Skip to content
26 changes: 25 additions & 1 deletion docs/release-notes/known-issues.md
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,31 @@ As a workaround, and to prevent crashes, Beats will ignore any filters provided
% On [Month/Day/Year], this issue was resolved.
:::


:::{dropdown} Filebeat's Filestream input does not validate `clean_inactive`.
**Applies to**: Filebeat < 9.2.0

The Filestream input does not enforce the restrictions documented for
the `clean_inactive` option, thus allowing configurations that can
lead to data re-ingestion issues.

**Fix planned in**: 9.2.0 by [PR #46373](https://github.com/elastic/beats/pull/46373)
:::

:::{dropdown} Setting `clean_inactive` to `0` in Filebeat's Filestream input will cause data to be re-ingested on every restart.
**Applies to**: Filebeat >= 8.14.0 and < 9.2.0

When `clean_inactive` is set to `0`, Filestream will clean the state of all files
on start up, effectively re-ingesting all files on restart.

**Workaround**
- For Filestream >= 8.16.0 and < 9.2.0: disable `clean_inactive` by setting `clean_inactive: -1`.
- For Filestream >= 8.14.0 and < 8.16.0 set `clean_inactive` to a very
large value. For example, use `clean_inactive: 43800h0m0s`, which is 5 years.

**Fix planned in**: 9.2.0 by [PR #46373](https://github.com/elastic/beats/pull/46373)
:::

:::{dropdown} Beats panic on restart when "restart_on_cert_change" is enabled on Linux

**Applies to**: v8.16.6+, v8.17.3+, v8.18.0+, v8.19.0+, v9.0.0+, and v9.1.0+
Expand Down Expand Up @@ -173,5 +198,4 @@ seccomp:

% **Resolved**
% This issue was resolved by updating the default seccomp policy to include the `eventfd2` syscall. To apply the fix, please upgrade to version 8.18.7, 8.19.4, 9.0.7, 9.1.4, or any subsequent release.

:::
Loading