Packetbeat 0.5.0
Change log:
- Simplified and re-organized the way the transactions are represented in Elasticsearch. Many fields which used to be protocol specific now share the same name. For example, the old
mysql.query
,pgsql.query
andhttp.first_line
are all namedquery
now. This makes it easier to create common dashboards across protocols. - Tuned the index template to speed up indexing and to improve the experience in the UI.
- The client location is now represented as a true geopoint instead of just the country code. This makes it work much better with the Kibana 4 map visualisation.
- Changed the defaults for the
request_raw
andresponse_raw
fields to off in order to save disk space and to avoid privacy issues by default. They can be enabled on a per-protocol basis. - Added a new
params
field in which (for example) the HTTP parameters are stored. Sensitive parameters can be safely removed based on configuration. - Split code in sub-packages so it's easier to maintain and understand.
- The
Content-Type
header is always parsed, so the explicitsend_headers
option is no longer needed when you want to save the body. - Fixed GeoIP data loading in the presence of symlinks. This was problematic on some CentOS systems.
- Fixed a bug where HTTP 1.1 requests having
content-length: 0
were not correctly handled - Binaries are compiled with Go 1.4.2