Add Beats 9.5.0 release notes - #52254
Open
ebeahan wants to merge 1 commit into
Open
Conversation
ebeahan
requested review from
khushijain21 and
leehinman
and removed request for
a team
July 25, 2026 15:17
botelastic
Bot
added
the
needs_team
Contributor
🤖 GitHub commentsJust comment with:
|
ebeahan
added
docs
release
Team:Docs
Contributor
🔍 Preview links for changed docsThis PR only changes snippets or data files. No direct page links are available. |
Contributor
Elastic Docs Style Checker (Vale)Summary: 4 warnings, 3 suggestions found
|
| File | Line | Rule | Message |
|---|---|---|---|
| docs/release-notes/_snippets/9.5.0/index.md | 30 | Elastic.Latinisms | Latin terms and abbreviations are a common source of confusion. Use 'versus' instead of 'vs'. |
| docs/release-notes/_snippets/9.5.0/index.md | 56 | Elastic.BritishSpellings | Use American English spelling 'behavior' instead of British English 'behaviour'. |
| docs/release-notes/_snippets/9.5.0/index.md | 74 | Elastic.BritishSpellings | Use American English spelling 'behavior' instead of British English 'behaviour'. |
| docs/release-notes/_snippets/9.5.0/index.md | 75 | Elastic.BritishSpellings | Use American English spelling 'behavior' instead of British English 'behaviour'. |
💡 Suggestions (3): Optional style improvements. Apply when helpful.
| File | Line | Rule | Message |
|---|---|---|---|
| docs/release-notes/_snippets/9.5.0/index.md | 31 | Elastic.WordChoice | Consider using 'deactivate, deselect, hide, turn off' instead of 'Disable', unless the term is in the UI. |
| docs/release-notes/_snippets/9.5.0/index.md | 70 | Elastic.Semicolons | Use semicolons judiciously. |
| docs/release-notes/_snippets/9.5.0/index.md | 205 | Elastic.WordChoice | Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI. |
The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.
vishaangelova
approved these changes
Jul 27, 2026
vishaangelova
left a comment
vishaangelova
left a comment
Member
There was a problem hiding this comment.
Added some suggestions to improve formatting/wording. Some PRs are missing?
Approving to unblock.
|
|
||
| **All** | ||
|
|
||
| * Introduce `wait_for_metadata` and `wait_for_metadata_timeout` and `wait_for_metadata_retry_period` settings to `add_kubernetes_metadata` processor to allow waiting for Kubernetes API availability before processing events. [#50509](https://github.com/elastic/beats/pull/50509) |
Member
There was a problem hiding this comment.
Suggested change
| * Introduce `wait_for_metadata` and `wait_for_metadata_timeout` and `wait_for_metadata_retry_period` settings to `add_kubernetes_metadata` processor to allow waiting for Kubernetes API availability before processing events. [#50509](https://github.com/elastic/beats/pull/50509) | |
| * Introduce `wait_for_metadata`, `wait_for_metadata_timeout`, and `wait_for_metadata_retry_period` settings to `add_kubernetes_metadata` processor to allow waiting for Kubernetes API availability before processing events. [#50509](https://github.com/elastic/beats/pull/50509) |
Comment on lines
+11
to
+19
| * Retry connecting to Docker in `add_docker_metadata` when the initial connection attempt fails. [#50595](https://github.com/elastic/beats/pull/50595) | ||
|
|
||
| The `add_docker_metadata` processor now retries connecting to Docker at | ||
| startup until `wait_for_metadata_timeout` expires. The timeout defaults to | ||
| 30s and includes the initial connection attempt. Set `wait_for_metadata` to | ||
| true to block startup until Docker metadata is available. Set | ||
| `wait_for_metadata_timeout` to 0 to retry indefinitely. Configure retry | ||
| cadence with `wait_for_metadata_retry_period`. | ||
|
|
Member
There was a problem hiding this comment.
Suggested change
| * Retry connecting to Docker in `add_docker_metadata` when the initial connection attempt fails. [#50595](https://github.com/elastic/beats/pull/50595) | |
| The `add_docker_metadata` processor now retries connecting to Docker at | |
| startup until `wait_for_metadata_timeout` expires. The timeout defaults to | |
| 30s and includes the initial connection attempt. Set `wait_for_metadata` to | |
| true to block startup until Docker metadata is available. Set | |
| `wait_for_metadata_timeout` to 0 to retry indefinitely. Configure retry | |
| cadence with `wait_for_metadata_retry_period`. | |
| * Retry connecting to Docker in `add_docker_metadata` when the initial connection attempt fails. [#50595](https://github.com/elastic/beats/pull/50595) |
|
|
||
| **Beats** | ||
|
|
||
| * Replace COPILOT_GITHUB_TOKEN secret with copilot-requests:write permission in agentic workflow files. [#51293](https://github.com/elastic/beats/pull/51293) |
Member
There was a problem hiding this comment.
Suggested change
| * Replace COPILOT_GITHUB_TOKEN secret with copilot-requests:write permission in agentic workflow files. [#51293](https://github.com/elastic/beats/pull/51293) | |
| * Replace `COPILOT_GITHUB_TOKEN` secret with `copilot-requests: write` permission in agentic workflow files. [#51293](https://github.com/elastic/beats/pull/51293) |
| **Beats** | ||
|
|
||
| * Replace COPILOT_GITHUB_TOKEN secret with copilot-requests:write permission in agentic workflow files. [#51293](https://github.com/elastic/beats/pull/51293) | ||
| * Add slabqueue, a new in-memory publisher queue that shares a single event budget across multiple pipelines while keeping per-pipeline FIFOs isolated. Selectable via queue.slab (~2.5× throughput vs queue.mem in stress tests); used by default in Beat receivers to support multi-receiver intake queue sharing. [#51047](https://github.com/elastic/beats/pull/51047) |
Member
There was a problem hiding this comment.
Suggested change
| * Add slabqueue, a new in-memory publisher queue that shares a single event budget across multiple pipelines while keeping per-pipeline FIFOs isolated. Selectable via queue.slab (~2.5× throughput vs queue.mem in stress tests); used by default in Beat receivers to support multi-receiver intake queue sharing. [#51047](https://github.com/elastic/beats/pull/51047) | |
| * Add `slabqueue`, a new in-memory publisher queue that shares a single event budget across multiple pipelines while keeping per-pipeline FIFOs isolated. Selectable via `queue.slab` (~2.5× throughput versus `queue.mem` in stress tests). Used by default in Beat receivers to support multi-receiver intake queue sharing. [#51047](https://github.com/elastic/beats/pull/51047) |
|
|
||
| * Replace COPILOT_GITHUB_TOKEN secret with copilot-requests:write permission in agentic workflow files. [#51293](https://github.com/elastic/beats/pull/51293) | ||
| * Add slabqueue, a new in-memory publisher queue that shares a single event budget across multiple pipelines while keeping per-pipeline FIFOs isolated. Selectable via queue.slab (~2.5× throughput vs queue.mem in stress tests); used by default in Beat receivers to support multi-receiver intake queue sharing. [#51047](https://github.com/elastic/beats/pull/51047) | ||
| * Disable periodic metrics logging (`logging.metrics`) by default when a beat runs as an OTel Collector receiver. [#51711](https://github.com/elastic/beats/pull/51711) |
Member
There was a problem hiding this comment.
Suggested change
| * Disable periodic metrics logging (`logging.metrics`) by default when a beat runs as an OTel Collector receiver. [#51711](https://github.com/elastic/beats/pull/51711) | |
| * Turn off periodic metrics logging (`logging.metrics`) by default when a beat runs as an OTel Collector receiver. [#51711](https://github.com/elastic/beats/pull/51711) |
|
|
||
| * Use a stable status message for SQS receive errors to prevent update churn during sustained outages. | ||
| * Do not mark the CEL input's health as degraded when the maximum executions is exceeded. | ||
| * Honor the configured language when rendering Windows events. [#7332](https://github.com/elastic/sdh-beats/issues/7332) |
Member
There was a problem hiding this comment.
Suggested change
| * Honor the configured language when rendering Windows events. [#7332](https://github.com/elastic/sdh-beats/issues/7332) | |
| * Honor the configured language when rendering Windows events. [#7332](https://github.com/elastic/sdh-beats/issues/7332) |
|
|
||
| **Heartbeat** | ||
|
|
||
| * Fix panic with multiple heartbeat receivers. |
Member
There was a problem hiding this comment.
Suggested change
| * Fix panic with multiple heartbeat receivers. | |
| * Fix panic with multiple Heartbeat receivers. |
| **Libbeat** | ||
|
|
||
| * Add LDAP channel binding for Windows SSPI binds. [#49733](https://github.com/elastic/beats/pull/49733) | ||
| * Fix add_host_metadata host.geo map sharing across events causing data corruption. [#49722](https://github.com/elastic/beats/pull/49722) [#49721](https://github.com/elastic/beats/issues/49721) |
Member
There was a problem hiding this comment.
Suggested change
| * Fix add_host_metadata host.geo map sharing across events causing data corruption. [#49722](https://github.com/elastic/beats/pull/49722) [#49721](https://github.com/elastic/beats/issues/49721) | |
| * Fix `add_host_metadata` `host.geo` map sharing across events causing data corruption. [#49722](https://github.com/elastic/beats/pull/49722) [#49721](https://github.com/elastic/beats/issues/49721) |
| **Osquerybeat** | ||
|
|
||
| * Reject CPIO entries in macOS .pkg payloads whose paths escape the destination directory, preventing path traversal during extraction (CWE-22). [#51446](https://github.com/elastic/beats/pull/51446) | ||
| * Propagate osquery live-query space IDs to action response events. [#50808](https://github.com/elastic/beats/pull/50808) |
Member
There was a problem hiding this comment.
Suggested change
| * Propagate osquery live-query space IDs to action response events. [#50808](https://github.com/elastic/beats/pull/50808) | |
| * Propagate Osquery live-query space IDs to action response events. [#50808](https://github.com/elastic/beats/pull/50808) |
|
|
||
| * Reject CPIO entries in macOS .pkg payloads whose paths escape the destination directory, preventing path traversal during extraction (CWE-22). [#51446](https://github.com/elastic/beats/pull/51446) | ||
| * Propagate osquery live-query space IDs to action response events. [#50808](https://github.com/elastic/beats/pull/50808) | ||
| * Fixes serialization of ads and active columns in elastic_ntfs_file table to use boolean instead of integer. [#51629](https://github.com/elastic/beats/pull/51629) |
Member
There was a problem hiding this comment.
Suggested change
| * Fixes serialization of ads and active columns in elastic_ntfs_file table to use boolean instead of integer. [#51629](https://github.com/elastic/beats/pull/51629) | |
| * Fix the serialization of ads and active columns in `elastic_ntfs_file` table to use boolean instead of integer. [#51629](https://github.com/elastic/beats/pull/51629) |
vishaangelova
approved these changes
Jul 27, 2026
vishaangelova
left a comment
vishaangelova
left a comment
Member
There was a problem hiding this comment.
Added some suggestions to improve formatting/wording. Some PRs are missing?
Approving to unblock.
Contributor
|
Tick the box to add this pull request to the merge queue (same as
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds Beats 9.5.0 release notes.
Checklist