DOC] Add info about Kafka timestamp behavior #241
Redact sasl_jaas_config to prevent credentials from appearing in debug logs. #237
Http Output - 6.0.1
ssl_certificate_authorities takes at-most-one value #150Geoip Filter - 8.0.0
geoip2 library to version 4.4.0 #238Kafka Integration - 11.8.4
kafka-avro-serializer dependency #225Collectd Codec - 3.1.1
Netflow Codec - 4.3.4
Date Filter - 3.1.16
Dissect Filter - 1.2.6
Geoip Filter - 7.3.4
Grok Filter - 4.4.4
Beats Input - 7.0.7
Dead_letter_queue Input - 2.0.2
File Input - 4.4.7
Http Input - 4.1.6
Tcp Input - 7.0.6
Unix Input - 3.1.3
Jdbc Integration - 5.6.3
Kafka Integration - 11.8.3
Nagios Output - 3.0.7
Webhdfs Output - 3.1.1
::::{important}
Do not upgrade to Logstash 9.3.0 if you are running on aarch64 or Windows with the bundled JDK and are not using Docker.
For more details please see the associated known issue.
::::
We've added additional wait_for_status and timeout query parameters to the Logstash root endpoint /. When calling the endpoint with these parameters set, the call will return when either the Logstash status matches (or improves on) the given status, or the given timeout has expired.
Related:
wait_for_status and timeout query params for _health_report API #18377Avro Codec - 3.5.0
ssl_enabled option to enable/disable SSLssl_certificate and ssl_key options for PEM-based client authentication (unencrypted keys only)ssl_certificate_authorities option for PEM-based server certificate validationssl_verification_mode option to control SSL verification (full, none)ssl_cipher_suites option to configure cipher suitesssl_supported_protocols option to configure TLS protocol versions (TLSv1.1, TLSv1.2, TLSv1.3)ssl_truststore_path and ssl_truststore_password options for server certificate validation (JKS/PKCS12)ssl_keystore_path and ssl_keystore_password options for mutual TLS authentication (JKS/PKCS12)ssl_truststore_type and ssl_keystore_type options (JKS or PKCS12)proxy optionusername and password optionsNetflow Codec - 4.3.3
NoMethodError when decode fails #214Cidr Filter - 3.2.0
address_field config option to handle nested fields #29Elastic_integration Filter - 9.3.0
Azure_event_hubs Input - 1.5.4
adal4j dependency #107Kafka Integration - 11.8.2
org.apache.commons:commons-lang3 dependency #217Snmp Integration - 4.2.1
Elasticsearch Output - 12.1.1
Remove duplicated deprecation log entry #1232
Add drop_error_types config option to avoid retrying on certain error types #1228
Azure_event_hubs Input - 1.5.5
Beats Input - 7.0.8
Http Input - 4.1.7
Tcp Input - 7.0.7
Kafka Integration - 11.8.7
Upgrade Avro dependency to 1.11.5 #242
[DOC] Add info about Kafka timestamp behavior #241
Redact sasl_jaas_config to prevent credentials from appearing in debug logs. #237
Http Output - 6.0.1
ssl_certificate_authorities takes at-most-one value #150Geoip Filter - 8.0.0
Kafka Integration - 11.8.4
kafka-avro-serializer dependency #225Collectd Codec - 3.1.1
Netflow Codec - 4.3.4
Date Filter - 3.1.16
Dissect Filter - 1.2.6
Geoip Filter - 7.3.4
Grok Filter - 4.4.4
Beats Input - 7.0.7
Dead_letter_queue Input - 2.0.2
File Input - 4.4.7
Http Input - 4.1.6
Tcp Input - 7.0.6
Unix Input - 3.1.3
Jdbc Integration - 5.6.3
Kafka Integration - 11.8.3
Nagios Output - 3.0.7
Webhdfs Output - 3.1.1
::::{important}
Do not upgrade to Logstash 9.2.5 if you are running on aarch64 or Windows with the bundled JDK and are not using Docker.
For more details please see the associated known issue.
::::
No user-facing changes in Logstash core.
Netflow Codec - 4.3.3
Azure_event_hubs Input - 1.5.4
Kafka Integration - 11.8.2
::::{Deprecations to Kafka partitioner settings}
The Kafka integration plugin version bundled with this release introduces deprecations for partitioner settings in the Kafka output. Check out Deprecations for more information.
::::
Beats Input - 7.0.5
Http Input - 4.1.4
Tcp Input - 7.0.4
Kafka Integration - 11.8.1
default and uniform_sticky options #206
Both options are deprecated in Kafka client 3 and will be removed in the plugin 12.0.0.reconnect_backoff_max_ms option for configuring kafka client #204Updated logging in JSON format to include pipeline and plugin IDs. #18470
No user-facing changes in Logstash plugins.
No user-facing changes in Logstash core.
Split Filter - 3.1.10
Fix Logstash startup failure when queue.max_bytes exceeds 2 GiB #18366
Deprecation logs are now written to both the deprecation logger and the standard logger #18326
Geoip Filter - 7.3.2
Mutate Filter - 3.5.9
convert to correctly parse hexadecimal float notation and scientific notation strings into floats and integers #175Azure_event_hubs Input - 1.5.3
config_mode => 'advanced' is set, event hub-specific settings (initial_position, max_batch_size, prefetch_count, receive_timeout, initial_position_look_back) were being ignored and replaced with global defaults. These settings are now correctly applied per event hub #104Rabbitmq Integration - 7.4.1
::::{important}
Do not upgrade to Logstash 9.2.0 if you use the Persistent Queue (PQ) with a value of queue.max_bytes greater than 2GiB,
For more details please see the associated known issue.
::::
We’ve added support for compression to the Persistent Queue (PQ), allowing you to spend some CPU in exchange for reduced disk IO. This can help reduce cost and increase throughput in situations where your hardware is rate-limited or metered.
PQ compression is implemented using the industry-standard highly-efficient ZSTD algorithm, and can be activated at one of three levels:
The effects of these settings will depend on the shape and size of each pipeline’s events. To help you tune your configuration to meet your own requirements, we have added queue metrics exposing the effective compression ratio and the amount of CPU that is being spent to achieve it.
PQ Compression has been introduced as an opt-in feature in 9.2 because a PQ that contains one or more compressed events cannot be read by previous versions of Logstash, making the feature a rollback-barrier. We recommend validating your pipelines with Logstash 9.2 (or later) before enabling PQ compression so that you have the freedom to roll back if you encounter any issues with your pipelines.
Related:
We've added metrics to help you track the size of batches processed by Logstash pipelines.
The Node API pipelines endpoint now shows includes information displaying the showing the average number of events processed per batch, and the average byte size of those batches for each pipeline. This information can be used to help size Logstash instances, and optimize settings for pipeline.batch.size for Logstash pipelines based on real observations of data.
Related:
_node/stats API response when the vertices=true parameter is included. These metrics are particularly useful for monitoring {{ls}} plugin activity on the {{ls}} Integration dashboards #18090Elastic_integration Filter - 9.2.0
Translate Filter - 3.5.0
Snmp Integration - 4.1.0
context engine ID and context name to the snmptrap input #76Updated logging in JSON format to include pipeline and plugin IDs. #18470
No user-facing changes in Logstash plugins.
No user-facing changes in Logstash core.
Split Filter - 3.1.10
Geoip Filter - 7.3.2
Mutate Filter - 3.5.9
convert to correctly parse hexadecimal float notation and scientific notation strings into floats and integers #175Azure_event_hubs Input - 1.5.3
config_mode => 'advanced' is set, event hub-specific settings (initial_position, max_batch_size, prefetch_count, receive_timeout, initial_position_look_back) were being ignored and replaced with global defaults. These settings are now correctly applied per event hub #104Rabbitmq Integration - 7.4.1
No user-facing changes in Logstash core.
Csv Output - 3.0.11
No user-facing changes in Logstash core.
Elasticsearch Filter - 4.3.1
Elasticsearch Input - 5.2.1
Jdbc Integration - 5.6.1
jdbc_static filter's throughput was artificially limited to 4 concurrent queries, causing the plugin to become a bottleneck in pipelines with more than 4 workers. Each instance of the plugin is now limited to 16 concurrent queries, with increased timeouts to eliminate enrichment failures. #187Elasticsearch Output - 12.0.7
_node/stats API response when the vertices=true parameter is included. These metrics are particularly useful for monitoring {{ls}} plugin activity on the {{ls}} Integration dashboards #18090Elasticsearch Filter - 4.3.0
Beats Input - 7.0.3
Http Input - 4.1.3
Jms Input - 3.3.1
add_field is no longer enriching events #59Tcp Input - 7.0.3
Kafka Integration - 11.6.4
No change to the plugins in this release.
No user-facing changes in Logstash core.
No change to the plugins in this release.
No user-facing changes in Logstash core.
Elastic_integration Filter - 9.1.1
Translate Filter - 3.4.3
Xml Filter - 4.3.2
Azure_event_hubs Input - 1.5.2
Snmp Integration - 4.0.7
snmptrap input now correctly enforces the user security level set by security_level config, and drops received events that do not match the configured value #75Elasticsearch Output - 12.0.6
queue.checkpoint.interval#17759, which was found to have no effect. This will be removed in a future Logstash release.The Elasticsearch Input now provides support for field value tracking, persisted to disk on each search_after page. This is useful to track new data being written to an index or series of indices.
Elastic Integration Filter - 9.1.0
proxy param to support proxy #316Elasticsearch Filter - 4.2.0
target configuration option to store the result into it #196Elasticsearch Input - 5.2.0
Elasticsearch Output - 12.0.5
WARN to INFO when connecting during register phase #1211JDBC Integration - 5.6.0
JMS Input - 3.3.0
Kafka Integration - 11.6.3
3.9.1 #193sasl_iam_jar_paths #192Xml Filter - 4.3.1
Tcp Output - 7.0.1
No user-facing changes in Logstash core.
Elasticsearch Output - 12.0.7
_node/stats API response when the vertices=true parameter is included. These metrics are particularly useful for monitoring {{ls}} plugin activity on the {{ls}} Integration dashboards. #18089Beats Input - 7.0.3
Http Input - 4.1.3
Tcp Input - 7.0.3
Kafka Integration - 11.6.4
No change to the plugins in this release.
No user-facing changes in Logstash core.
Elastic_integration Filter - 9.0.2
terminate processor #345Translate Filter - 3.4.3
Xml Filter - 4.3.2
Azure_event_hubs Input - 1.5.2
Snmp Integration - 4.0.7
snmptrap input now correctly enforces the user security level set by security_level config, and drops received events that do not match the configured value #75Elasticsearch Output - 12.0.6
Elastic_integration Filter - 9.0.1
proxy config to support proxy URI to connect to Elasticsearch. #320Elasticsearch Output - 12.0.4
No user-facing changes in Logstash core.
Kafka Integration - 11.6.3
3.9.1 #193No user-facing changes in Logstash core.
Kafka Integration - 11.6.2
sasl_iam_jar_paths #192::::{important} The 9.0.1 release contains fixes for potential security vulnerabilities. Check out the security advisory for details. ::::
Xml Filter - 4.3.1
Elasticsearch Output - 12.0.3
WARN to INFO when connecting during register phase #1211Tcp Output - 7.0.1
elastic_integration Filter - 9.0.0
Elasticsearch Filter - 4.1.0
Http Filter - 2.0.0
Beats Input - 7.0.1
Elastic_serverless_forwarder Input - 2.0.0
Elasticsearch Input - 5.0.0
Http Input - 4.1.0
Http_poller Input - 6.0.0
Tcp Input - 7.0.0
Kafka Integration - 11.6.0
oauth and sasl configuration options for configuring kafka client #189Snmp Integration - 4.0.6
Elasticsearch Output - 12.0.2
Http Output - 6.0.0
Tcp Output - 7.0.0