// Use these for links to issue and pulls. :kibana-issue: https://github.com/elastic/kibana/issues/ :kibana-pull: https://github.com/elastic/kibana/pull/ :beats-issue: https://github.com/elastic/beats/issues/ :beats-pull: https://github.com/elastic/beats/pull/ :agent-libs-pull: https://github.com/elastic/elastic-agent-libs/pull/ :agent-issue: https://github.com/elastic/elastic-agent/issues/ :agent-pull: https://github.com/elastic/elastic-agent/pull/ :fleet-server-issue: https://github.com/elastic/fleet-server/issues/ :fleet-server-pull: https://github.com/elastic/fleet-server/pull/ [[release-notes]] = Release notes This section summarizes the changes in each release. * <> * <> * <> * <> * <> Also see: * {kibana-ref}/release-notes.html[{kib} release notes] * {beats-ref}/release-notes.html[{beats} release notes] // begin 8.15.4 relnotes [[release-notes-8.15.4]] == {fleet} and {agent} 8.15.4 [discrete] [[bug-fixes-8.15.4]] === Bug fixes {agent}:: * Improve upgrade experience by assuming that {agent} is installed, allowing to use proper control socket path to communicate with running {agent}. {agent-pull}5879[#5879] // end 8.15.4 relnotes // begin 8.15.3 relnotes [[release-notes-8.15.3]] == {fleet} and {agent} 8.15.3 Review important information about the {fleet} and {agent} 8.15.3 release. [discrete] [[known-issues-8.15.3]] === Known issues [[known-issue-issue-41355-8.15.3]] .The memory usage of {beats} based integrations is not correctly limited by the number of events actively in the memory queue, but rather the maximum size of the memory queue regardless of usage. [%collapsible] ==== *Details* In 8.15, events in the memory queue are not freed when they are acknowledged (as intended), but only when they are overwritten by later events in the queue buffer. This means for example if a configuration has a queue size of 5000, but the input data is low-volume and only 100 events are active at once, then the queue will gradually store more events until reaching 5000 in memory at once, then start replacing those with new events. See {beats} issue link:https://github.com/elastic/beats/issues/41355[#41355]. *Impact* + Memory usage may be higher than in previous releases depending on the throughput of {agent}. A fix is planned for 8.15.4. - The worst memory increase is for low-throughput configs with large queues. - For users whose queues were already sized proportionate to their throughput, memory use is increased but only marginally. - Affected users can mitigate the higher memory usage by lowering their queue size. ==== [discrete] [[security-updates-8.15.3]] === Security updates {agent}:: * Update Go version to 1.22.8. {agent-pull}5718[#5718] [discrete] [[enhancements-8.15.3]] === Enhancements {agent}:: * Adjust the default memory requests and limits for {agent} when it runs in a Kubernetes cluster. {agent-pull}5614[#5614] {agent-issue}5613[#5613] {agent-issue}4729[#4729] * Use a metadata watcher for ReplicaSets in the K8s provider to collect only the name and OwnerReferences, which are used to connect Pods to Deployments and DaemonSets. {agent-pull}5699[#5699] {agent-issue}5623[#5623] [discrete] [[bug-fixes-8.15.3]] === Bug fixes {agent}:: * Add `pprof` endpoints to the monitoring server if they're enabled in the {agent} configuration. {agent-pull}5562[#5562] * Stop the `elastic-agent inspect` command from printing the output configuration twice. {agent-pull}5692[#5692] {agent-issue}4471[#4471] // end 8.15.3 relnotes // begin 8.15.2 relnotes [[release-notes-8.15.2]] == {fleet} and {agent} 8.15.2 Review important information about the {fleet} and {agent} 8.15.2 release. [discrete] [[known-issues-8.15.2]] === Known issues [[known-issue-issue-41355-8.15.2]] .The memory usage of {beats} based integrations is not correctly limited by the number of events actively in the memory queue, but rather the maximum size of the memory queue regardless of usage. [%collapsible] ==== *Details* In 8.15, events in the memory queue are not freed when they are acknowledged (as intended), but only when they are overwritten by later events in the queue buffer. This means for example if a configuration has a queue size of 5000, but the input data is low-volume and only 100 events are active at once, then the queue will gradually store more events until reaching 5000 in memory at once, then start replacing those with new events. See {beats} issue link:https://github.com/elastic/beats/issues/41355[#41355]. *Impact* + Memory usage may be higher than in previous releases depending on the throughput of {agent}. A fix is planned for 8.15.4. - The worst memory increase is for low-throughput configs with large queues. - For users whose queues were already sized proportionate to their throughput, memory use is increased but only marginally. - Affected users can mitigate the higher memory usage by lowering their queue size. ==== [discrete] [[enhancements-8.15.2]] === Enhancements Fleet:: * Bump the maximum supported package spec version to 3.2. ({kibana-pull}193574[#193574]) [discrete] [[bug-fixes-8.15.2]] === Bug fixes Fleet:: * Prevent extra `agent_status` call with empty `policyId`, resulting in incorrect agent count on the `Edit Integration` page. ({kibana-pull}192549[#192549]) * Set the correct title for the `Restart upgrade` agent modal. ({kibana-pull}192536[#192536]) {agent}:: * Add the `health_check` extension to the `otel.yml` file bundled with the {agent} package, in order to prevent installation of the `open-telemetry/opentelemetry-collector` Helm chart from failing. {agent-pull}5369[#5369] {agent-issue}5092[#5092] * Fix bug that prevented the {beats} {es} output from recovering from an interrupted connection. {beats-pull}40769[#40796] {beats-issue}40705[#40705] * Prevent the {agent} from crashing when self unenrolling due to too many authentication failures against {fleet-server}. {agent-pull}5438[#5438] {agent-issue}5434[#5434] * Set the default log level when an {agent} policy is changed and a log level is not set in the policy. {agent-pull}5452[#5452] {agent-issue}5451[#5451] {fleet-server}:: * Enable missing warnings for configuration options that have been deprecated throughout the 8.x lifecycle. {fleet-server-pull}3901[#3901] // end 8.15.2 relnotes // begin 8.15.1 relnotes [[release-notes-8.15.1]] == {fleet} and {agent} 8.15.1 Review important information about the {fleet} and {agent} 8.15.1 release. [discrete] [[bug-fixes-8.15.1]] === Bug fixes {fleet}:: * Remove duplicative retries from client-side requests to APIs that depend on EPR ({kibana-pull}190722[#190722]). * Add mappings for properties of nested objects that were previously omitted ({kibana-pull}191730[#191730]). {agent}:: * Fix the Debian packaging to properly copy the `state.enc` and `state.yml` files to the new version of the {agent}. {agent-pull}5260[#5260] {agent-issue}5101[#5101] * Switch from wall clock to montonic clocks for component check-in calculation. {agent-pull}5284[#5284] {agent-issue}5277[#5277] * For a failed installation, return a `nil` error instead of `syscall.Errno(0)` which indicates a successful operation on Windows. {agent-pull}5317[#5317] {agent-issue}4496[#4496] [discrete] [[known-issues-8.15.1]] === Known issues [[known-issue-issue-40705]] .{beats} based integrations stop publishing data after a network error unless restarted. [%collapsible] ==== *Details* A bugfix merged for 8.15.1 can cause repeated `Get \"https://${ELASTICSEARCH_HOST}:443\": context canceled` errors after a transient network error (for example DNS failure) that prevent {agent} integrations based on {beats} from publishing data. {agent} must be restarted for publishing to continue. See {beats} issue link:https://github.com/elastic/beats/issues/40705[#40705] for details. *Impact* + Avoid upgrading to 8.15.1. ==== [[known-issue-issue-191730]] .Fleet configures additional properties in some nested objects in index templates of integrations. [%collapsible] ==== *Details* A bugfix intended to be released in 8.16.0 was also included in 8.15.1. It fixes an actual issue where some mappings were not being generated, but this also includes additional mappings when installing some integrations in 8.15.1 that were not included when using 8.15.0. *Impact* + Users may notice that some index templates include additional mappings for the same package versions. ==== [[known-issue-issue-41355-8.15.1]] .The memory usage of {beats} based integrations is not correctly limited by the number of events actively in the memory queue, but rather the maximum size of the memory queue regardless of usage. [%collapsible] ==== *Details* In 8.15, events in the memory queue are not freed when they are acknowledged (as intended), but only when they are overwritten by later events in the queue buffer. This means for example if a configuration has a queue size of 5000, but the input data is low-volume and only 100 events are active at once, then the queue will gradually store more events until reaching 5000 in memory at once, then start replacing those with new events. See {beats} issue link:https://github.com/elastic/beats/issues/41355[#41355]. *Impact* + Memory usage may be higher than in previous releases depending on the throughput of {agent}. A fix is planned for 8.15.4. - The worst memory increase is for low-throughput configs with large queues. - For users whose queues were already sized proportionate to their throughput, memory use is increased but only marginally. - Affected users can mitigate the higher memory usage by lowering their queue size. ==== // end 8.15.1 relnotes // begin 8.15.0 relnotes [[release-notes-8.15.0]] == {fleet} and {agent} 8.15.0 Review important information about the {fleet} and {agent} 8.15.0 release. [discrete] [[security-updates-8.15.0]] === Security updates {fleet-server}:: * Update {fleet-server} Go version to 1.22.5. {fleet-server-pull}3681[#3681] [discrete] [[known-issues-8.15.0]] === Known issues [[known-issue-issue-40608]] .Azure EventHub input for {agent} fails to start on Windows [%collapsible] ==== *Details* The Azure EventHub input fails to start on {agent} version 8.15 running on Windows. The {agent} status will be reported as unhealthy. See {beats} issue link:https://github.com/elastic/beats/issues/40608[#40608] for details. *Impact* + If you're using {agent} on Windows with any integration which makes use of the Azure EventHub input, we recommend not upgrading {agent} to version 8.15.0 and instead waiting for a later release. A fix is planned for version 8.15.1. ==== [[known-issue-issue-41355]] .The memory usage of {beats} based integrations is not correctly limited by the number of events actively in the memory queue, but rather the maximum size of the memory queue regardless of usage. [%collapsible] ==== *Details* In 8.15, events in the memory queue are not freed when they are acknowledged (as intended), but only when they are overwritten by later events in the queue buffer. This means for example if a configuration has a queue size of 5000, but the input data is low-volume and only 100 events are active at once, then the queue will gradually store more events until reaching 5000 in memory at once, then start replacing those with new events. See {beats} issue link:https://github.com/elastic/beats/issues/41355[#41355]. *Impact* + Memory usage may be higher than in previous releases depending on the throughput of {agent}. A fix is planned for 8.15.4. - The worst memory increase is for low-throughput configs with large queues. - For users whose queues were already sized proportionate to their throughput, memory use is increased but only marginally. - Affected users can mitigate the higher memory usage by lowering their queue size. ==== [discrete] [[new-features-8.15.0]] === New features The 8.15.0 release Added the following new and notable features. {fleet-server}:: * When {fleet-server} runs in `elastic-agent` mode, it's now able to use the enrollment configuration options in `output.elasticsearch.bootstrap` from its policy, instead of overwriting the matching keys in `output.elasticsearch`. {fleet-server-pull}3506[#3506] {fleet-server-issue}3464[#3464] * As part of making {fleet} space aware, {fleet-server} now adds a `namespaces` property to created `.fleet-*` documents. {fleet-server-pull}3535[#3535] {fleet-server-issue}3505[#3505] {agent}:: * Enable {agent} to monitor and report usage metrics for {elastic-endpoint}. {agent-pull}4789[#4789] {agent-issue}4083[#4083] * Add the AWS Asset Inventory input to Cloudbeat. {agent-pull}4804[#4804] * Unhide the `--unprivileged` option for the `elastic-agent install` command and mark the usage of the flag as being in a `beta` technical preview state. {agent-pull}4914[#4914] * To ensure that {agent} starts correctly when run in a container, ensure that the `statePath` set by the container command generates a Unix socket path that is smaller than 108 characters. {agent-pull}4909[#4909] * Enable {agent} to receive an event logger configuration through {fleet}. {agent-pull}4932[#4932] {agent-issue}4874[#4874] [discrete] [[enhancements-8.15.0]] === Enhancements {fleet}:: * Use API key for standalone agent onboarding. ({kibana-pull}187133[#187133]) //* Add action for upgrading all agents on a policy. ({kibana-pull}186827[#186827]) //* Change agent policies in edit package policy page. ({kibana-pull}186084[#186084]) //* Create shared package policy. ({kibana-pull}185916[#185916]) * Make {fleet} & Integrations layouts full width. ({kibana-pull}186056[#186056]) * Add support for setting `add_fields` processors on all agents under an agent policy. ({kibana-pull}184693[#184693]) //* Introduce `policy_ids` in package policy SO ({kibana-pull}184636[#184636]) * Add force flag to delete `agent_policies` API. ({kibana-pull}184419[#184419]) * Surface option to delete diagnostics files. ({kibana-pull}183690[#183690]) * Add data tags to agent policy APIs. ({kibana-pull}183563[#183563]) * Allow to reset log level for agents >= 8.15.0. ({kibana-pull}183434[#183434]) * Add support for mappings with `store: true`. ({kibana-pull}183390[#183390]) * Add warning if need root integrations trying to be used with unprivileged agents. ({kibana-pull}183283[#183283]) * Add unprivileged vs privileged agent count to Fleet UI. ({kibana-pull}183077[#183077]) * Show all integration assets on detail page. ({kibana-pull}182180[#182180]) * Add overrides to package policies update endpoint. ({kibana-pull}181453[#181453]) * Enable `agent.monitoring.http` settings on agent policy UI. ({kibana-pull}180922[#180922]) * Share Modal redesign, clean up, and tests. ({kibana-pull}180406[#180406]) * UI for the custom integration creation with AI. ({kibana-pull}186304[#186304]) {fleet-server}:: * {agent} diagnostic bundles now provide additional TLS information for {fleet-server}. {fleet-server-pull}3587[#3587] {agent}:: //* Support setting {agent} log level from a {fleet} policy. {agent-pull}3090[#3090] {agent-issue}2851[#2851] // On hold based on conversation with Shaunak * Add commands to switch between {agent} `unprivileged` and `privileged` modes. {agent-pull}4621[#4621] {agent-issue}2790[#2790] * Implement reading and applying TLS configuration for a {fleet} client using the CA, certificate, and key included in a {fleet} policy. {agent-pull}4770[#4770] {agent-issue}2247[#2247] {agent-issue}2248[#2248] * Add {filebeat} benchmark input to {agent}. {agent-issue}4849[#4849] * Add a `conn` param and a `conn-skip` flag to the {agent} diagnostics command. {agent-pull}4946[#4946] {agent-issue}4880[#4880] * Add the ability for a variable to not be expanded and replaced in {agent} inputs. {agent-pull}5035[#5035] {agent-issue}2177[#2177] * Inject the `proxy_url` value into {endpoint}'s {es} output configuration, and {endpoint} or {apm}'s {fleet} configuration if the attribute is missing and either the `HTTPS_PROXY` or `HTTP_PROXY` environment variable is set. {agent-pull}5044[#5044] {agent-issue}2602[#2602] [discrete] [[bug-fixes-8.15.0]] === Bug fixes {fleet}:: * Fix navigating back to Agent policy integration list. ({kibana-pull}189165[#189165]) * Fix copy agent policy, missed bump revision. ({kibana-pull}188935[#188935]) * Force field `enabled=false` on inputs that have all their streams disabled. ({kibana-pull}188919[#188919]) * Fill in empty values for `constant_keyword` fields from existing mappings. ({kibana-pull}188145[#188145]) * Enrollment token table may show an empty last page. ({kibana-pull}188049[#188049]) * Separate `showInactive` from unenrolled status filter. ({kibana-pull}187960[#187960]) * Missing policy filter in Fleet Server check to enable secrets. ({kibana-pull}187935[#187935]) * Allow preconfigured agent policy only with name and ID. ({kibana-pull}187542[#187542]) * Show warning callout in configs tab when an error occurs. ({kibana-pull}187487[#187487]) * Enable rollover in custom integrations install when getting `mapper_exception` error. ({kibana-pull}186991[#186991]) * Add concurrency limit to EPM bulk install API and fix duplicate installations. ({kibana-pull}185900[#185900]) * Include inactive agents in agent policy agent count. ({kibana-pull}184517[#184517]) * Fix KQL filtering. ({kibana-pull}183757[#183757]) * Prevent concurrent runs of Fleet setup. ({kibana-pull}183636[#183636]) {fleet-server}:: * Support receiving the download rate sent by {agent} in string format. {fleet-server-pull}3677[#3677] {fleet-server-issue}3446[#3446] {agent}:: * When {agent} starts, wait for Watcher to start before releasing resources associated with it. {agent-pull}4834[#4834] {agent-issue}2190[#2190] * For the Kubernetes provider, fix the namespace filter on watchers started by a pod and service eventer. {agent-pull}4975[#4975] * Adjust the {agent} `container` subcommand to write the `container-paths.yml` configuration into the `STATE_PATH` on startup. {agent-pull}4995[#4995] * Apply setting capabilities to the correct binary. {agent-pull}5070[#5070] * Reduce {agent} image size by setting capabilities in the builder Docker image instead of the final image. {agent-pull}5070[#5073] * Fix an issue where installation can fail on Windows systems in the case that the user doesn't have a home directory. {agent-pull}5118[#5118] {agent-issue}5019[#5019] // end 8.15.0 relnotes // --------------------- //TEMPLATE //Use the following text as a template. Remember to replace the version info. // begin 8.7.x relnotes //[[release-notes-8.7.x]] //== {fleet} and {agent} 8.7.x //Review important information about the {fleet} and {agent} 8.7.x release. //[discrete] //[[security-updates-8.7.x]] //=== Security updates //{fleet}:: //* add info //{agent}:: //* add info //[discrete] //[[breaking-changes-8.7.x]] //=== Breaking changes //Breaking changes can prevent your application from optimal operation and //performance. Before you upgrade, review the breaking changes, then mitigate the //impact to your application. //[discrete] //[[breaking-PR#]] //.Short description //[%collapsible] //==== //*Details* + // For more information, refer to {kibana-pull}PR[#PR]. //*Impact* + // For more information, refer to {fleet-guide}/fleet-server.html[Fleet Server]. //==== //[discrete] //[[notable-changes-8.13.0]] //=== Notable changes //The following are notable, non-breaking updates to be aware of: //* Changes to features that are in Technical Preview. //* Changes to log formats. //* Changes to non-public APIs. //* Behaviour changes that repair critical bugs. //{fleet}:: //* add info //{agent}:: //* add info //[discrete] //[[known-issues-8.7.x]] //=== Known issues //[[known-issue-issue#]] //.Short description //[%collapsible] //==== //*Details* // //*Impact* + // //==== //[discrete] //[[deprecations-8.7.x]] //=== Deprecations //The following functionality is deprecated in 8.7.x, and will be removed in //8.7.x. Deprecated functionality does not have an immediate impact on your //application, but we strongly recommend you make the necessary updates after you //upgrade to 8.7.x. //{fleet}:: //* add info //{agent}:: //* add info //[discrete] //[[new-features-8.7.x]] //=== New features //The 8.7.x release Added the following new and notable features. //{fleet}:: //* add info //{agent}:: //* add info //[discrete] //[[enhancements-8.7.x]] //=== Enhancements //{fleet}:: //* add info //{agent}:: //* add info //[discrete] //[[bug-fixes-8.7.x]] //=== Bug fixes //{fleet}:: //* add info //{agent}:: //* add info // end 8.7.x relnotes