Migrating from 1.X to 5.X

Hi all,

After updating from 1.x to 5.x, our logs don't seem to be pushed to ES/Kibana anymore.

I ran the config migration script and restarted filebeat but I am still not seeing any output to ES,

Also, the new config and the original (in the generated backup) were identical.

This was an rpm installation and I'm wondering if theres anything else I need to modify.

It also looks like from filebeat's perspective, everything is getting sent:

2016-10-14T00:32:30Z DBG output worker: publish 43 events
2016-10-14T00:32:30Z DBG ES Ping(url=http://search.us-west-2.es.amazonaws.com:80, timeout=1m30s)
2016-10-14T00:32:30Z DBG Ping status code: 200
2016-10-14T00:32:30Z INFO Connected to Elasticsearch version 1.5.2
2016-10-14T00:32:30Z INFO Trying to load template for client: http://search.us-west-2.es.amazonaws.com:80
2016-10-14T00:32:30Z DBG HEAD http://search.us-west-2.es.amazonaws.com:80/_template/filebeat
2016-10-14T00:32:30Z INFO Template already exists and will not be overwritten.
2016-10-14T00:32:30Z DBG PublishEvents: 43 events have been published to elasticsearch in 16.284284ms.
2016-10-14T00:32:30Z DBG send completed
2016-10-14T00:32:30Z DBG Events sent: 44
2016-10-14T00:32:30Z DBG Processing 44 events
2016-10-14T00:32:30Z DBG Registrar states cleaned up. Before: 1 , After: 1
2016-10-14T00:32:30Z DBG Write registry file: /var/lib/filebeat/registry
2016-10-14T00:32:30Z DBG Registry file updated. 1 states written.
2016-10-14T00:32:31Z DBG End of file reached: /var/log/app.log; Backoff now.
2016-10-14T00:32:33Z DBG End of file reached: /var/log/app.log; Backoff now.
2016-10-14T00:32:35Z DBG Flushing spooler because of timeout. Events flushed: 1

Thanks

Did you change the index template? See https://www.elastic.co/guide/en/beats/libbeat/5.0/upgrade-mapping-template.html#upgrade-mapping-template

Check your ES status and logs as well.

This topic was automatically closed after 21 days. New replies are no longer allowed.