elastic · giorgi-imerlishvili-elastic · Mar 19, 2026 · Mar 19, 2026 · Mar 19, 2026
@@ -28,7 +28,7 @@
 
 ## Compatibility
 
-This integration has been tested against IBM MQ v9.1 and IBM MQ v9.2. Currently, the `ibmmq qmgr` data stream is only compatible with the containerized versions of IBM MQ, such as those available from [IBM Cloud Container Registry](https://icr.io/) or [Docker Hub](https://hub.docker.com/r/ibmcom/mq). 
+This integration has been tested against IBM MQ v9.1, IBM MQ v9.2 and IBM MQ v9.4. Currently, the `ibmmq qmgr` data stream is only compatible with the containerized versions of IBM MQ, such as those available from [IBM Cloud Container Registry](https://icr.io/) or [Docker Hub](https://hub.docker.com/r/ibmcom/mq). 
 
 ## What do I need to use this integration?
 
@@ -61,7 +61,7 @@
 
 ### Queue Manager performance metrics
 
-The `qmgr` data stream collects [performance metrics of Queue Manager](https://www.ibm.com/docs/en/ibm-mq/9.2?topic=operator-metrics-published-when-using-mq) like messages, topics, subscriptions and calls.
+The `qmgr` data stream collects [performance metrics of Queue Manager](https://www.ibm.com/docs/en/ibm-mq/9.4.x?topic=operator-metrics-published-by-mq-container) like messages, topics, subscriptions and calls.
 
 {{event "qmgr"}}
 

@@ -1,7 +1,6 @@
-version: '2.3'
 services:
   ibmmq:
-    image: ibmcom/mq:${SERVICE_VERSION:-9.2.4.0-r1-amd64}
+    image: ${SERVICE_VERSION:-ibmcom/mq:9.2.4.0-r1-amd64}
     environment:
       - LICENSE=accept
       - MQ_QMGR_NAME=QM1

@@ -1,4 +1,6 @@
 variants:
   v9.2.4.0-r1-amd64:
-    SERVICE_VERSION: 9.2.4.0-r1-amd64
-default: v9.2.4.0-r1-amd64
+    SERVICE_VERSION: ibmcom/mq:9.2.4.0-r1-amd64
+  v9.4.0.20-r1:
+    SERVICE_VERSION: icr.io/ibm-messaging/mq:9.4.0.20-r1
+default: v9.4.0.20-r1
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.9.0"
+  changes:
+    - description: Add ibm mq 9.4 version
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/17913
 - version: "1.8.0"
   changes:
     - description: Improve documentation

@@ -0,0 +1,3 @@
+03/19/26 14:55:47 - Process(460.1) User(root) Program(crtmqm) Host(6bfb28d6779a) Installation(Installation1) VRMF(9.4.0.20) Time(2026-03-19T14:55:47.163Z) CommentInsert1(Linux 6.8.0-106-generic (MQ Linux (x86-64 platform) 64-bit)) CommentInsert2(/opt/mqm (Installation1)) CommentInsert3(9.4.0.20 (p940-020-260211)) AMQ6287I: IBM MQ V9.4.0.20 (p940-020-260211). EXPLANATION: IBM MQ system information: Host Info:- Linux 6.8.0-106-generic (MQ Linux (x86-64 platform) 64-bit)  Installation:- /opt/mqm (Installation1)  Version:- 9.4.0.20 (p940-020-260211) ACTION: None.
+03/19/26 14:55:47 - Process(460.1) User(root) Program(crtmqm) Host(6bfb28d6779a) Installation(Installation1) VRMF(9.4.0.20) Time(2026-03-19T14:55:47.163Z) CommentInsert3(QM1) AMQ8001I: IBM MQ queue manager 'QM1' created.  EXPLANATION: IBM MQ queue manager 'QM1' created. ACTION: None.
+03/19/26 14:55:52 - Process(512.1) User(root) Program(strmqm) Host(6bfb28d6779a) Installation(Installation1) VRMF(9.4.0.20) Time(2026-03-19T14:55:52.397Z) CommentInsert1(strmqm) CommentInsert2(strmqm -x QM1) AMQ6206I: Command strmqm was issued.  EXPLANATION: Control command 'strmqm -x QM1' was issued. ACTION: None.
@@ -0,0 +1,148 @@
+{
+    "expected": [
+        {
+            "@timestamp": "2026-03-19T14:55:47.163Z",
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-03-19T20:47:00.809405879Z",
+                "kind": "event",
+                "module": "ibmmq",
+                "original": "03/19/26 14:55:47 - Process(460.1) User(root) Program(crtmqm) Host(6bfb28d6779a) Installation(Installation1) VRMF(9.4.0.20) Time(2026-03-19T14:55:47.163Z) CommentInsert1(Linux 6.8.0-106-generic (MQ Linux (x86-64 platform) 64-bit)) CommentInsert2(/opt/mqm (Installation1)) CommentInsert3(9.4.0.20 (p940-020-260211)) AMQ6287I: IBM MQ V9.4.0.20 (p940-020-260211). EXPLANATION: IBM MQ system information: Host Info:- Linux 6.8.0-106-generic (MQ Linux (x86-64 platform) 64-bit) Installation:- /opt/mqm (Installation1) Version:- 9.4.0.20 (p940-020-260211) ACTION: None.",
+                "type": [
+                    "error"
+                ]
+            },
+            "host": {
+                "hostname": "6bfb28d6779a"
+            },
+            "ibmmq": {
+                "errorlog": {
+                    "error": {
+                        "action": "None.",
+                        "code": "AMQ6287I",
+                        "description": "IBM MQ V9.4.0.20 (p940-020-260211).",
+                        "explanation": "IBM MQ system information: Host Info:- Linux 6.8.0-106-generic (MQ Linux (x86-64 platform) 64-bit) Installation:- /opt/mqm (Installation1) Version:- 9.4.0.20 (p940-020-260211)"
+                    },
+                    "insert": {
+                        "comment": [
+                            "Linux 6.8.0-106-generic (MQ Linux (x86-64 platform) 64-bit)",
+                            "/opt/mqm (Installation1)",
+                            "9.4.0.20 (p940-020-260211)"
+                        ]
+                    },
+                    "installation": "Installation1"
+                }
+            },
+            "process": {
+                "pid": 460.1,
+                "title": "crtmqm"
+            },
+            "service": {
+                "version": "9.4.0.20"
+            },
+            "tags": [
+                "preserve_original_event"
+            ],
+            "user": {
+                "name": "root"
+            }
+        },
+        {
+            "@timestamp": "2026-03-19T14:55:47.163Z",
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-03-19T20:47:00.809468817Z",
+                "kind": "event",
+                "module": "ibmmq",
+                "original": "03/19/26 14:55:47 - Process(460.1) User(root) Program(crtmqm) Host(6bfb28d6779a) Installation(Installation1) VRMF(9.4.0.20) Time(2026-03-19T14:55:47.163Z) CommentInsert3(QM1) AMQ8001I: IBM MQ queue manager 'QM1' created. EXPLANATION: IBM MQ queue manager 'QM1' created. ACTION: None.",
+                "type": [
+                    "error"
+                ]
+            },
+            "host": {
+                "hostname": "6bfb28d6779a"
+            },
+            "ibmmq": {
+                "errorlog": {
+                    "error": {
+                        "action": "None.",
+                        "code": "AMQ8001I",
+                        "description": "IBM MQ queue manager 'QM1' created.",
+                        "explanation": "IBM MQ queue manager 'QM1' created."
+                    },
+                    "insert": {
+                        "comment": [
+                            "QM1"
+                        ]
+                    },
+                    "installation": "Installation1"
+                }
+            },
+            "process": {
+                "pid": 460.1,
+                "title": "crtmqm"
+            },
+            "service": {
+                "version": "9.4.0.20"
+            },
+            "tags": [
+                "preserve_original_event"
+            ],
+            "user": {
+                "name": "root"
+            }
+        },
+        {
+            "@timestamp": "2026-03-19T14:55:52.397Z",
+            "ecs": {
+                "version": "8.11.0"
+            },
+            "event": {
+                "ingested": "2026-03-19T20:47:00.809482860Z",
+                "kind": "event",
+                "module": "ibmmq",
+                "original": "03/19/26 14:55:52 - Process(512.1) User(root) Program(strmqm) Host(6bfb28d6779a) Installation(Installation1) VRMF(9.4.0.20) Time(2026-03-19T14:55:52.397Z) CommentInsert1(strmqm) CommentInsert2(strmqm -x QM1) AMQ6206I: Command strmqm was issued. EXPLANATION: Control command 'strmqm -x QM1' was issued. ACTION: None.",
+                "type": [
+                    "error"
+                ]
+            },
+            "host": {
+                "hostname": "6bfb28d6779a"
+            },
+            "ibmmq": {
+                "errorlog": {
+                    "error": {
+                        "action": "None.",
+                        "code": "AMQ6206I",
+                        "description": "Command strmqm was issued.",
+                        "explanation": "Control command 'strmqm -x QM1' was issued."
+                    },
+                    "insert": {
+                        "comment": [
+                            "strmqm",
+                            "strmqm -x QM1"
+                        ]
+                    },
+                    "installation": "Installation1"
+                }
+            },
+            "process": {
+                "pid": 512.1,
+                "title": "strmqm"
+            },
+            "service": {
+                "version": "9.4.0.20"
+            },
+            "tags": [
+                "preserve_original_event"
+            ],
+            "user": {
+                "name": "root"
+            }
+        }
+    ]
+}
@@ -6,7 +6,7 @@
                 "version": "8.11.0"
             },
             "event": {
-                "ingested": "2024-06-18T05:49:41.278914891Z",
+                "ingested": "2026-03-19T20:47:00.024861724Z",
                 "kind": "event",
                 "module": "ibmmq",
                 "original": "06/14/22 11:54:29 - Process(119.8) User(mqm) Program(amqzmur0) Host(00c6b2142371) Installation(Installation1) VRMF(9.2.4.0) QMgr(QM1) Time(2022-06-14T11:54:29.349Z) ArithInsert2(3) CommentInsert1(APP-SIGNAL) AMQ5037I: The queue manager task 'APP-SIGNAL' has started. EXPLANATION: The restartable utility task manager has started the APP-SIGNAL task. This task has now started 3 times. ACTION: None.",
@@ -57,7 +57,7 @@
                 "version": "8.11.0"
             },
             "event": {
-                "ingested": "2024-06-18T05:49:41.278942132Z",
+                "ingested": "2026-03-19T20:47:00.024869485Z",
                 "kind": "event",
                 "module": "ibmmq",
                 "original": "06/13/22 06:53:29 - Process(60.1) User(mqm) Program(crtmqm) Host(2661e9dd5c0b) Installation(Installation1) VRMF(9.2.4.0) Time(2022-06-13T06:53:29.794Z) CommentInsert3(QM1) AMQ8001I: IBM MQ queue manager 'QM1' created. EXPLANATION: IBM MQ queue manager 'QM1' created. ACTION: None.",
@@ -107,7 +107,7 @@
                 "version": "8.11.0"
             },
             "event": {
-                "ingested": "2024-06-18T05:49:41.278945903Z",
+                "ingested": "2026-03-19T20:47:00.024873474Z",
                 "kind": "event",
                 "module": "ibmmq",
                 "original": "06/15/22 06:10:59 - Process(597.4) User(mqm) Program(amqrmppa) Host(00c6b2142371) Installation(Installation1) VRMF(9.2.4.0) QMgr(QM1) Time(2022-06-15T06:10:59.254Z) RemoteHost(10.212.128.113) ArithInsert2(TCP/IP) CommentInsert1(10.212.128.113) CommentInsert3(????) AMQ9207E: The data received from host '10.212.128.113' on channel '????' is not valid. EXPLANATION: Incorrect data format received from host '10.212.128.113' over TCP/IP. It my be that an unknown host is attempting to send data. An FFST file might be generated containing the invalid data received. It will not be generated if this is the beginning of a conversation with the remote side, and the format is a simple known format (example: a GET request from an HTTP web browser). If you want to override this, to cause FFST files to be written for any bad data, including simple known formats, then set the environment variable AMQ_BAD_COMMS_DATA_FDCS=TRUE and restart the queue manager. The channel name is '????'; in some cases it cannot be determined and so is shown as '????'. ACTION: Tell the systems administrator.",
@@ -121,10 +121,10 @@
             "ibmmq": {
                 "errorlog": {
                     "error": {
-                        "action": "a GET request from an HTTP web browser). If you want to override this, to cause FFST files to be written for any bad data, including simple known formats, then set the environment variable AMQ_BAD_COMMS_DATA_FDCS=TRUE and restart the queue manager. The channel name is '????'; in some cases it cannot be determined and so is shown as '????'. ACTION: Tell the systems administrator.",
+                        "action": "Tell the systems administrator.",
                         "code": "AMQ9207E",
                         "description": "The data received from host '10.212.128.113' on channel '????' is not valid.",
-                        "explanation": "Incorrect data format received from host '10.212.128.113' over TCP/IP. It my be that an unknown host is attempting to send data. An FFST file might be generated containing the invalid data received. It will not be generated if this is the beginning of a conversation with the remote side, and the format is a simple known format"
+                        "explanation": "Incorrect data format received from host '10.212.128.113' over TCP/IP. It my be that an unknown host is attempting to send data. An FFST file might be generated containing the invalid data received. It will not be generated if this is the beginning of a conversation with the remote side, and the format is a simple known format (example: a GET request from an HTTP web browser). If you want to override this, to cause FFST files to be written for any bad data, including simple known formats, then set the environment variable AMQ_BAD_COMMS_DATA_FDCS=TRUE and restart the queue manager. The channel name is '????'; in some cases it cannot be determined and so is shown as '????'."
                     },
                     "insert": {
                         "arith": [
@@ -154,4 +154,4 @@
             }
         }
     ]
-}
+}
@@ -60,8 +60,7 @@ processors:
       ArithInsert2\(%{DATA:ibmmq.errorlog.arithinsert2}\))?( CommentInsert1\(%{DATA:ibmmq.errorlog.commentinsert1}\))?(
       CommentInsert2\(%{DATA:ibmmq.errorlog.commentinsert2}\))?( CommentInsert3\(%{DATA:ibmmq.errorlog.commentinsert3}\))?
       (?=AMQ[0-9]{4})%{DATA:ibmmq.errorlog.error.code}((?<=AMQ[0-9]{4}[A-Z])%{DATA:log.level})?:
-      %{DATA:ibmmq.errorlog.error.description} [^\ ]+:( %{DATA:ibmmq.errorlog.error.explanation})?
-      [^\ ]+:( %{DATA:ibmmq.errorlog.error.action})?$'
+      %{DATA:ibmmq.errorlog.error.description}( EXPLANATION: %{DATA:ibmmq.errorlog.error.explanation})?( ACTION: %{DATA:ibmmq.errorlog.error.action})?$'
 - convert:
     field: process.pid
     type: float

@@ -1,53 +1,53 @@
 {
-    "@timestamp": "2024-05-28T10:29:59.860Z",
+    "@timestamp": "2026-03-19T22:38:36.869Z",
     "agent": {
-        "ephemeral_id": "cbbb6e1e-c10f-4635-bb3e-b42063268637",
-        "id": "476beedd-c7de-4696-a85b-d20aa455d46a",
-        "name": "docker-fleet-agent",
+        "ephemeral_id": "a011b947-d019-43ee-a154-fe60d15539e4",
+        "id": "0ab76002-6449-49c0-b8e4-5012dae7b745",
+        "name": "elastic-agent-33173",
         "type": "filebeat",
-        "version": "8.12.0"
+        "version": "9.3.2"
     },
     "data_stream": {
         "dataset": "ibmmq.errorlog",
-        "namespace": "ep",
+        "namespace": "77308",
         "type": "logs"
     },
     "ecs": {
         "version": "8.11.0"
     },
     "elastic_agent": {
-        "id": "476beedd-c7de-4696-a85b-d20aa455d46a",
-        "snapshot": false,
-        "version": "8.12.0"
+        "id": "0ab76002-6449-49c0-b8e4-5012dae7b745",
+        "snapshot": true,
+        "version": "9.3.2"
     },
     "event": {
         "agent_id_status": "verified",
-        "created": "2024-05-28T10:30:26.219Z",
+        "created": "2026-03-19T22:39:00.004Z",
         "dataset": "ibmmq.errorlog",
-        "ingested": "2024-05-28T10:30:38Z",
+        "ingested": "2026-03-19T22:39:03Z",
         "kind": "event",
         "module": "ibmmq",
         "type": [
             "error"
         ]
     },
     "host": {
-        "hostname": "99726abecb7d",
-        "name": "docker-fleet-agent"
+        "hostname": "5b506fb42ae8",
+        "name": "elastic-agent-33173"
     },
     "ibmmq": {
         "errorlog": {
             "error": {
-                "action": "Host Info :- Linux 3.10.0-1160.102.1.el7.x86_64 (MQ Linux (x86-64 platform) 64-bit) Installation :- /opt/mqm (Installation1) Version :- 9.2.4.0 (p924-L211105.DE) ACTION: None.",
+                "action": "None.",
                 "code": "AMQ6287I",
-                "description": "IBM MQ V9.2.4.0 (p924-L211105.DE).",
-                "explanation": "IBM MQ system"
+                "description": "IBM MQ V9.4.0.20 (p940-020-260211).",
+                "explanation": "IBM MQ system information: Host Info :- Linux 6.8.0-106-generic (MQ Linux (x86-64 platform) 64-bit) Installation :- /opt/mqm (Installation1) Version :- 9.4.0.20 (p940-020-260211)"
             },
             "insert": {
                 "comment": [
-                    "Linux 3.10.0-1160.102.1.el7.x86_64 (MQ Linux (x86-64 platform) 64-bit)",
+                    "Linux 6.8.0-106-generic (MQ Linux (x86-64 platform) 64-bit)",
                     "/opt/mqm (Installation1)",
-                    "9.2.4.0 (p924-L211105.DE)"
+                    "9.4.0.20 (p940-020-260211)"
                 ]
             },
             "installation": "Installation1"
@@ -60,17 +60,15 @@
         "file": {
             "path": "/tmp/service_logs/AMQERR01.LOG"
         },
-        "flags": [
-            "multiline"
-        ],
+        "flags": "multiline",
         "offset": 0
     },
     "process": {
-        "pid": 58.1,
+        "pid": 456.1,
         "title": "crtmqm"
     },
     "service": {
-        "version": "9.2.4.0"
+        "version": "9.4.0.20"
     },
     "tags": [
         "forwarded",
@@ -79,4 +77,4 @@
     "user": {
         "name": "root"
     }
-}
+}
@@ -243,4 +243,4 @@
             }
         }
     ]
-}
+}
-Original file line number
+Diff line change
@@ Expand Up / @@ -243,4 +243,4 @@ @@
                 }
             }
         ]
-    }
+    }