Skip to content

Commit 1d8c349

Browse files
robcowartrobcowart
committed
bump version to 4.0.1
1 parent 70f2dd1 commit 1d8c349

10 files changed

+64
-18
lines changed

‎CHANGELOG.md

+48-2
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,52 @@
22

33
---
44

5+
## v4.0.1
6+
7+
> **WARNING!** - If you are using a 3.x or earlier release, please refer to the v4.0.0 Breaking Changes.
8+
9+
ElastiFlow v4.0.1 is a minor release. No migration of data from v4.0.0 to v4.0.1 is required.
10+
11+
### Fixes
12+
13+
* Netflow v5 sources reporting zero bytes and packets in ECS fields has been fixed.
14+
* TSVB visualizations displaying data in bits/s now use the new `bitd` custom formatter.
15+
16+
---
17+
18+
## v4.0.0
19+
20+
> **WARNING!** - ElastiFlow v4.0.0 is a major release, and now supports Elastic Common Schema (ECS). Due to significant data model changes there is no upgrade/migration from ElastiFlow 3.x. You should either remove all 3.x indices or deploy ElastiFlow 4.0.0 to a separate environment.
21+
22+
### Breaking Changes
23+
24+
ElastiFlow v4.0.0 is built for Elasticsearch and Kibana 7.8.1 and later. No earlier versions will be supported. Please use a prior ElastiFlow release if you cannot yet upgrade to Elastic Stack 7.8.1+.
25+
26+
ElastiFlow v4.0.0 takes advantage of X-Pack Basic features, such as the Maps, SIEM and Logs apps, as well as Index Lifecycle Management (ILM). This means that you must use at least the X-Pack Basic licensed release of the Elastic Stack. The pure Apache 2.0 licensed release of the Elastic Stack will not work without disabling many features.
27+
28+
### New Features
29+
30+
* Data model has changed to leverage ECS 1.5.
31+
* Flow data can now be analyzed using the Kibana SIEM and Log apps.
32+
* Optional resolution of MAC OUIs to vendor names (disabled by default).
33+
* Kibana dark theme is now supported.
34+
* Geo IP dashboards now leverage the new Kibana Maps app.
35+
* Applications can now be defined manually by IP address and port number.
36+
* Palo Alto virtual interface indexes are translated to interfaces names.
37+
* Support for VeloCloud, Calix and various Cisco SD-WAN information elements.
38+
* KQL is now default
39+
40+
### Updates
41+
42+
* Pipeline refactored to simplify various logic, which might improve performance and throughput for some users.
43+
* YAML dictionaries intended for customization by users have been moved to the `logstash/elastiflow/user_settings` path.
44+
45+
### Fixes
46+
47+
* Client/Server detection using TCP flags is improved.
48+
49+
---
50+
551
## v4.0.0-beta1
652

753
v4.0.0 is a major release. A data migration will be required if you want to have your older data available in 4.0.0. This `BETA` release does not yet include a migration method and is intended for testing with new flow data only.
@@ -41,7 +87,7 @@ ElastiFlow v3.5.x provides support Elastic Stack 7.x. The support for document t
4187

4288
* Added support for pmacct IEs (needed for VyOS 1.2.x).
4389

44-
------
90+
---
4591

4692
## v3.5.2
4793

@@ -68,7 +114,7 @@ ElastiFlow v3.5.x provides support Elastic Stack 7.x. The support for document t
68114
* Added a lot of new Fortinet application IDs.
69115
* Update IP reputation dictionary and GeoIP DBs.
70116

71-
------
117+
---
72118

73119
## v3.5.1
74120

‎Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ LABEL org.opencontainers.image.created="$BUILD_DATE" \
2424
org.opencontainers.image.url="https://github.com/robcowart/elastiflow/README.md" \
2525
org.opencontainers.image.documentation="https://github.com/robcowart/elastiflow/DOCKER.md" \
2626
org.opencontainers.image.source="https://github.com/robcowart/elastiflow" \
27-
org.opencontainers.image.version="4.0.0" \
27+
org.opencontainers.image.version="4.0.1" \
2828
org.opencontainers.image.vendor="Robert Cowart" \
2929
org.opencontainers.image.title="ElastiFlow™ - Logstash" \
3030
org.opencontainers.image.description="Logstash with the ElastiFlow™ pipeline."

‎INSTALL.md

+4-4
Original file line numberDiff line numberDiff line change
@@ -4,19 +4,19 @@
44

55
ElastiFlow™ is built using the Elastic Stack, including Elasticsearch, Logstash and Kibana. To install and configure ElastiFlow™, you must first have a working Elastic Stack environment.
66

7-
> **WARNING!** - ElastiFlow 4.0.0 supports Elastic Common Schema (ECS). Due to significant data model changes there is no upgrade/migration from ElastiFlow 3.x. You should either remove all 3.x indices or deploy ElastiFlow 4.0.0 to a separate environment.
7+
> **WARNING!** - ElastiFlow 4.0.x supports Elastic Common Schema (ECS). Due to significant data model changes there is no upgrade/migration from ElastiFlow 3.x. You should either remove all 3.x indices or deploy ElastiFlow 4.0.x to a separate environment.
88
99
> **IMPORTANT!** - Always use a **RELEASE**. DO NOT use the `master` branch.
1010
11-
> **NOTE** - For full ElastiFlow 4.0.0 functionality, including Kibana's SIEM and Logs apps, you should use X-Pack Basic or one of the commercial X-Pack tiers.
11+
> **NOTE** - For full ElastiFlow 4.0.x functionality, including Kibana's SIEM and Logs apps, you should use X-Pack Basic or one of the commercial X-Pack tiers.
1212
1313
## Elastic Stack Compatibility
1414

1515
Refer to the following compatibility chart to choose a release of ElastiFlow™ that is compatible with the version of the Elastic Stack you are using.
1616

1717
Elastic Stack | ElastiFlow™ 3.x | ElastiFlow™ 4.x
1818
:---:|:---:|:---:
19-
7.8+ | | ✓ v4.0.0
19+
7.8+ | | ✓ v4.0.x
2020
7.5-7.7 | | ✓ v4.0.0-beta
2121
7.0-7.4 | ✓ v3.5.x |
2222
6.7 | ✓ v3.4.2 |
@@ -38,7 +38,7 @@ Elastic Stack | ElastiFlow™ 1.x | ElastiFlow™ 2.x | ElastiFlow&trade
3838
5.5 | ✓ | | |
3939
5.4 | ✓ | | |
4040

41-
> NOTE: The instructions that follow are for ElastiFlow™ 4.0.0 and above on Elastic Stack 7.5.x and higher.
41+
> NOTE: The instructions that follow are for ElastiFlow™ 4.0.0 and above on Elastic Stack 7.8.x and higher.
4242
4343
## Requirements
4444

‎docker-compose-macos.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ services:
9191
LOGGING_QUIET: 'false'
9292

9393
elastiflow-logstash:
94-
image: robcowart/elastiflow-logstash:4.0.0
94+
image: robcowart/elastiflow-logstash:4.0.1
9595
container_name: elastiflow-logstash
9696
restart: 'no'
9797
depends_on:

‎docker-compose.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ services:
8080
LOGGING_QUIET: 'false'
8181

8282
elastiflow-logstash:
83-
image: robcowart/elastiflow-logstash:4.0.0
83+
image: robcowart/elastiflow-logstash:4.0.1
8484
container_name: elastiflow-logstash
8585
restart: 'no'
8686
depends_on:

‎docker_build.sh

+1-1
Original file line numberDiff line numberDiff line change
@@ -15,4 +15,4 @@
1515
# Robert Cowart are Copyright (C)2020 Robert Cowart. All Rights Reserved.
1616
#------------------------------------------------------------------------------
1717

18-
docker build --build-arg BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ') --no-cache -t robcowart/elastiflow-logstash:4.0.0 .
18+
docker build --build-arg BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ') --no-cache -t robcowart/elastiflow-logstash:4.0.1 .

‎logstash/elastiflow/conf.d/20_filter_10_begin.logstash.conf

+2-2
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,12 @@ filter {
3636
"[host][name]" => "%{[@metadata][host]}"
3737
"[agent][name]" => "elastiflow"
3838
"[agent][type]" => "logstash"
39-
"[agent][version]" => "4.0.0"
39+
"[agent][version]" => "4.0.1"
4040
"[agent][id]" => "${ELASTIFLOW_AGENT_ID:elastiflow}"
4141
"[event][module]" => "flow"
4242
"[event][kind]" => "event"
4343
}
44-
replace => { "@version" => "4.0.0" }
44+
replace => { "@version" => "4.0.1" }
4545
}
4646

4747
# Add agent.hostname - the host running the Logstash instance.

‎logstash/elastiflow/conf.d/30_output_10_single.logstash.conf

+2-2
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,9 @@ output {
2424
#cacert => "/PATH/TO/CERT"
2525
user => "${ELASTIFLOW_ES_USER:elastic}"
2626
password => "${ELASTIFLOW_ES_PASSWD:changeme}"
27-
index => "elastiflow-4.0.0-%{+YYYY.MM.dd}"
27+
index => "elastiflow-4.0.1-%{+YYYY.MM.dd}"
2828
template => "${ELASTIFLOW_TEMPLATE_PATH:/etc/logstash/elastiflow/templates}/elastiflow.template.json"
29-
template_name => "elastiflow-4.0.0"
29+
template_name => "elastiflow-4.0.1"
3030
template_overwrite => "true"
3131
}
3232
}

‎logstash/elastiflow/conf.d/30_output_20_multi.logstash.conf.disabled

+2-2
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,9 @@ output {
2424
#cacert => "/PATH/TO/CERT"
2525
user => "${ELASTIFLOW_ES_USER:elastic}"
2626
password => "${ELASTIFLOW_ES_PASSWD:changeme}"
27-
index => "elastiflow-4.0.0-%{+YYYY.MM.dd}"
27+
index => "elastiflow-4.0.1-%{+YYYY.MM.dd}"
2828
template => "${ELASTIFLOW_TEMPLATE_PATH:/etc/logstash/elastiflow/templates}/elastiflow.template.json"
29-
template_name => "elastiflow-4.0.0"
29+
template_name => "elastiflow-4.0.1"
3030
template_overwrite => "true"
3131
}
3232
}

‎logstash/elastiflow/templates/elastiflow.template.json

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"order": 0,
33
"version": 40000,
4-
"index_patterns": "elastiflow-4.0.0-*",
4+
"index_patterns": "elastiflow-4.0.1-*",
55
"settings": {
66
"index": {
77
"number_of_shards": 3,
@@ -21,7 +21,7 @@
2121
"mappings": {
2222
"_meta" : {
2323
"beat" : "elastiflow",
24-
"version" : "4.0.0"
24+
"version" : "4.0.1"
2525
},
2626
"_source" : {
2727
"enabled" : true

0 commit comments

Comments
 (0)