Errors After Filebeat Upgrade to 6.3.1

[Or_Arnon]

Hi,

After upgrading our Filebeat to 6.3.1, we get error on our Logstash servers that consume these logs from Kafka and insert to Elasticsearch (5.3)

[2018-08-01T09:19:04,028][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"tag-mediation-2018.08.01", :_type=>"logs", :_routing=>nil}, 2018-08-01T09:19:03.185Z {"name":"tagmediation-i-0c6dadf01c99ec637.eu-west-1.production"} %{message}], :response=>{"index"=>{"_index"=>"tag-mediation-2018.08.01", "_type"=>"logs", "_id"=>"AWT0yJcsvdiggc-2mDWo", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [host]", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:656"}}}}}

[tgaudin]

If you come from Filebeat <= 6.2, then it looks like it's caused by this breaking change: https://www.elastic.co/guide/en/beats/libbeat/6.3/breaking-changes-6.3.html#breaking-changes-mapping-conflict, but I might be wrong.

[Or_Arnon]

Hi,

Actually, We came from Filebeat 5.2.2. And from what I understand, the upgrade was suppose to be seamless.