I have a pretty basic Logstash setup putting events into Elastic Search with an index per day. The data being added is already in JSON (Suricata EVE). I don't think it gets a whole lot more basic than this.
I just upgraded from 5.0 to 5.1 and then any query using an aggregation (I use term aggregations) do not return any results. If I delete todays index and restart logstash so the index gets recreated I can then again do aggregations.
Is this expected?