FB 5.x -> Logstash 2.4 -> ES 1.7... Cool or no?

Elastic Stack Beats
1

Howdy folks,

I'm in the process of moving to a 5.x stack from my ancient Filebeat-1.3 -> Logstash-2.4 -> ES-1.7 stack. The plan is to build a 5.x stack, run both stacks in parallel to the end of the retention window, and then cut over. Whild this adds a lot of nice transition cushion, this does move a lot of the problem to having double shipment on the loghosts themselves, and how to handle filebeat on those hosts in the interim.

The documentation makes it pretty clear that Filebeat 5.x isn't compatible with ES 1.x, but supposedly it is compatible with LS 2.x, which is who the shippers would be talking to directly.

Given that none (and I mean not a one) of my filebeat shippers ship directly to ES, and they all go though by LS filters, can I update my filebeat shippers to 5.x first?

What say ye?

2

Beats 5.x to Logstash 2.4 should work for you. They are listed as compatible on the support matrix. In general we recommend updating ES then LS then Beats. But there wasn't a breaking change in the protocol between Beats and LS so they remain compatible.

I would test out the setup in a staging area before deploying it.

3

Thanks for the response. I was about to just hack together a test anyway at this point, but it's nice to have another voice align with my suspicions.

I'll test this out a bit and report it back to the community.

4

For posterity: This seems to be working fine. I'm able to use FB 5.3 to ship to both my old stack and me new one.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.