Filebeat 5.x install and file migration

I have a filebeat on a web server forwarding a logfile to a logstash instance.
I'm planning to migrate said web server and i'll migrate the whole logfile and install the same filebeat version (5.6.4) and migrate it's running config.

My question is: is my new filebeat install, with the same config file will be missing something else, like the current state of the shipping of the lines of the log file or something like that?

I mainly want to prevent the migrated filebeat service from re-sending the whole log file to logstash when i start it and causing it to insert duplicates in my index. The problem hasn't happened yet but i think filebeat is using something more than just the yaml file to manage it's inner handling of the log file. I've spotted the registry file which might be what i'm looking for but i haven't found any explicit documentation on it's role and whether migrating it will cause the wanted effect (keeping the state of the old filebeat regarding the shipping of the log lines)

Any insight on the subject would be more than welcome!

Hello @EtienneDemers,
Filebeat keeps a registry file in his data directory and using a newer version of Filebeat will be able to use the same registry and read the files from that starting points.

Concerning the configuration, some options did changes, the more important one that come to my mind is the renaming of "prospectors" to "inputs" and the move to ECS, I suggest you take a look at our breaking change page to see what can impact you.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.