# ELK Stack upgrade to version 9.1.5

**URL:** <https://discuss.elastic.co/t/elk-stack-upgrade-to-version-9-1-5/382734>\
**Category:** Elasticsearch\
**Created:** [October 15, 2025, 9:41am UTC](https://discuss.elastic.co/t/elk-stack-upgrade-to-version-9-1-5/382734 "2025-10-15T09:41:31Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![M311ow](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m311ow/32/144802_2.png) [@M311ow](https://discuss.elastic.co/u/M311ow)\
**Post date:** [October 15, 2025, 9:41am UTC](https://discuss.elastic.co/t/elk-stack-upgrade-to-version-9-1-5/382734/1 "2025-10-15T09:41:31Z")

</div>

Hi All,

We planned to upgrade the ELK Stack to the latest version (9.1.5) and encountered an issue where logs disappeared.

After upgrading Elasticsearch and Kibana to version 9.1.5, the system continued to function. However, when Logstash, Filebeat, and Elastic Agent were also upgraded to 9.1.5, the logs were no longer ingested into Elasticsearch.

On the other hand, after rolling back Logstash, Filebeat, and Elastic Agent to version 8.17.4, log ingestion resumed and worked normally.

Behavior  
Upgrade Elasticsearch/Kibana 8.17.4 =\> 8.19.5 =\> 9.1.5  
Upgrade Logstash, Filebeat, and Elastic Agent 8.17.4 =\> 9.1.5 (Using helm)

Helm chart: v8.5.1 (Current use)  
[https://github.com/elastic/helm-charts/tree/v8.5.1(external, opens in a new tab or window)](https://github.com/elastic/helm-charts/tree/v8.5.1)

Why the logs cannot ingested into the Elasticsearch while pods are running without errors?

BR,

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 15, 2025, 11:09am UTC](https://discuss.elastic.co/t/elk-stack-upgrade-to-version-9-1-5/382734/3 "2025-10-15T11:09:59Z")

</div>



---

<div class="post-metadata">

**Author:** ![M311ow](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m311ow/32/144802_2.png) [@M311ow](https://discuss.elastic.co/u/M311ow)\
**Post date:** [October 15, 2025, 11:11am UTC](https://discuss.elastic.co/t/elk-stack-upgrade-to-version-9-1-5/382734/4 "2025-10-15T11:11:49Z")

</div>

Hi @KS_Tomar ,

As I understand, the helm chart that I currently using is the official one

```auto
(https://artifacthub.io/packages/helm/elastic/elasticsearch)

```

I am not sure, can you check on this?

BR,

---

<div class="post-metadata">

**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\
**Post date:** [October 15, 2025, 11:17am UTC](https://discuss.elastic.co/t/elk-stack-upgrade-to-version-9-1-5/382734/5 "2025-10-15T11:17:51Z")

</div>

> the helm chart that I currently using is the official one

Yes I think that’s right. The previous post looked to be AI-generated, please disregard.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 15, 2025, 11:18am UTC](https://discuss.elastic.co/t/elk-stack-upgrade-to-version-9-1-5/382734/6 "2025-10-15T11:18:10Z")

</div>



---

<div class="post-metadata">

**Author:** ![M311ow](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m311ow/32/144802_2.png) [@M311ow](https://discuss.elastic.co/u/M311ow)\
**Post date:** [October 16, 2025, 4:32am UTC](https://discuss.elastic.co/t/elk-stack-upgrade-to-version-9-1-5/382734/7 "2025-10-16T04:32:30Z")

</div>

Hi @DavidTurner,

Do you have any ideas?

BR,

---

<div class="post-metadata">

**Author:** ![DavidTurner](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/davidturner/32/22453_2.png) [@DavidTurner](https://discuss.elastic.co/u/DavidTurner)\
**Post date:** [October 16, 2025, 8:02am UTC](https://discuss.elastic.co/t/elk-stack-upgrade-to-version-9-1-5/382734/8 "2025-10-16T08:02:35Z")

</div>

Nothing obvious, sorry. I’d be surprised if the agents just silently stopped doing anything, it seems more likely they’d be logging some messages that help you move forwards, but you didn’t share any logs in your post so I have nothing to suggest. You might be better off asking in [Elastic Agent - Discuss the Elastic Stack](https://discuss.elastic.co/c/elastic-stack/elastic-agent/91) or [Logstash - Discuss the Elastic Stack](https://discuss.elastic.co/c/elastic-stack/logstash/14) since Elasticsearch itself seems to be working ok here.

---

<div class="post-metadata">

**Author:** ![M311ow](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m311ow/32/144802_2.png) [@M311ow](https://discuss.elastic.co/u/M311ow)\
**Post date:** [October 18, 2025, 8:09am UTC](https://discuss.elastic.co/t/elk-stack-upgrade-to-version-9-1-5/382734/9 "2025-10-18T08:09:06Z")

</div>

Hi @DavidTurner ,

As I check with the support, I missed to check the document of Filebeat container input that already deprecated.  
So, I will fixing to update the input to use a filesteam instead.

Many thanks for your advise.

BR,
