Packetbeat is an open source network packet analyzer that ships the data to Elasticsearch. Think of it like a distributed real-time Wireshark with a lot more analytics features. The Packetbeat shippers sniff the traffic between your application processes, parse on the fly protocols like HTTP, MySQL, PostgreSQL, Redis or Thrift and correlate the messages into transactions. For each transaction, the shipper inserts a JSON document into Elasticsearch, where it is stored and indexed. You can then use Kibana to view key metrics and do ad-hoc queries against the data.
What's new in 9.5.5
Features and enhancements All - Update Go to 1.26.8. #53026 Filebeat - Add api_endpoint configuration option to gcp-pubsub input to allow overriding the default Pub/Sub API endpoint. #53080 #48923 - Filestream take_over supports from_any_id to migrate from any previous filestream input. #53122 #51307 - Reuse the UDP and Unix datagram read buffer so each packet allocates only its own length. #53490 Libbeat - Add append_fields option to add_kubernetes_metadata processor to merge metadata into events that already have a kubernetes field without overwriting existing keys. #53098 #53094 - Reduce per-event allocations in the add_agent_metadata processor by pre-building the static metadata maps once at construction. #53477 Metricbeat - Persist additional cluster settings in the autoops_es cluster_settings metricset. #53145 - Report archived cluster setting names in the autoops_es cluster_settings metricset. #53146 #52654 Fixes Auditbeat - Fix Auditbeat file_integrity kprobe leak that could prevent FIM from starting when the running kernel does not match the first candidate BTF spec. #53253 #45827 - Fix process misattribution in system/socket where TCP/UDP flows were attributed to wrong processes. #53421 #44741 Filebeat - Fix the Elasticsearch state store writing other inputs of the same type to the first input's index. #53178 #53034 - Reconnect the ETW input when its real-time session is stopped and restarted. #53112 #49984 - Fix race condition in Kafka input when multiple inputs are configured. #53115 #34919 - Fix Azure AD entity analytics accumulating stale registered owners and users on devices. #53134 #53132 - Fix Active Directory entity analytics panic when ssl.certificate_authorities is set. #53218 - Fix EntraID entity analytics collection behavior for deleted devices when using minimal state mode. #53254 #20 - Respond to http_endpoint requests that contain no events instead of closing the connection. #53261 - Fix httpjson rate limiter marking the input "Degraded" when rate-limit headers are absent. #53326 #53185 - Scope the aws-s3 lexicographical polling tail to the input's bucket and key prefix. #53351 #53195 Libbeat - Fix add_kubernetes_metadata: wait_for_metadata now prevents unenriched events at startup. #53093 #53090 - Make an ETW reader session safe to reuse and stop, and fix a lost stop that could hang shutdown. #53112 #49984 - Fix healthy input units stuck in CONFIGURING when a sibling unit fails config validation. #53299 #53292 Metricbeat …
