# ElasticSearch 7.0 upgrade from 6.7.1 issue with Metricbeat templates
**URL:** https://discuss.elastic.co/t/elasticsearch-7-0-upgrade-from-6-7-1-issue-with-metricbeat-templates/177418
**Category:** Elasticsearch
**Created:** [April 18, 2019, 9:05am UTC](https://discuss.elastic.co/t/elasticsearch-7-0-upgrade-from-6-7-1-issue-with-metricbeat-templates/177418 "2019-04-18T09:05:18Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@RogerDavies](https://discuss.elastic.co/u/RogerDavies)
#### Post date: [April 18, 2019, 9:05am UTC](https://discuss.elastic.co/t/elasticsearch-7-0-upgrade-from-6-7-1-issue-with-metricbeat-templates/177418/1 "2019-04-18T09:05:18Z")
Hi
I'm looking at a test ElasticSearch instance @ 6.7.1 upgrade to 7.0. The upgrade assistant says that the metricbeat templates for the cluster need looking at. Basically it says:-
"Index templates [metricbeat-7.0.0, metricbeat-6.6.1, metricbeat-6.6.2] have a number of fields which exceeds the automatic field expansion limit of [1024] and does not have [index.query.default\_field] set, which may cause queries which use automatic field expansion, such as query\_string, simple\_query\_string, and multi\_match to fail if fields are not explicitly specified in the query."
Any ideas how I might resolve this issue before upgrading?
Thanks
Roger
---
### Author:  [@json](https://discuss.elastic.co/u/json)
#### Post date: [April 26, 2019, 1:50pm UTC](https://discuss.elastic.co/t/elasticsearch-7-0-upgrade-from-6-7-1-issue-with-metricbeat-templates/177418/2 "2019-04-26T13:50:54Z")
Hi Roger,
Interesting. `metricbeat-7.0.0` should have the `index.query.default_field` setting in the template. Can you check `GET /_template/metricbeat-7.0.0`?
The setting was added to the Metricbeat template in libbeat 6.7.x per [https://github.com/elastic/beats/pull/11205](https://github.com/elastic/beats/pull/11205).
You can set `indices.query.bool.max_clause_count: 2000` in `elasticsearch.yml` to avoid any issues during the upgrade.
Jason
---
### Author:  [@RogerDavies](https://discuss.elastic.co/u/RogerDavies)
#### Post date: [May 16, 2019, 2:41pm UTC](https://discuss.elastic.co/t/elasticsearch-7-0-upgrade-from-6-7-1-issue-with-metricbeat-templates/177418/3 "2019-05-16T14:41:31Z")
Sorry Jason, got sidetracked. I've changed the elasticsearch.yml as you suggested and upgraded. The error didn't disappear, but I went ahead anyway.
All works nicely, the metricbeat stuff is much better than the previous version. My logstash config though isn't being respected entirely. my output in the logstash config is elasticsearch { hosts =\> "[http://127.0.0.1:9200](http://127.0.0.1:9200)" index =\> "logstash-%{+YYYY.MM.dd}" } but all the logs come through to an index called 'logstash' instead of logstash-YYYY.MM.dd
Probably just have to get used to that. Although I'd like to tidy my config up if it's just going to ignore that.
Thanks
Roger
---
### Author:  [@json](https://discuss.elastic.co/u/json)
#### Post date: [May 22, 2019, 8:39pm UTC](https://discuss.elastic.co/t/elasticsearch-7-0-upgrade-from-6-7-1-issue-with-metricbeat-templates/177418/4 "2019-05-22T20:39:03Z")
Hi Roger,
Sorry for the delay. You could be seeing the one index named `logstash` due to ILM- [https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-ilm](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-ilm) which would be enabled by default in Basic and above licenses. Can you try setting `ilm_enabled => false`?
Jason
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 19, 2019, 8:39pm UTC](https://discuss.elastic.co/t/elasticsearch-7-0-upgrade-from-6-7-1-issue-with-metricbeat-templates/177418/5 "2019-06-19T20:39:20Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.