Errors After Filebeat Upgrade to 6.3.1


After upgrading our Filebeat to 6.3.1, we get error on our Logstash servers that consume these logs from Kafka and insert to Elasticsearch (5.3)

[2018-08-01T09:19:04,028][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=>400, :action=>["index", {:_id=>nil, :_index=>"tag-mediation-2018.08.01", :_type=>"logs", :_routing=>nil}, 2018-08-01T09:19:03.185Z {"name":""} %{message}], :response=>{"index"=>{"_index"=>"tag-mediation-2018.08.01", "_type"=>"logs", "_id"=>"AWT0yJcsvdiggc-2mDWo", "status"=>400, "error"=>{"type"=>"mapper_parsing_exception", "reason"=>"failed to parse [host]", "caused_by"=>{"type"=>"illegal_state_exception", "reason"=>"Can't get text on a START_OBJECT at 1:656"}}}}}

If you come from Filebeat <= 6.2, then it looks like it's caused by this breaking change:, but I might be wrong.


Actually, We came from Filebeat 5.2.2. And from what I understand, the upgrade was suppose to be seamless.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.