// Use these for links to issue and pulls. Note issues and pulls redirect one to
// each other on Github, so don't worry too much on using the right prefix.
:issue: https://github.com/elastic/beats/issues/
:pull: https://github.com/elastic/beats/pull/

=== Beats version HEAD
https://github.com/elastic/beats/compare/v7.0.0-alpha2...main[Check the HEAD diff]

==== Breaking changes

*Affecting all Beats*

- Fix mapping of parent process information provided by add_process_metadata. {issue}29874[29874] {pull}30727[30727]

*Auditbeat*


*Filebeat*

*Heartbeat*


*Metricbeat*


*Packetbeat*


*Winlogbeat*


*Functionbeat*


==== Bugfixes

*Affecting all Beats*

- Fix field names with `add_network_direction` processor. {issue}29747[29747] {pull}29751[29751]
- Fix a logging bug when `ssl.verification_mode` was set to `full` or `certificate`, the command `test output` incorrectly logged that TLS was disabled.
- Fix the ability for subcommands to be ran properly from the beats containers. {pull}30452[30452]
- Update docker/distribution dependency library to fix a security issues concerning OCI Manifest Type Confusion Issue. {pull}30462[30462]
- Fix dissect trim panics from DELETE (127)(\u007f) character {issue}30657[30657] {pull}30658[30658]
- Load data stream during setup, so users do not need extra permissions during publishing. {issue}30647[30647] {pull}31048[31048]
- Add ecs container fields {pull}31020[31020]
- Fix docs reference for syslog processor {pull}31087[31087]
- Fix AWS config initialization issue when using a role {issue}30999[30999] {pull}31014[31014]

*Auditbeat*


*Filebeat*

- auditd: Prevent mapping explosion when truncated EXECVE records are ingested. {pull}30382[30382]
- elasticsearch: fix duplicate ingest when using a common appender configuration {issue}30428[30428] {pull}30440[30440]
- Prevent logic race on clearing data during request in httpjson. {pull}30730[30730]
- Do not emit error log when filestream reader reaches EOF and `close.reader.on_eof` is enabled. {pull}31109[31109]
- Prevents filestream inputs from being stuck while being created. {pull}31240[31240]
- Recover CEF extensions from messages with invalid/incomplete headers. {issue}30757[30757] {pull}30938[30938]
- Fix panic in filestream input when `copy_truncate` log rotation strategy is used {issue}29024[29024] {pull}31041[31041]
- Fix Azure signinlogs authentication_requirement_policies field type and several missing fields. {pull}31062[31062]
- Cyberark PAS: Fix error ingesting events with a single entry in the CAProperties field. {pull}31094[31094]
- Fix Azure activitylogs identity field type and several missing fields. {pull}31170[31170]
- checkpoint: Fix ingest error when a message contains trailing spaces {pull}31197[31197]
- m365_defender: Fix processing when alerts.entities is an empty list. {issue}31223[31223] {pull}31227[31227]

*Heartbeat*

- Heartbeat now successfully runs synthetic monitors on ARM processors. {pull}31114[31114]

*Metricbeat*

- Enhance metricbeat on openshift documentation {pull}30054[30054]
- Fixed missing ZooKeeper metrics due compatibility issues with versions >= 3.6.0 {pull}30068[30068]
- Fix Docker module: rename fields on dashboards. {pull}30500[30500]
- Add back missing metrics to system/linux. {pull}30774[30774]
- GCP metrics query instances with aggregatedList API to improve efficiency. {pull}30154[#30153]
- Fix delay in perfmon counters collection {issue}30686[30686] {pull}30861[#30861]
- Fix Jolokia module to print URI for one of the debug logs. {pull}30943[#30943]
- Handle docker reporting different capitalization for disk usage metrics. {pull}30978[#30978]

*Packetbeat*


*Winlogbeat*

- Fix evtx parsing failures. {issue}30621[30621] {pull}30942[30942]


*Functionbeat*



*Elastic Logging Plugin*


==== Added

*Affecting all Beats*

- Add FIPS configuration option for all AWS API calls. {pull}28899[28899]
- Add support for kafka message headers. {pull}29940[29940]
- Add support for non-unique Kafka headers for output messages. {pull}30369[30369]
- Add syslog parser and processor. {issue}30139[30139] {pull}30541[30541]
- Add action_input_type for the .fleet-actions-results {pull}30562[30562]
- Add cronjob metadata by default {pull}30637[30637]
- New option `setup.template.json.data_stream` is added to indicate if the JSON index template is a data stream. {pull}31048[31048]
- Add support for port mapping in docker hints. {pull}31243[31243]

*Auditbeat*


*Filebeat*

- Add `text/csv` decoder to `httpjson` input {pull}28564[28564]
- Update `aws-s3` input to connect to non AWS S3 buckets {issue}28222[28222] {pull}28234[28234]
- Add support for '/var/log/pods/' path for add_kubernetes_metadata processor with `resource_type: pod`. {pull}28868[28868]
- Add documentation for add_kubernetes_metadata processors `log_path` matcher. {pull}28868[28868]
- Add support for parsers on journald input {pull}29070[29070]
- Add support in httpjson input for oAuth2ProviderDefault of password grant_type. {pull}29087[29087]
- Add extraction of `related.hosts` to Microsoft 365 Defender ingest pipeline {issue}29859[29859] {pull}29863[29863]
- threatintel module: Add new Recorded Future integration. {pull}30030[30030]
- Support SASL/SCRAM authentication in the Kafka input. {pull}31167[31167]
- Improve recovery from corrupted registries. {issue}25135[25135] {pull}30994[30994]
- Add support in httpjson input for chain calls. {pull}29816[29816]
- checkpoint module: Add `network.transport` derived from IANA number. {pull}31076[31076]
- Add URL Encode template function for httpjson input. {pull}30962[30962]

*Auditbeat*

- Include config file (`auditbeat.elastic-agent.yml`) in tar.gz and zip packages for use with Elastic Agent.


*Filebeat*

- http_endpoint input: Add support for requests with `Content-Encoding: gzip`. {issue}31005[31005]

*Heartbeat*


*Metricbeat*

- Add `kubernetes.container.status.last.reason` metric {pull}30306[30306]
- Extend documentation about `orchestrator.cluster` fields {pull}30518[30518]
- Fix overflow in `iostat` metrics {pull}30679[30679]
- Add `commandstats` field to Redis module {pull}29662[29662]
- Add `kubernetes.volume.fs.inodes.pct` field. {pull}30785[30785]
- Improve Kubernetes dashboard. {pull}30913[30913]
- Populate new container ECS fields in Docker module. {pull}30399[30399]
- Populate new container ECS fields in Kubernetes module. {pull}30181[30181]
- Populate ecs container fields in Containerd module. {pull}31025[31025]

*Packetbeat*


*Functionbeat*


*Winlogbeat*

- Improve the error message when the registry file content is invalid. {pull}30543[30543]
- Retry EvtSubscribe from start if fails with strict mode. {issue}29793[29793] {pull}30155[30155]
- Add parent process ID to new process creation events. {issue}29237[29237] {pull}31102[31102]


*Elastic Log Driver*


==== Deprecated

*Affecting all Beats*


*Filebeat*


*Heartbeat*

*Metricbeat*


*Packetbeat*

*Winlogbeat*

*Functionbeat*

==== Known Issue

