7.10.0

Elasticsearch, Kibana and Logstash 7.10.0

This release adds support for deploying Elasticsearch Kibana and Logstash 7.10.0 to Azure!

Features

#371 Add Elastic Stack 7.10.0 🥇

This release adds Elastic Stack 7.10.0 to the template, with 7.10.0 now the default version. Check
out the release blog post to see all the new features available in the Elastic Stack 7.10.0.

Highlights include:

User Experience monitoring

A new dedicated User experience app in Kibana, allows you to monitor key user experience metrics, including core Web Vitals.

Searchable Snapshots

Directly query years of archived data on object stores like S3 — without having to go through the slow and costly process of restoring indices from snapshots before doing a search. With this new capability, you can choose to lower costs while retaining good performance in your search queries and retaining massive amounts of data.

Bug fixes

#372 Wait for green elastic password check

Waits for the security index to be green before checking if the elastic built-in user password has been updated by another node, in the event that the request to update the password using the seed password fails.

#373 and #374 Wait and retry for green security index

#377 Wait for cluster health to be green when waiting for a node to be up

7.9.0

Elasticsearch, Kibana and Logstash 7.9.0

This release adds support for deploying Elasticsearch Kibana and Logstash 7.9.0 to Azure!

Features

#357 Add Elastic Stack 7.9.0 🥇

This release adds Elastic Stack 7.9.0 to the template, with 7.9.0 now the default version. Check
out the release blog post to see all the new features available in the Elastic Stack 7.9.0.

#359 Use kibana keystore

The kibana keystore is used to store credentials for Kibana

Bug fixes

#359 Escape double quotes in passwords

Double quotes in passwords must be escaped when building the JSON input to update passwords using the user password API.

#362 Check HTTP response status code when updating user passwords

7.8.0

Elasticsearch, Kibana and Logstash 7.8.0

This release adds support for deploying Elasticsearch Kibana and Logstash 7.8.0 to Azure!

Features

#349 Add Elastic Stack 7.8.0 🥇

This release adds Elastic Stack 7.8.0 to the template, with 7.8.0 now the default version. Check
out the release blog post to see all the new features available in the Elastic Stack 7.8.0. These include:

• A new side navigation and dashboard drilldowns

• Service maps now surface health indicators powered by machine learning
• Jira integration with Elastic SIEM case management

plus many more!

7.7.0

Elasticsearch, Kibana and Logstash 7.7.0

This release adds support for deploying Elasticsearch Kibana and Logstash 7.7.0 to Azure!

Features

#333 Add Elastic Stack 7.7.0 🥇

This release adds Elastic Stack 7.7.0 to the template, with 7.7.0 now the default version. Check
out the release blog post to see all the new features available in the Elastic Stack 7.7.0. These include:

• a new alerting system and full management UI in Kibana, providing workflows to configure alerts for a variety of events on different types of data
• ability to perform asynchronous searches, running potentially long-running queries in the background.
• service maps, providing a graphical view of the dependencies between APM instrumented applications

• embedded case management in Elastic SIEM

plus many more!

#332 Add Elastic Stack 7.6.2

The 7.6 minor version has been updated to deploy the latest patch version, 7.6.2. Thanks @quimrodri 👍

Bug fixes

#335 Configure SSL certificates on redeployment

SSL cert configuration were not added to elasticsearch.yml when a re-deployment is performed into an existing resource group, requiring them to be manually added. These are now automatically configured.

#342 Configure Logstash monitoring credentials when Basic security enabled

For versions 6.8.0+ (and less than 7.0.0) and 7.1.0+, Basic security will be enabled so
credentials should be configured in logstash.yml.

Deprecations

#340 Remove EOL versions

6.4.3 and 6.5.3 versions are removed from the template as they are now end-of-life (EOL)

7.6.0

Elasticsearch, Kibana and Logstash 7.6.0

This release adds support for deploying Elasticsearch Kibana and Logstash 7.6.0 to Azure!

Features

#328 Add Elastic Stack 7.6.0 🥇

This release adds Elastic Stack 7.6.0 to the template, with 7.6.0 now the default version. Check
out the release blog post to see all the new features available in the Elastic Stack 7.6.0. These include:

• Supervised Machine Learning

• new SIEM detection engine and MITRE ATT&CK™-aligned rules

... plus many more!

• Update 7.5 version to latest patch, 7.5.2
• Remove support for 6.3.2 which is now EOL.

7.5.0

Elasticsearch, Kibana and Logstash 7.5.0

This release adds support for deploying Elasticsearch Kibana and Logstash 7.5.0 to Azure!

Features

#324 Add Elastic Stack 7.5.0 🥇

This release adds Elastic Stack 7.5.0 to the template, with 7.5.0 now the default version. Check
out the release blog post to see all the new features available in the Elastic Stack 7.5.0. These include:

• Kibana Lens

... plus many more!

• Remove support for Elastic Stack 5.x
• Add support for 7.4.2 and remove 7.4.0

#324 Update VM SKUs

The VM SKUs selectable within the template have been updated, along with the default VM SKUs selected, to newer versions.

Bugs

#325 Deploy NSG and VM public IP resources when a Standard SKU internal LB is selected

Each VM in the backend pool is dynamically assigned a Standard SKU public IP address to allow outbound traffic, which is prevented by default when a Standard SKU load balancer is in front of the VMs.

7.4.0

Elasticsearch, Kibana and Logstash 7.4.0

This release adds support for deploying Elasticsearch Kibana and Logstash 7.4.0 to Azure!

Features

#313 Add Elastic Stack 7.4.0 🥇

This release adds Elastic Stack 7.4.0 to the template, with 7.4.0 now the default version. Check
out the release blog post to see all the new features available in the Elastic Stack 7.4.0. These include:

• Snapshot Lifecycle Management
• Pew Pew maps in Elastic Maps and SIEM:

• PKI Authentication in Kibana

... plus more!

• Add support for 7.3.2 and remove 7.3.1
• Add support for 6.8.3 and remove 6.8.2

Misc

#314 Use /dev/urandom to generate pseudorandom passwords

Removes the installation of the pwgen apt-package and uses /dev/urandom to generate pseudorandom 64 character passwords for xpack.security.encryptionKey and xpack.reporting.encryptionKey for Kibana.

7.3.1

Elasticsearch, Kibana and Logstash 7.3.1

This release adds support for deploying Elasticsearch Kibana and Logstash 7.3.1 to Azure!

Features

#305 Add Elastic Stack 7.3.1 🥇

This release adds Elastic Stack 7.3.1 to the template, with 7.3.1 now the default version.

Deprecations

#305 Remove 6.2.4

6.2.4 is now EOL, so remove from the template.

• Bump Elastic Stack 7.3.0 to 7.3.1

Bug fixes

#303 and #304 Set trial license only when xpackPlugins = "Yes"

There was a bug whereby a trial license was being applied when xpackPlugins = "No", but the version of Elasticsearch is one whereby security can be configured with a basic license i.e. >= 6.8.0 and < 7.0.0, and >=7.1.0. This has now been fixed.

This bug could be worked around in previous template versions, and revert to a basic license by

• using the Start basic license button in Kibana, under Management, if Kibana is installed:

  

or

• callling the start basic license API:

  POST /_license/start_basic?acknowledge=true

acknowledge=true is passed to acknowledge that reverting to a basic license loses features.

In both cases, license information is stored in cluster state, and supersedes the setting in elasticsearch.yml. Please note that using the basic license with security enabled (which is highly recommended) requires at least configuring TLS for the Elasticsearch Transport layer. Reverting to the basic license should be done after configuring TLS for the transport layer.

#304 Configure Network Security Group when using Standard external LB

When a Standard SKU external LB is chosen, the backend pool of VMs are required to be part of a Network Security Group (NSG) to allow traffic to be successfully routed. An NSG is now configured when a Standard SKU external LB is chosen.

7.3.0

Elasticsearch, Kibana and Logstash 7.3.0

This release adds support for deploying Elasticsearch Kibana and Logstash 7.3.0 to Azure!

Features

#301 Add Elastic Stack 7.3.0 🥇

This release adds Elastic Stack 7.3.0 to the template, with 7.3.0 now the default version.

Be sure to check out the release blog post for more details.

Deprecations

#301 Remove 5.6.15, 6.8.0, 7.2.0

• Bump Elastic Stack 7.2.0 to 7.2.1
• Bump Elastic Stack 6.8.0 to 6.8.2
• Bump Elastic Stack 5.6.15 to 5.6.16

7.2.0

Elasticsearch, Kibana and Logstash 7.2.0

This release adds support for deploying Elasticsearch Kibana and Logstash 7.2.0 to Azure!

Features

#289 Add Elastic Stack 7.2.0 🥇

This release adds Elastic Stack 7.2.0 to the template, with 7.2.0 now the default version.

There are many new features in 7.2.0 that make it for more like a major version release than a minor, such as the beta release of Elastic SIEM:

Be sure to check out the release blog post for more details.

#293 Deploy multiple Logstash instances

Multiple instances of Logstash can now be deployed, using the vmLogstashCount parameter to control the number of instances to deploy. Logstash VMs are deployed into their own Availability Set.

#292 Allow load balancer SKU to be selected

It is now possible to choose between Basic and Standard SKU load balancers for both the internal and external load balancer. Please consult the Azure load balancer documentation to understand the differences.

When choosing Standard SKU for the external load balancer, the public IP address assigned to the load balancer will also be Standard SKU, and have an IP addess statically allocated.

Breaking Changes

#295 Replace artifactsBaseUrl with _artifactsLocation and _artifactsLocationSasToken

The artifactsBaseUrl input parameter has been replaced with _artifactsLocation. A new _artifactsLocationSasToken parameter has been added. Both parameters are in line with Microsoft's updated best practices for Azure ARM templates.

_artifactsLocation works the same as artifactsBaseUrl, with the additional requirement that it must end in a trailing /. Please see the updated documentation for examples

Bug fixes

• #291 Add native realm when configuring SAML realm

A native realm is explicitly added to elasticsearch.yml configuration, to allow both the native realm and SAML realm to be used for authentication.

Miscellaneous

• #296 Set kibana logging to quiet by default

Kibana logging has been set to silent from the outset, which suppresses all log output. With this change, errors will now be logged. Care should be taken to monitor the size of the Kibana log file, as it will continue to grow over time.