Beats is the platform for building lightweight, open source data
shippers for many types of operational data you want to enrich with
Logstash, search and analyze in Elasticsearch, and visualize in Kibana.
Whether you're interested in log files, infrastructure metrics, network
packets, or any other type of data, Beats serves as the foundation for
keeping a beat on your data.
Filebeat is a lightweight, open source shipper for log file data. As the
next-generation Logstash Forwarder, Filebeat tails logs and quickly
sends this information to Logstash for further parsing and enrichment or
to Elasticsearch for centralized storage and analysis.
Metricbeat Collect metrics from your systems and services. From CPU to memory,
Redis to Nginx, and much more, Metricbeat is a lightweight way to send system
and service statistics.
Packetbeat is a lightweight network packet analyzer that sends data to Logstash
or Elasticsearch.
===> The following configuration options are available for beats7-7.17.11_17:
AUDITBEAT=off: Auditbeat
FILEBEAT=on: Filebeat
HEARTBEAT=on: Heartbeat
METRICBEAT=on: Metricbeat
PACKETBEAT=off: Packetbeat
===> Use 'make config' to modify these settings
Reason:
The following breaking changes apply to beats 7.15.0 and newer:
- All beats:
Loading Kibana assets (dashboards, index templates) rely on Saved Object API.
So to provide a reliable service, Beats can only import and export dashboards
using at least Kibana 7.15.
- Filebeat:
- Remove all alias fields pointing to ECS fields from modules. This affects
the Suricata and Traefik modules.
- Fix Crowdstrike ingest pipeline that was creating flattened process fields.
- Rename log.path to log.file.path in filestream to be consistent with log
input and ECS.
- Heartbeat:
- Remove long deprecated watch_poll functionality.
- Fix inconsistency in event.dataset values between heartbeat and fleet by
always setting this value to the monitor type / fleet dataset.
- Metricbeat:
- Fix Elasticsearch jvm.gc.collectors.old being exposed as young
Full changelog:
https://www.elastic.co/guide/en/beats/libbeat/current/release-notes-7.15.0.html
https://www.elastic.co/guide/en/beats/libbeat/current/release-notes-7.15.1.html
Reason:
Beats may not be sending data to some distributions of Elasticsearch
In this release, Elastic is enabling a licensing change that was broadly
communicated earlier in 2021. This change would imply that 7.13 instances of
Beats would fail to connect to 7.10 or earlier open source distributions of
Elasticsearch and Kibana.
The most visible effect is that sysutils/beats7 users can expect
difficulties to send data to Elastic instances hosted in AWS.
For more information, see:
https://www.elastic.co/guide/en/beats/libbeat/current/breaking-changes-7.13.html
sysutils/beats7: Remove, and point users to beats8
beats7 uses symbols from Go that were removed in go1.23, making it
unbuildable with anything beyond go1.22. Both go1.22 and go1.23 are EOL,
and I don't know of any way to fix it. It's going to become unsupported
upstream in 13 days, so its time has come.
This commit also includes a MOVED entry that directs users to the
more-modern beats8.
many: Unsupported Go dep; deprecate and schedule for removal
There are about 75 ports that depend on old, unsupported Go
versions. I've scheduled those Go versions for deletions on
2025/01/01, and so these ports are scheduled for removal on
that same day.
HOWEVER....
Likely NONE or VERY VERY FEW of these ports will actually need
to be deleted! This stems from a misunderstanding:
When go.mod says "go 1.23", it means that it requires AT LEAST
go-1.23. Locking a port to a specific go version should almost
never happen; it is reserved for when a package absolutely
(Only the first 15 lines of the commit message are shown above )
sysutils/beats7: Fix build using older version of go
syscall.SendmsgN and syscall.Recvmsg where moved to golang.org/x/sys/unix a
while back. With go-1.23, they where finally removed from syscall, and hence
the build fails. This package uses older version of some vendor packages that
where not migrated. Building with go-1.22 mitigates the problem and fixes the
build. Since we already have beats8, it is safe to assume that go-1.22 will be
more long lived in the the ports tree than beats7, so downgrading to just
building with go-1.22 fixes the problem.
PR: 287103
Approved-by: otis (with elastic hat)
sysutils/beats7: broken
Fails to build everywhere with error message
link: golang.org/x/net/internal/socket: invalid reference to syscall.recvmsg
Seems like it's not compatible with recent Go toolchains.
go: Bump go124-dependent ports
Earlier I bumped the default Go to 1.24. Ports that specify a lower
version will still build with those lower version (for now), so they
don't need a bumping. Instead I'm bumping anything that (now) has go124
as a dependency.
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
Regenerate all distfiles using gitlab as source.
This regeneration is required as the new gitlab version changed
the address and the directory the source files can be downloaded.
This commit also applies some small fixes to make sure all ports using
gitlab are buildable.
Reviewed by: mat
Approved by: portmgr
Differential Revision: https://reviews.freebsd.org/D29628
sysutils/beats7: Update to 7.9.3
Changelog for 7.9.3:
* Bugfixes:
- Affecting all Beats
- The o365audit input and o365 module now recover from an authentication
problem or other fatal errors, instead of terminating.
- Auditbeat
- system/socket: Fix a crash due to concurrent map read and write.
- Filebeat
- Add field limit check for AWS Cloudtrail flattened fields.
- Metricbeat
- Fix remote_write flaky test.
- Fix panic in Kubernetes autodiscovery caused by storing stateless
keystores.
- Remove redundant dockersock volume mount to avoid problems on Kubernetes
deployments that do not use docker as the container runtime.
PR: 250604
Submitted by: Juraj Lutter <juraj@lutter.sk>
sysutils/beats7: Update to 7.9.2
Changes since 7.9.1:
* Breaking changes
- Affecting all Beats
- Autodiscover doesn't generate any configuration when a variable is
missing. Previously it generated an incomplete configuration.
* Bugfixes
- Affecting all Beats
- Explicitly detect missing variables in autodiscover configuration,
log them at the debug level.
- Fix libbeat.output.write.bytes and libbeat.output.read.bytes metrics
of
the Elasticsearch output.
- Filebeat
- Provide backwards compatibility for the set processor when
Elasticsearch is
(Only the first 15 lines of the commit message are shown above )
sysutils/beats7: Update to 7.9.1
Changelog:
* Bugfixes:
- Affecting all Beats:
- Update replicaset group to apps/v1
- Rename cloud.provider az value to azure inside the add_cloud_metadata
processor.
- Add missing country_name geo field in add_host_metadata and
add_observer_metadata processors.
- Filebeat:
- Fix long registry migration times.
- Fix event types and categories in auditd module to comply with ECS
- Update documentation in the azure module filebeat.
- Heartbeat:
(Only the first 15 lines of the commit message are shown above )
