I'm in the process of moving to a 5.x stack from my ancient Filebeat-1.3 -> Logstash-2.4 -> ES-1.7 stack. The plan is to build a 5.x stack, run both stacks in parallel to the end of the retention window, and then cut over. Whild this adds a lot of nice transition cushion, this does move a lot of the problem to having double shipment on the loghosts themselves, and how to handle filebeat on those hosts in the interim.
The documentation makes it pretty clear that Filebeat 5.x isn't compatible with ES 1.x, but supposedly it is compatible with LS 2.x, which is who the shippers would be talking to directly.
Given that none (and I mean not a one) of my filebeat shippers ship directly to ES, and they all go though by LS filters, can I update my filebeat shippers to 5.x first?
What say ye?