v2.11.0

Features

• Added "json" action to decode field and copy resulting fields into root of event (fba6388)
• Combine similiar event index failures, reporting only first message and total count (4a148b3)
• Grok action will now only remove the field if grok parsing was successful (676225e)
• Implement @metadata[receiver][name] and others against all events to allow processors to process based on connection details (this replaced agent[source] which is removed) (9ba6ba7)
• Log Carver now appends direct source of a received event to agent[source] (68b88c7)
• The @timestamp field can now be set from grok and json actions if in the correct format expected (RFC3339 with optional nanoseconds: 2006-01-02T15:04:05.999Z) (36bc467)
• TLS handshake errors are now prefixed to show they originate from a handshake (1d8a57f)

Bug Fixes

• Fix a rare race in publisher for immediately failing reconnections that can cause high CPU and pipeline freeze (e3aacc8)
• Fix crash if reconnection reusing port occurs (d5c1cc2)
• Fix potential log-carver deadlock when using lc-admin -carver and a new connection appears during the status poll (d702ce1)
• Fix potential panic in receiver if a connection is lost (3615aa3)
• Fix receiver pool not cleaning up connections in some instances and preventing shutdown, and add additional logs (f072865)
• Fix receiver shutting down and reset messages displaying incorrectly (4d7c873)
• Fix scheduling issues that can cause unexpected timeouts on new connections (b0980cc)
• Fix send congestion or send errors not causing connection shutdown and leaking connections (02c8ede)
• Fix successful ES bulk request failing with cluster block message due to cluster block handling fix (20e5751)
• Fix timeout on courier displaying two error messages, one for unexpected end (e453486)
• Float grok values and conversion to float expressions now serialize correctly to float in the Elasticsearch output (bb0f4a9)
• Receiver can cause panic during reload in Log Carver (c43f935), closes #400
• Receiver pool can sometimes crash when a disconnect occurs unexpectedly (3553db5)
• Resolve a formatting issue in Handshake failure output (2f6d77d)
• Resolve connection leakage that can cause too many open files, especially with stream input (39f87a9)
• Resolve crash introduced with cleanup code for force failed connections (a17595b)
• Resolve ES template not indexing terms for messages longer than 256 characters (99bf67f)
• Resolve force closed connections on receiver not being cleaned up fully, preventing shutdown (b6689de)
• Resolve linereader hanging on streams due to recent fix on missing lines (bdc463c)
• Resolve missing lines at end of streams due to harvester early failure (710fc3c)
• Resolve potential crash in receiver cleanup if shutdown of a connection occurs whilst draining (fcd54d6)
• Resolve potential crash when no endpoints are available to publish to (463ed63)
• Workaround some EOF errors on connections that closed gracefully (7d20247)