diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 1c3ca09092f..59f8ecd1cfd 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -99,6 +99,14 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Add service resource in k8s cluster role. {pull}20546[20546]
 - Periodic metrics in logs will now report `libbeat.output.events.active` and `beat.memstats.rss`
 - Fix `fingerprint` processor to give it access to the `@timestamp` field. {issue}28683[28683]
+  as gauges (rather than counters). {pull}22877[22877]
+- Improve `perfmon` metricset performance. {pull}26886[26886]
+- Preserve annotations in a kubernetes namespace metadata {pull}27045[27045]
+- Allow conditional processing in `decode_xml` and `decode_xml_wineventlog`. {pull}27159[27159]
+- Fix build constraint that caused issues with doc builds. {pull}27381[27381]
+- Beats dashboards use custom index when `setup.dashboards.index` is set. {issue}21232[21232] {pull}27901[27901]
+- Fix handling of float data types within processors. {issue}28279[28279] {pull}28280[28280]
+- Allow `clone3` syscall in seccomp filters. {pull}28117[28117]
 
 *Auditbeat*
 
diff --git a/libbeat/common/seccomp/policy_linux_386.go b/libbeat/common/seccomp/policy_linux_386.go
index 796b071a104..40b49113b73 100644
--- a/libbeat/common/seccomp/policy_linux_386.go
+++ b/libbeat/common/seccomp/policy_linux_386.go
@@ -35,6 +35,7 @@ func init() {
 					"chown",
 					"clock_gettime",
 					"clone",
+					"clone3",
 					"close",
 					"dup",
 					"dup2",
diff --git a/libbeat/common/seccomp/policy_linux_amd64.go b/libbeat/common/seccomp/policy_linux_amd64.go
index 4246e6a1a51..6096b37bb32 100644
--- a/libbeat/common/seccomp/policy_linux_amd64.go
+++ b/libbeat/common/seccomp/policy_linux_amd64.go
@@ -38,6 +38,7 @@ func init() {
 					"chown",
 					"clock_gettime",
 					"clone",
+					"clone3",
 					"close",
 					"connect",
 					"dup",