# Filbeat 6.3.1 not sending logs to stack 6.3.1

**URL:** <https://discuss.elastic.co/t/filbeat-6-3-1-not-sending-logs-to-stack-6-3-1/140188>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 16, 2018, 4:02pm UTC](https://discuss.elastic.co/t/filbeat-6-3-1-not-sending-logs-to-stack-6-3-1/140188 "2018-07-16T16:02:08Z")\
**Posts on this page:** 6\
**Page:** 2

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [July 26, 2018, 11:54am UTC](https://discuss.elastic.co/t/filbeat-6-3-1-not-sending-logs-to-stack-6-3-1/140188/21 "2018-07-26T11:54:39Z")

</div>

@lenn4rd I would recommend to load the templates each time. If you connect to ES directly it will happen automatically. The reason is assuming there is a bug in a field name for 6.3.1 we can fix it in 6.3.2. Setup does more then just the template, also dashboards. There having each bugfix release is nice to have but it's not a must.

@Diggy Filebeat templates look good. You need to make sure you also index into the according index patterns containing the Filebeat version number.

---

<div class="post-metadata">

**Author:** ![Diggy](https://avatars.discourse-cdn.com/v4/letter/d/e99b99/32.png) [@Diggy](https://discuss.elastic.co/u/Diggy)\
**Post date:** [July 26, 2018, 12:33pm UTC](https://discuss.elastic.co/t/filbeat-6-3-1-not-sending-logs-to-stack-6-3-1/140188/22 "2018-07-26T12:33:58Z")

</div>

> [@ruflin](#):
>
> Filebeat templates look good. You need to make sure you also index into the according index patterns containing the Filebeat version number.

How do I do that? As you've seen, I already have a pattern `filebeat-*`. If I try to create one named e.g. filebeat-6.3.1-\*, it doesn't work. "curl 10.0.101.101:9200/\_cat/indices?v|sort -n" produces this:

~  
yellow open filebeat-2018.07.23 mfM-dBQ9RyyxAQ7ZiShH3Q 5 1 37002 0 14.1mb 14.1mb  
yellow open filebeat-2018.07.24 1GVQtjKfSP2zBHhWx68Zwg 5 1 104780 0 37.8mb 37.8mb  
yellow open filebeat-2018.07.25 TxoZtDKUQzmZuZcgeGGMeg 5 1 33309 0 9.4mb 9.4mb  
yellow open filebeat-2018.07.26 TJ-S3DExQhaCP0o6r1YnJA 5 1 66880 0 22.6mb 22.6mb  
~

(The yellow condition is presumable from having only one elasticsearch instance. That's what I think, anyway.)

Again, apologies for dragging this out, and for asking questions, the answers to which I should probably know.

---

<div class="post-metadata">

**Author:** ![lenn4rd](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lenn4rd/32/33464_2.png) [@lenn4rd](https://discuss.elastic.co/u/lenn4rd)\
**Post date:** [July 26, 2018, 2:49pm UTC](https://discuss.elastic.co/t/filbeat-6-3-1-not-sending-logs-to-stack-6-3-1/140188/23 "2018-07-26T14:49:20Z")

</div>

That makes sense, thanks for the heads up. Filebeat sends its data to Logstash but I'll set up my update routine so that templates and dashboards are updated once I deploy new agent versions.

---

<div class="post-metadata">

**Author:** ![Diggy](https://avatars.discourse-cdn.com/v4/letter/d/e99b99/32.png) [@Diggy](https://discuss.elastic.co/u/Diggy)\
**Post date:** [July 27, 2018, 12:38pm UTC](https://discuss.elastic.co/t/filbeat-6-3-1-not-sending-logs-to-stack-6-3-1/140188/24 "2018-07-27T12:38:50Z")

</div>

> [@Diggy](#):
>
> You need to make sure you also index into the according index patterns containing the Filebeat version number.

And, I do that how?

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [July 30, 2018, 6:10am UTC](https://discuss.elastic.co/t/filbeat-6-3-1-not-sending-logs-to-stack-6-3-1/140188/25 "2018-07-30T06:10:07Z")

</div>

If you use the Elasticsearch output as recommended in our Beats getting started it will do it automatically for you: [https://www.elastic.co/guide/en/elastic-stack-overview/6.3/get-started-elastic-stack.html#logstash-setup](https://www.elastic.co/guide/en/elastic-stack-overview/6.3/get-started-elastic-stack.html#logstash-setup)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 27, 2018, 6:10am UTC](https://discuss.elastic.co/t/filbeat-6-3-1-not-sending-logs-to-stack-6-3-1/140188/26 "2018-08-27T06:10:12Z")

</div>

Closed on August 27, 2018, 6:10am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/filbeat-6-3-1-not-sending-logs-to-stack-6-3-1/140188.md?page=1)
