Merge branch 'master' into syslog-docs

.ci/packer_cache.sh

@@ -21,13 +21,8 @@ source ./dev-tools/common.bash
 # couchbase:4.5.1
 # debian:latest
 # debian:stretch
-# docker.elastic.co/beats-dev/fpm:1.11.0
 # docker.elastic.co/beats/metricbeat:6.5.4
 # docker.elastic.co/beats/metricbeat:7.2.0
-# docker.elastic.co/elasticsearch/elasticsearch:7.2.0
-# docker.elastic.co/kibana/kibana:7.2.0
-# docker.elastic.co/logstash/logstash:7.2.0
-# docker.elastic.co/observability-ci/database-instantclient:12.2.0.1
 # envoyproxy/envoy:v1.7.0
 # exekias/localkube-image
 # haproxy:1.8
@@ -59,20 +54,28 @@ get_go_version
 
 DOCKER_IMAGES="docker.elastic.co/observability-ci/database-instantclient:12.2.0.1
 docker.elastic.co/observability-ci/database-enterprise:12.2.0.1
+docker.elastic.co/beats-dev/fpm:1.11.0
 docker.elastic.co/beats-dev/golang-crossbuild:${GO_VERSION}-arm
+docker.elastic.co/beats-dev/golang-crossbuild:${GO_VERSION}-base-arm-debian9
 docker.elastic.co/beats-dev/golang-crossbuild:${GO_VERSION}-darwin
 docker.elastic.co/beats-dev/golang-crossbuild:${GO_VERSION}-main
 docker.elastic.co/beats-dev/golang-crossbuild:${GO_VERSION}-main-debian7
 docker.elastic.co/beats-dev/golang-crossbuild:${GO_VERSION}-main-debian8
+docker.elastic.co/beats-dev/golang-crossbuild:${GO_VERSION}-main-debian9
 docker.elastic.co/beats-dev/golang-crossbuild:${GO_VERSION}-mips
 docker.elastic.co/beats-dev/golang-crossbuild:${GO_VERSION}-ppc
 docker.elastic.co/beats-dev/golang-crossbuild:${GO_VERSION}-s390x
+docker.elastic.co/elasticsearch/elasticsearch:8.0.0-SNAPSHOT
+docker.elastic.co/kibana/kibana:8.0.0-SNAPSHOT
+docker.elastic.co/logstash/logstash:8.0.0-SNAPSHOT
 golang:${GO_VERSION}
+golang:1.14.12-stretch
+centos:7
 "
 if [ -x "$(command -v docker)" ]; then
   for image in ${DOCKER_IMAGES}
   do
-  (retry 2 docker pull ${image}) || echo "Error pulling ${image} Docker image, we continue"
+    (retry 2 docker pull ${image}) || echo "Error pulling ${image} Docker image. Continuing."
   done
 
   docker tag \
@@ -82,5 +85,5 @@ if [ -x "$(command -v docker)" ]; then
   docker tag \
     docker.elastic.co/observability-ci/database-enterprise:12.2.0.1 \
     store/oracle/database-enterprise:12.2.0.1 \
-    || echo "Error setting the Oracle Dtabase tag"
+    || echo "Error setting the Oracle Database tag"
 fi

.mergify.yml

@@ -10,6 +10,8 @@ pull_request_rules:
           - "{{ author }}"
         branches:
           - "7.x"
+        labels:
+          - "backport"
   - name: backport patches to 7.12 branch
     conditions:
       - merged
@@ -21,6 +23,8 @@ pull_request_rules:
           - "{{ author }}"
         branches:
           - "7.12"
+        labels:
+          - "backport"
   - name: backport patches to 7.11 branch
     conditions:
       - merged
@@ -32,6 +36,8 @@ pull_request_rules:
           - "{{ author }}"
         branches:
           - "7.11"
+        labels:
+          - "backport"
   - name: ask to resolve conflict
     conditions:
       - conflict

CHANGELOG.next.asciidoc

@@ -105,6 +105,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Rename `network.direction` values in crowdstrike/falcon to `ingress`/`egress`. {pull}23041[23041]
 - Possible values for Netflow's locality fields (source.locality, destination.locality and flow.locality) are now `internal` and `external`, instead of `private` and `public`. {issue}24272[24272] {pull}24295[24295]
 - Add User Agent Parser for Azure Sign In Logs Ingest Pipeline {pull}23201[23201]
+- Changes filebeat httpjson input's append transform to create a list even with only a single value{pull}25074[25074]
 
 *Heartbeat*
 
@@ -279,6 +280,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix a connection error in httpjson input. {pull}16123[16123]
 - Fix integer overflow in S3 offsets when collecting very large files. {pull}22523[22523]
 - Fix CredentialsJSON unpacking for `gcp-pubsub` and `httpjson` inputs. {pull}23277[23277]
+- Strip Azure Eventhub connection string in debug logs. {pulll}25066[25066]
 
 *Filebeat*
 
@@ -392,11 +394,13 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Fix S3 input validation for non amazonaws.com domains. {issue}24420[24420] {pull}24861[24861]
 - Fix google_workspace and okta modules pagination when next page template is empty. {pull}24967[24967]
 - Fix IPtables Pipeline and Ubiquiti dashboard. {issue}24878[24878] {pull}24928[24928]
+- Fix gcp module field names to use gcp instead of googlecloud. {pull}25038[25038]
 
 *Heartbeat*
 
 - Fixed excessive memory usage introduced in 7.5 due to over-allocating memory for HTTP checks. {pull}15639[15639]
 - Fixed TCP TLS checks to properly validate hostnames, this broke in 7.x and only worked for IP SANs. {pull}17549[17549]
+- Fix panic when initialization of ICMP monitors fail twice. {pull}25073[25073]
 
 *Journalbeat*
 
@@ -607,6 +611,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Add `wineventlog` schema to `decode_xml` processor. {issue}23910[23910] {pull}24726[24726]
 - Add new ECS 1.9 field `cloud.service.name` to `add_cloud_metadata` processor. {pull}24993[24993]
 - Libbeat: report queue capacity, output batch size, and output client count to monitoring. {pull}24700[24700]
+- Add kubernetes.pod.ip field in kubernetes metadata. {pull}25037[25037]
 
 *Auditbeat*
 
@@ -998,6 +1003,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Add additional event categorization for security and sysmon modules. {pull}22988[22988]
 - Add dns.question.subdomain fields for sysmon DNS events. {pull}22999[22999]
 - Add dns.question.top_level_domain fields for sysmon DNS events. {pull}23046[23046]
+- Add support for sysmon v13 events 24 and 25. {issue}24217[24217] {pull}24945[24945]
 
 *Elastic Log Driver*