Filebeat still shows old version even if service is a later version

[Azkiel19]

Hi,

Checking into Elastic - the beat version still shows as 5.6.5 even though the service we have running is already at 6.8.13 and confirmed it is still sending logs real time.

Already tried restarting the filebeat service but no go.

I tried to check for articles on this but to no avail.

Any help is appreciated!

[warkolm (Mark Walkom)]

Welcome to our community!

Did you re-run the setup command for it after ugprading?

[Azkiel19]

Hi Warkolm!

Thank you.

A former colleague originally set this all up but left with no documentation (they were using 5.6.5 version).

A newer one installed the 6.8.13 but never got it working at all.

I'm still trying to grasp the tech behind this, but is the setup command simply the filebeat Application file

I appreciate any pointers. Thank you in advance!

[Azkiel19]

Tried running the said application but just returns me

Even though the filebeat.yml exists in the directory.

[warkolm (Mark Walkom)]

Please don't post pictures of text, logs or code. They are difficult to read, impossible to search and replicate (if it's code), and some people may not be even able to see them

Take a look at Filebeat quick start: installation and configuration | Filebeat Reference [8.5] | Elastic, you may need to run step 4 again.

[Azkiel19]

Hi Warkolm, apologies on the late response.

I have tried that but to no avail.

I've also uninstalled that version of filebeat that I'm still seeing in elastic (which is 5.6.5)

and then re-installed filebeat 6.8.13 as a service, confirmed running - but the logs I see are still the old version.

I am hesitant but seeing registry keys as a possibility. What do you think?