I have a 3 nodes cluster that was on version 7.1.1 until yesterday.
I updated the cluster performing small steps (7.2-7.3-7.6-7.9) in order to start playing with the new alerting framework.
I use beats to send metrics and logs into logstash piplines, and than ingest data into ES.
For metrics, the metricbeat dashboard (7.1 version) were installed in kibana. As the older version of beats still be compatible with the new stack, I'd not updated them.
Everything seemed to be fine, unless checking metricbeat dashboards I found something strange:
- Metricbeat System dashboards have been duplicated with a new set called [Metrics System] (also the id is the same, having system- as prefix)
- Visualize inside these dashboards have been updated, making them pointing to a new index pattern metrics-*
- New index patterns were set in kibana: logs-* and metrics-*
- New ILM policies were set in ES: logs and metrics
I really don't understand why it happened, as I never updated metricbeat, neither I launched the setup command; in addition, there isn't any trace in documentation about these 2 new indexes, that probably will replace filebeat and metricbeat indexes.
There is someone else that faced this issue, or have an explanation for this behaviour?