# How to find which node, with an old version of metricbeat, is the data coming from? **URL:** \ **Category:** Beats\ **Tags:** metricbeat\ **Created:** [January 6, 2021, 10:41pm UTC](https://discuss.elastic.co/t/how-to-find-which-node-with-an-old-version-of-metricbeat-is-the-data-coming-from/260389 "2021-01-06T22:41:11Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![vee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vee/32/55759_2.png) [@vee](https://discuss.elastic.co/u/vee)\ **Post date:** [January 6, 2021, 10:41pm UTC](https://discuss.elastic.co/t/how-to-find-which-node-with-an-old-version-of-metricbeat-is-the-data-coming-from/260389/1 "2021-01-06T22:41:11Z")
We've upgraded to elastic v7.5 a few months ago, and upgraded most of the known servers metricbeat to the same version. However, looks like there might be a few servers which still have v6.6 metricbeat running and so we see this error message constantly thrown in the master elastic node logs. Is there an easier to identify where the source data comign from these logs instead of logging into all the 100+ nodes and validating. Appreciate your time. ```auto failed to put template [metricbeat-6.6.0] org.elasticsearch.index.mapper.MapperParsingException: Failed to parse mapping [_doc]: Root mapping definition has unsupported parameters: [doc : {_meta={version=6.6.0}, dynamic_templates=[{traefik.health.response.status_code={path_match=traefik.health.response.status_code.*, mapping={type=long}, match_mapping_type=long}}, {vsphere.virtualmachine.custom_fields={path_match=vsphere.virtualmachine.custom_fields.*, mapping={type=keyword}, match_mapping_type=string}}, {system.process.env={path_match=system.process.env.*, mapping={type=keyword}, match_mapping_type=string}}, {system.process.cgroup.cpuacct.percpu={path_match=system.process.cgroup.cpuacct.percpu.*, mapping={type=long}, match_mapping_type=long}}, {docker.cpu.core.*.pct={path_match=docker.cpu.core.*.pct, mapping={scaling_factor=1000, type=scaled_float}, match_mapping_type=*}}, {docker.cpu.core.*.ticks={path_match=docker.cpu.core.*.ticks, mapping={type=long}, match_mapping_type=long}}, {docker.image.labels={path_match=docker.image.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {kubernetes.apiserver.request.latency.bucket={path_match=kubernetes.apiserver.request.latency.bucket.*, mapping={type=long}, match_mapping_type=long}}, {fields={path_match=fields.*, mapping={type=keyword}, match_mapping_type=string}}, {docker.container.labels={path_match=docker.container.labels.*, mapping={type=keyword}, match_mapping_type=string}}, {strings_as_keyword={mapping={ignore_above=1024, type=keyword}, match_mapping_type=string}}], date_detection=false, properties={container={properties={image={properties={name={path=docker.container.image, type=alias}}}, name={path=docker.container.name, type=alias}, id={path=docker.container.id, type=alias}}}, kubernetes={properties={container={properties={image={ignore_above=1024, type=keyword}, start_time={type=date}, memory={properties={request={properties={bytes={type=long}}}, rss={properties={bytes={type=long}}}, usage={properties={node={properties={pct={scaling_factor=1000, type=scaled_float}}}, bytes={type=long}, limit={properties={pct={scaling_factor=1000, type=scaled_float}}}}}, majorpagefaults={type=long}, limit={properties={bytes={type=long}}}, available={properties={bytes={type=long}}}, workingset={properties={bytes={type=long}}}, pagefaults={type=long}}}, rootfs={properties={inodes={properties={used={type=long}}}, available={properties={bytes={type=long}}}, used={properties={bytes={type=long}}}, capacity={properties={bytes={type=long}}}}}, name={ignore_above=1024, type=keyword}, cpu={properties={request={properties={cores={type=long}, nanocores={type=long}}}, usage={properties={core={properties={ns={type=long}}}, node={properties={pct={scaling_factor=1000, type=scaled_float}}}, nanocores={type=long}, limit={properties={pct={scaling_factor=1000, type=scaled_float}}}}}, limit={properties={cores={type=long}, nanocores={type=long}}}}}, id={ignore_above=1024, type=keyword}, logs={properties={inodes={properties={count={type=long}, used={type=long}, free={type=long}}}, available={properties={bytes={type=long}}}, used={properties={bytes={type=long}}}, capacity={properties={bytes={type=long}}}}}, status={properties={phase={ignore_above=1024, type=keyword}, reason={ignore_above=1024, type=keyword}, ready={type=boolean}, restarts={type=long}}}}}, pod= etc..... ``` ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 6, 2021, 10:43pm UTC](https://discuss.elastic.co/t/how-to-find-which-node-with-an-old-version-of-metricbeat-is-the-data-coming-from/260389/2 "2021-01-06T22:43:38Z")
Do you have Monitoring enabled? ---
**Author:** ![vee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vee/32/55759_2.png) [@vee](https://discuss.elastic.co/u/vee)\ **Post date:** [January 6, 2021, 10:56pm UTC](https://discuss.elastic.co/t/how-to-find-which-node-with-an-old-version-of-metricbeat-is-the-data-coming-from/260389/3 "2021-01-06T22:56:48Z")
Yes, we do. I did check in the Kibana monitoring page (beats section), but only see v7.5 beats showing up there. I'm guessing it's because the data coming from 6.6 version is never made into elastic and so no reference to where it's coming from. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 6, 2021, 10:58pm UTC](https://discuss.elastic.co/t/how-to-find-which-node-with-an-old-version-of-metricbeat-is-the-data-coming-from/260389/4 "2021-01-06T22:58:12Z")
Ok, do you have deployment automation at all? Puppet/chef/ansible/whatever. ---
**Author:** ![vee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vee/32/55759_2.png) [@vee](https://discuss.elastic.co/u/vee)\ **Post date:** [January 6, 2021, 11:08pm UTC](https://discuss.elastic.co/t/how-to-find-which-node-with-an-old-version-of-metricbeat-is-the-data-coming-from/260389/5 "2021-01-06T23:08:07Z")
yes, we do have automation at elastic level using ansible. And the metricbeat installation/configuration is limited to sub-sets of our servers. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 6, 2021, 11:15pm UTC](https://discuss.elastic.co/t/how-to-find-which-node-with-an-old-version-of-metricbeat-is-the-data-coming-from/260389/6 "2021-01-06T23:15:07Z")
That should be able to do reporting on installed packages then? ---
**Author:** ![vee](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vee/32/55759_2.png) [@vee](https://discuss.elastic.co/u/vee)\ **Post date:** [January 7, 2021, 3:52pm UTC](https://discuss.elastic.co/t/how-to-find-which-node-with-an-old-version-of-metricbeat-is-the-data-coming-from/260389/7 "2021-01-07T15:52:07Z")
I verified on all those servers to which metricbeat was rolled out through ansible, and they all have v7.5 running. So, the one with v6.6 must be coming from one of those misc servers which did not get updated through ansible. And that's what I'm attempting to find without having logging into all unknown servers to verify if they have v6 installed on them. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 11, 2021, 12:02am UTC](https://discuss.elastic.co/t/how-to-find-which-node-with-an-old-version-of-metricbeat-is-the-data-coming-from/260389/8 "2021-01-11T00:02:09Z")
In Discover can you pull up the Monitoring indices and then filter down based on version? ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [January 11, 2021, 1:51am UTC](https://discuss.elastic.co/t/how-to-find-which-node-with-an-old-version-of-metricbeat-is-the-data-coming-from/260389/9 "2021-01-11T01:51:53Z")
Or even simpler just got into Discover, look at metricbeat-\*, open a metricbeat document and filter out the agents version(s) you are not looking for.. ![Screen Shot 2021-01-10 at 5.49.44 PM](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1a6f72bb52ab43574e313a62ee0ac8b6ce7f7e30.png) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 8, 2021, 3:52am UTC](https://discuss.elastic.co/t/how-to-find-which-node-with-an-old-version-of-metricbeat-is-the-data-coming-from/260389/10 "2021-02-08T03:52:17Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.