Beats auditbeat 9.5.5

What's new in 9.5.5

Features and enhancements
All
- Update Go to 1.26.8. #53026
Filebeat
- Add api_endpoint configuration option to gcp-pubsub input to allow overriding the default Pub/Sub API endpoint. #53080 #48923
- Filestream take_over supports from_any_id to migrate from any previous filestream input. #53122 #51307
- Reuse the UDP and Unix datagram read buffer so each packet allocates only its own length. #53490
Libbeat
- Add append_fields option to add_kubernetes_metadata processor to merge metadata into events that already have a kubernetes field without overwriting existing keys. #53098 #53094
- Reduce per-event allocations in the add_agent_metadata processor by pre-building the static metadata maps once at construction. #53477
Metricbeat
- Persist additional cluster settings in the autoops_es cluster_settings metricset. #53145
- Report archived cluster setting names in the autoops_es cluster_settings metricset. #53146 #52654
Fixes
Auditbeat
- Fix Auditbeat file_integrity kprobe leak that could prevent FIM from starting when the running kernel does not match the first candidate BTF spec. #53253 #45827
- Fix process misattribution in system/socket where TCP/UDP flows were attributed to wrong processes. #53421 #44741
Filebeat
- Fix the Elasticsearch state store writing other inputs of the same type to the first input's index. #53178 #53034
- Reconnect the ETW input when its real-time session is stopped and restarted. #53112 #49984
- Fix race condition in Kafka input when multiple inputs are configured. #53115 #34919
- Fix Azure AD entity analytics accumulating stale registered owners and users on devices. #53134 #53132
- Fix Active Directory entity analytics panic when ssl.certificate_authorities is set. #53218
- Fix EntraID entity analytics collection behavior for deleted devices when using minimal state mode. #53254 #20
- Respond to http_endpoint requests that contain no events instead of closing the connection. #53261
- Fix httpjson rate limiter marking the input "Degraded" when rate-limit headers are absent. #53326 #53185
- Scope the aws-s3 lexicographical polling tail to the input's bucket and key prefix. #53351 #53195
Libbeat
- Fix add_kubernetes_metadata: wait_for_metadata now prevents unenriched events at startup. #53093 #53090
- Make an ETW reader session safe to reuse and stop, and fix a lost stop that could hang shutdown. #53112 #49984
- Fix healthy input units stuck in CONFIGURING when a sibling unit fails config validation. #53299 #53292
Metricbeat …

Full release notes »