// Use these for links to issue and pulls. Note issues and pulls redirect one to
// each other on Github, so don't worry too much on using the right prefix.
:issue: https://github.com/elastic/beats/issues/
:pull: https://github.com/elastic/beats/pull/

=== Elastic Agent version HEAD

==== Breaking changes

- Docker container is not run as root by default. {pull}21213[21213]
- Read Fleet connection information from `fleet.*` instead of `fleet.kibana.*`. {pull}24713[24713]
- Beats build for 32Bit Windows or Linux system will refuse to run on a 64bit system. {pull}25186[25186]
- Remove the `--kibana-url` from `install` and `enroll` command. {pull}25529[25529]
- Default to port 80 and 443 for Kibana and Fleet Server connections. {pull}25723[25723]
- Remove deprecated/undocumented IncludeCreatorMetadata setting from kubernetes metadata config options {pull}28006[28006]
- The `/processes/<subprocess>` endpoint proxies to the subprocess's monitoring endpoint, instead of querying its `/stats` endpoint {pull}28165[28165]

==== Bugfixes
- Fix rename *ConfigChange to *PolicyChange to align on changes in the UI. {pull}20779[20779]
- Thread safe sorted set {pull}21290[21290]
- Copy Action store on upgrade {pull}21298[21298]
- Include inputs in action store actions {pull}21298[21298]
- Fix issue where inputs without processors defined would panic {pull}21628[21628]
- Prevent reporting ecs version twice {pull}21616[21616]
- Partial extracted beat result in failure to spawn beat {issue}21718[21718]
- Use symlink path for reexecutions {pull}21835[21835]
- Use ML_SYSTEM to detect if agent is running as a service {pull}21884[21884]
- Use local temp instead of system one {pull}21883[21883]
- Fix issue with named pipes on Windows 7 {pull}21931[21931]
- Rename monitoring index from `elastic.agent` to `elastic_agent` {pull}21932[21932]
- Fix missing elastic_agent event data {pull}21994[21994]
- Ensure shell wrapper path exists before writing wrapper on install {pull}22144[22144]
- Fix deb/rpm packaging for Elastic Agent {pull}22153[22153]
- Fix composable input processor promotion to fix duplicates {pull}22344[22344]
- Fix sysv init files for deb/rpm installation {pull}22543[22543]
- Fix shell wrapper for deb/rpm packaging {pull}23038[23038]
- Fixed parsing of npipe URI {pull}22978[22978]
- Remove artifacts on transient download errors {pull}23235[23235]
- Support for linux/arm64 {pull}23479[23479]
- Skip top level files when unziping archive during upgrade {pull}23456[23456]
- Do not take ownership of Endpoint log path {pull}23444[23444]
- Fixed fetching DBus service PID {pull}23496[23496]
- Fix issue of missing log messages from filebeat monitor {pull}23514[23514]
- Increase checkin grace period to 30 seconds {pull}23568[23568]
- Fix libbeat from reporting back degraded on config update {pull}23537[23537]
- Rewrite check if agent is running with admin rights on Windows {pull}23970[23970]
- Fix issues with dynamic inputs and conditions {pull}23886[23886]
- Select default agent policy if no enrollment token provided. {pull}23973[23973]
- Fix bad substitution of API key. {pull}24036[24036]
- Fix docker enrollment issue related to Fleet Server change. {pull}24155[24155]
- Improve log on failure of Endpoint Security installation. {pull}24429[24429]
- Verify communication to Kibana before updating Fleet client. {pull}24489[24489]
- Fix nil pointer when null is generated as list item. {issue}23734[23734]
- Add support for filestream input. {pull}24820[24820]
- Add check for URL set when cert and cert key. {pull}24904[24904]
- Fix install command for Fleet Server bootstrap, remove need for --enrollment-token when using --fleet-server {pull}24981[24981]
- Respect host configuration for exposed processes endpoint {pull}25114[25114]
- Set --inscure in container when FLEET_SERVER_ENABLE and FLEET_INSECURE set {pull}25137[25137]
- Restart process on output change {pull}24907[24907]
- Fixed: limit for retries to Kibana configurable {issue}25063[25063]
- Fix issue with status and inspect inside of container {pull}25204[25204]
- Remove FLEET_SERVER_POLICY_NAME env variable as it was not used {pull}25149[25149]
- Reduce log level for listener cleanup to debug {pull}25274
- Passing in policy id to container command works {pull}25352[25352]
- Reduce log level for listener cleanup to debug {pull}25274[25274]
- Delay the restart of application when a status report of failure is given {pull}25339[25339]
- Don't log when upgrade capability doesn't apply {pull}25386[25386]
- Fixed issue when unversioned home is set and invoked watcher failing with ENOENT {issue}25371[25371]
- Fixed Elastic Agent: expecting Dict and received *transpiler.Key for '0' {issue}24453[24453]
- Fix AckBatch to do nothing when no actions passed {pull}25562[25562]
- Add error log entry when listener creation fails {issue}23483[23482]
- Handle case where policy doesn't contain Fleet connection information {pull}25707[25707]
- Fix fleet-server.yml spec to not overwrite existing keys {pull}25741[25741]
- Agent sends wrong log level to Endpoint {issue}25583[25583]
- Fix startup with failing configuration {pull}26057[26057]
- Change timestamp in elatic-agent-json.log to use UTC {issue}25391[25391]
- Fix add support for Logstash output. {pull}24305[24305]
- Do not log Elasticsearch configuration for monitoring output when running with debug. {pull}26583[26583]
- Fix issue where proxy enrollment options broke enrollment command. {pull}26749[26749]
- Remove symlink.prev from previously failed upgrade {pull}26785[26785]
- Fix apm-server supported outputs not being in sync with supported output types. {pull}26885[26885]
- Set permissions during installation {pull}26665[26665]
- Disable monitoring during fleet-server bootstrapping. {pull}27222[27222]
- Fix issue with atomic extract running in K8s {pull}27396[27396]
- Fix issue with install directory in state path in K8s {pull}27396[27396]
- Change output.elasticsearch.proxy_disabled flag to output.elasticsearch.proxy_disable so fleet uses it. {issue}27670[27670] {pull}27671[27671]
- Add validation for certificate flags to ensure they are absolute paths. {pull}27779[27779]
- Migrate state on upgrade {pull}27825[27825]
- Add "_monitoring" suffix to monitoring instance names to remove ambiguity with the status command. {issue}25449[25449]
- Ignore ErrNotExists when fixing permissions. {issue}27836[27836] {pull}27846[27846]
- Snapshot artifact lookup will use agent.download proxy settings. {issue}27903[27903] {pull}27904[27904]
- Fix lazy acker to only add new actions to the batch. {pull}27981[27981]
- Allow HTTP metrics to run in bootstrap mode. Add ability to adjust timeouts for Fleet Server. {pull}28260[28260]
- Increase the download artifact timeout to 10mins and add log download statistics. {pull}31461[31461]
- Add filemod times to files in diagnostics collect bundle. {pull}31986[31986]
- Allow ':' characters in dynamic variables. {pull}32407[32407]
- Allow the - char to appear as part of variable names in eql expressions. {pull}32350[32350]
- Allow the / char to appear as part of variable names in eql expressions. {pull}32528{32528}
- Fix add_fields processor on Docker provider {pull}33269{33269}

==== New features

- Prepare packaging for endpoint and asc files {pull}20186[20186]
- Improved version CLI {pull}20359[20359]
- Enroll CLI now restarts running daemon {pull}20359[20359]
- Add restart CLI cmd {pull}20359[20359]
- Add new `synthetics/*` inputs to run Heartbeat {pull}20387[20387]
- Users of the Docker image can now pass `FLEET_ENROLL_INSECURE=1` to include the `--insecure` flag with the `elastic-agent enroll` command {issue}20312[20312] {pull}20713[20713]
- Add `docker` composable dynamic provider. {pull}20842[20842]
- Add support for dynamic inputs with providers and `{{variable|"default"}}` substitution. {pull}20839[20839]
- Add support for EQL based condition on inputs {pull}20994[20994]
- Send `fleet.host.id` to Endpoint Security {pull}21042[21042]
- Add `install` and `uninstall` subcommands {pull}21206[21206]
- Use new form of fleet API paths {pull}21478[21478]
- Add `kubernetes` composable dynamic provider. {pull}21480[21480]
- Send updating state {pull}21461[21461]
- Add `elastic.agent.id` and `elastic.agent.version` to published events from filebeat and metricbeat {pull}21543[21543]
- Add `upgrade` subcommand to perform upgrade of installed Elastic Agent {pull}21425[21425]
- Update `fleet.yml` and Kibana hosts when a policy change updates the Kibana hosts {pull}21599[21599]
- Update `install` command to perform enroll before starting Elastic Agent {pull}21772[21772]
- Update `fleet.kibana.path` from a POLICY_CHANGE {pull}21804[21804]
- Removed `install-service.ps1` and `uninstall-service.ps1` from Windows .zip packaging {pull}21694[21694]
- Add `priority` to `AddOrUpdate` on dynamic composable input providers communication channel {pull}22352[22352]
- Ship `endpoint-security` logs to elasticsearch {pull}22526[22526]
- Log level reloadable from fleet {pull}22690[22690]
- Push log level downstream {pull}22815[22815]
- Add metrics collection for Agent {pull}22793[22793]
- Add support for Fleet Server {pull}23736[23736]
- Add support for enrollment with local bootstrap of Fleet Server {pull}23865[23865]
- Add TLS support for Fleet Server {pull}24142[24142]
- Add support for Fleet Server running under Elastic Agent {pull}24220[24220]
- Add CA support to Elastic Agent docker image {pull}24486[24486]
- Add k8s secrets provider for Agent {pull}24789[24789]
- Add STATE_PATH, CONFIG_PATH, LOGS_PATH to Elastic Agent docker image {pull}24817[24817]
- Add status subcommand {pull}24856[24856]
- Add leader_election provider for k8s {pull}24267[24267]
- Add --fleet-server-service-token and FLEET_SERVER_SERVICE_TOKEN options {pull}25083[25083]
- Keep http and logging config during enroll {pull}25132[25132]
- Log output of container to $LOGS_PATH/elastic-agent-start.log when LOGS_PATH set {pull}25150[25150]
- Use `filestream` input for internal log collection. {pull}25660[25660]
- Enable agent to send custom headers to kibana/ES {pull}26275[26275]
- Set `agent.id` to the Fleet Agent ID in events published from inputs backed by Beats. {issue}21121[21121] {pull}26394[26394] {pull}26548[26548]
- Add proxy support to artifact downloader and communication with fleet server. {pull}25219[25219]
- Add proxy support to enroll command. {pull}26514[26514]
- Enable configuring monitoring namespace {issue}26439[26439]
- Communicate with Fleet Server over HTTP2. {pull}26474[26474]
- Pass logging.metrics.enabled to beats to stop beats from adding metrics into their logs. {issue}26758[26758] {pull}26828[26828]
- Support Node and Service autodiscovery in kubernetes dynamic provider. {pull}26801[26801]
- Increase Agent's mem limits in k8s. {pull}27153[27153]
- Add new --enroll-delay option for install and enroll commands. {pull}27118[27118]
- Add link to troubleshooting guide on fatal exits. {issue}26367[26367] {pull}27236[27236]
- Agent now adapts the beats queue size based on output settings. {issue}26638[26638] {pull}27429[27429]
- Support ephemeral containers in Kubernetes dynamic provider. {issue}27020[#27020] {pull}27707[27707]
- Add complete k8s metadata through composable provider. {pull}27691[27691]
- Add diagnostics command to gather beat metadata. {pull}28265[28265]
- Add diagnostics collect command to gather beat metadata, config, policy, and logs and bundle it into an archive. {pull}28461[28461]
- Add `KIBANA_FLEET_SERVICE_TOKEN` to Elastic Agent container. {pull}28096[28096]
- Allow pprof endpoints for elastic-agent or beats if enabled. {pull}28983[28983] {pull}29155[29155]
- Mark username/password settings for fleet-server as deprecated. {pull}29434[29434]
- Add --fleet-server-es-ca-trusted-fingerprint flag to allow agent/fleet-server to work with elasticsearch clusters using self signed certs. {pull}29128[29128]
- Discover changes in Kubernetes nodes metadata as soon as they happen. {pull}23139[23139]
- Add results of inspect output command into archive produced by diagnostics collect. {pull}29902[29902]
- Add support for loading input configuration from external configuration files in standalone mode. You can load inputs from YAML configuration files under the folder `{path.config}/inputs.d`. {pull}30087[30087]
- Install command will skip install/uninstall steps when installation via package is detected on Linux distros. {pull}30289[30289]
- Add support for enabling the metrics buffer endpoint in the elastic-agent and beats it runs. diagnostics collect command will gather metrics-buffer data if enabled. {pull}30471[30471]
- Elastic Agent now propagates ID for Filebeat input. {pull}30386[30386]
- Fix incorrectly creating a filebeat redis input when a policy contains a packetbeat redis input. {issue}[427] {pull}[700]
