elastic · elastic-vault-github-plugin-prod · Oct 3, 2025 · Oct 3, 2025
diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc
@@ -3,6 +3,54 @@
 :issue: https://github.com/elastic/beats/issues/
 :pull: https://github.com/elastic/beats/pull/
 
+[[release-notes-9.1.5]]
+=== Beats version 9.1.5
+https://github.com/elastic/beats/compare/v9.1.4\...v9.1.5[View commits]
+
+==== Breaking changes
+
+*Filebeat*
+
+- Journald input now converts byte-encoded messages to string. {issue}40479[40479] {pull}46415[46415]
+
+==== Bugfixes
+
+*Affecting all Beats*
+
+- Fixed a panic in the Kafka output that could occur when shutting down while final events were being published. {issue}46109[46109] {pull}46446[46446]
+
+*Filebeat*
+
+- [Journald input] Fix reading all files in a folder and watching for new ones. {issue}46657[46657] {pull}46682[46682]
+- The UDP input now fails if it cannot bind to the configured port and its status is set to failed when running under Elastic Agent. {issue}37216[37216] {pull}46302[46302]
+- The Unix input now fails on errors listening to the socket and its status is set to failed when running under Elastic Agent. {pull}46302[46302]
+- In Filestream, setting `clean_inactive: 0` does not re-ingest all files on startup any more. {issue}45601[45601] {pull}46373[46373]
+- Fix metrics from TCP & UDP inputs when the port number is > 32767 {pull}46486[46486]
+- [azure-eventhub] Fix handling of connection strings with entity path. {issue}43715[43715] {pull}43716[43716]
+
+*Winlogbeat*
+
+- Fix EventLog reset logic to not close renderers. {pull}46376[46376] {issue}45750{45750}
+
+==== Added
+
+*Filebeat*
+
+- Hints based autodiscover now sets `close.on_state_change.removed: false` in the default configuration to avoid missing the last log lines from a container. {issue}34789[34789] {pull}46695[46695]
+
+*Metricbeat*
+
+- Log every 401 response from Kubernetes API Server. {pull}42714[42714]
+- Add new metrics to vSphere Virtual Machine dataset (CPU usage percentage, disk average usage, disk read/write rate, number of disk reads/writes, memory usage percentage). {pull}44205[44205]
+- Added checks for the Resty response object in all Meraki module API calls to ensure proper handling of nil responses. {pull}44193[44193]
+- Add latency config option to Azure Monitor module. {pull}44366[44366]
+- Increase default polling period for MongoDB module from 10s to 60s. {pull}44781[44781]
+- Upgrade github.com/microsoft/go-mssqldb version from v1.7.2 to v1.8.2. {pull}44990[44990]
+- Add NTP response validation for system/ntp module. {pull}46184[46184]
+- Add vertexai_logs metricset to GCP for prompt response collection from VertexAI service. {pull}46383[46383]
+- Add default timegrain to Azure Storage Account metricset. {pull}46786[46786]
+
+
 [[release-notes-9.1.4]]
 === Beats version 9.1.4
 https://github.com/elastic/beats/compare/v9.1.3\...v9.1.4[View commits]

diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
@@ -36,7 +36,6 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Change log.file.path field in awscloudwatch input to nested object. {pull}41099[41099]
 - The Filestream input only starts to ingest a file when it is >= 1024 bytes in size. This happens because the fingerprint` is the default file identity now. To restore the previous behaviour, set `file_identity.native: ~` and `prospector.scanner.fingerprint.enabled: false` {issue}40197[40197] {pull}41762[41762]
 - Filebeat fails to start when its configuration contains usage of the deprecated `log` or `container` inputs. However, they can still be using while setting `allow_deprecated_use: true` in their configuration {pull}42295[42295]
-- Journald input now converts byte-encoded messages to string. {issue}40479[40479] {pull}46415[46415]
 
 
 *Heartbeat*
@@ -90,7 +89,6 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Support Elastic Agent control protocol chunking support {pull}37343[37343]
 - Lower logging level to debug when attempting to configure beats with unknown fields from autodiscovered events/environments {pull}[37816][37816]
 - Set timeout of 1 minute for FQDN requests {pull}37756[37756]
-- Fixed a panic in the Kafka output that could occur when shutting down while final events were being published. {issue}46109[46109] {pull}46446[46446]
 
 *Auditbeat*
 
@@ -148,16 +146,6 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Added missing "text/csv" content-type filter support in azureblobsortorage input. {issue}44596[44596] {pull}44824[44824]
 - Fix unexpected EOF detection and improve memory usage. {pull}44813[44813]
 - Added missing "text/csv" content-type filter support in GCS input. {issue}44922[44922] {pull}44923[44923]
-- [Journald input] Fix reading all files in a folder and watching for new ones. {issue}46657[46657] {pull}46682[46682]
-- The UDP input now fails if it cannot bind to the configured port and its status is set to failed when running under Elastic Agent. {issue}37216[37216] {pull}46302[46302]
-- The Unix input now fails on errors listening to the socket and its status is set to failed when running under Elastic Agent. {pull}46302[46302]
-- Fix race condition that could cause Filebeat to hang during shutdown after failing to startup {issue}45034[45034] {pull}46331[46331]
-- Fixed hints autodiscover for Docker when the configuration is only `hints.enabled: true`. {issue}45156[45156] {pull}45864[45864]
-- In Filestream, setting `clean_inactive: 0` does not re-ingest all files on startup any more. {issue}45601[45601]
-+{pull}46373[46373]
-- Fix metrics from TCP & UDP inputs when the port number is > 32767 {pull}46486[46486]
-- [Journald input] Fix reading all files in a folder and watching for new ones. {issue}46657[46657] {pull}46682[46682]
-- [azure-eventhub] Fix handling of connection strings with entity path. {issue}43715[43715] {pull}43716[43716]
 
 *Heartbeat*
 
@@ -199,8 +187,6 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 *Winlogbeat*
 
 - Fix message handling in the experimental api. {issue}19338[19338] {pull}41730[41730]
-- Fix forwarded event handling and add channel error resilience. {pull}46190[46190]
-- Fix EventLog reset logic to not close renderers. {pull}46376[46376] {issue}45750{45750}
 
 *Elastic Logging Plugin*
 - Fix for unable to run elastic-logging plugin
@@ -280,7 +266,6 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Add ability to remove request trace logs from entityanalytics input. {pull}40004[40004]
 - Filebeat's registry is now added to the Elastic-Agent diagnostics bundle {issue}33238[33238] {pull}41795[41795]
 - The Filestream input now uses the `fingerprint` file identity by default. The state from files are automatically migrated if the previous file identity was `native` (the default) or `path`. If the `file_identity` is explicitly set, there is no change in behaviour. {issue}40197[40197] {pull}41762[41762]
-- Hints based autodiscover now sets `close.on_state_change.removed: false` in the default configuration to avoid missing the last log lines from a container. {issue}34789[34789] {pull}46695[46695]
 
 *Auditbeat*
 
@@ -330,27 +315,6 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Only watch metadata for ReplicaSets in metricbeat k8s module {pull}41289[41289]
 - Preserve queries for debugging when `merge_results: true` in SQL module {pull}42271[42271]
 - Collect more fields from ES node/stats metrics and only those that are necessary {pull}42421[42421]
-- Add new metricset wmi for the windows module. {pull}42017[42017]
-- Update beat module with apm-server tail sampling monitoring metrics fields {pull}42569[42569]
-- Log every 401 response from Kubernetes API Server {pull}42714[42714]
-- Add a new `match_by_parent_instance` option to `perfmon` module. {pull}43002[43002]
-- Add a warning log to metricbeat.vsphere in case vSphere connection has been configured as insecure. {pull}43104[43104]
-- Changed the Elasticsearch module behavior to only pull settings from non-system indices. {pull}43243[43243]
-- Exclude dotted indices from settings pull in Elasticsearch module. {pull}43306[43306]
-- Add a `jetstream` metricset to the NATS module {pull}43310[43310]
-- Updated Meraki API endpoint for Channel Utilization data. Switched to `GetOrganizationWirelessDevicesChannelUtilizationByDevice`. {pull}43485[43485]
-- Upgrade Prometheus Library to v0.300.1. {pull}43540[43540]
-- Add GCP Dataproc metadata collector in GCP module. {pull}43518[43518]
-- Add new metrics to vSphere Virtual Machine dataset (CPU usage percentage, disk average usage, disk read/write rate, number of disk reads/writes, memory usage percentage). {pull}44205[44205]
-- Added checks for the Resty response object in all Meraki module API calls to ensure proper handling of nil responses. {pull}44193[44193]
-- Add latency config option to Azure Monitor module. {pull}44366[44366]
-- Increase default polling period for MongoDB module from 10s to 60s {pull}44781[44781]
-- Upgrade github.com/microsoft/go-mssqldb from v1.7.2 to v1.8.2 {pull}44990[44990]
-- Add SSL support for sql module: drivers mysql, postgres, and mssql. {pull}44748[44748]
-- Add support for Kafka 4.0 in the Kafka module. {pull}44723[44723]
-- Add NTP response validation for system/ntp module. {pull}46184[46184]
-- Add vertexai_logs metricset to GCP for prompt response collection from VertexAI service. {pull}46383[46383]
-- Add default timegrain to Azure Storage Account metricset. {pull}46786[46786]
 
 *Metricbeat*
 
@@ -419,6 +383,9 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 
 
 
+
+
+
 
 
 
@@ -8,6 +8,7 @@ This section summarizes the changes in each release. Also read
 <<breaking-changes>> for more detail about changes that affect
 upgrade.
 
+* <<release-notes-9.1.5>>
 * <<release-notes-9.1.4>>
 * <<release-notes-9.1.3>>
 * <<release-notes-9.1.2>>