# Migrating from Filebeat 5.5.2 to 6.0.0
**URL:** https://discuss.elastic.co/t/migrating-from-filebeat-5-5-2-to-6-0-0/107968
**Category:** Beats
**Created:** [November 16, 2017, 3:12pm UTC](https://discuss.elastic.co/t/migrating-from-filebeat-5-5-2-to-6-0-0/107968 "2017-11-16T15:12:48Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Maekee](https://discuss.elastic.co/u/Maekee)
#### Post date: [November 16, 2017, 3:12pm UTC](https://discuss.elastic.co/t/migrating-from-filebeat-5-5-2-to-6-0-0/107968/1 "2017-11-16T15:12:48Z")
Hello World,
I am trying to upgrade my filebeat agent and doing the following steps (on Windows):
1. Stopping the filebeat service
2. uninstalling the filebeat with the uninstall-service-winlogbeat.ps1
3. replacing the winlogbeat.yml in the 6.0.0 folder with the one that works from 5.5.2
4. installing the service with install-service-winlogbeat.ps1
5. Starting the service
No events coming in to ElasticSearch.... ☹
Stopping and Rolling back to the old 5.5.2 agent.. all documents/events coming in since last event.
Why?
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [November 16, 2017, 4:35pm UTC](https://discuss.elastic.co/t/migrating-from-filebeat-5-5-2-to-6-0-0/107968/2 "2017-11-16T16:35:44Z")
After upgrading you should test your config and output. Perhaps you are affected by a [breaking change](https://www.elastic.co/guide/en/beats/libbeat/current/breaking-changes-6.0.html) in 6.0.
PS \> .\winlogbeat.exe test config -e
PS \> .\winlogbeat.exe test output -e
---
### Author:  [@Maekee](https://discuss.elastic.co/u/Maekee)
#### Post date: [November 16, 2017, 7:38pm UTC](https://discuss.elastic.co/t/migrating-from-filebeat-5-5-2-to-6-0-0/107968/3 "2017-11-16T19:38:27Z")
Seems like it is something in Logstash, because now i can get the events sent successfully in the winlogbeat logs, but they dont show up in elasticsearch.
I get this error in my logstash server:
[2017-11-16T20:35:35,062][WARN][logstash.outputs.elasticsearch] Could not index event to Elasticsearch. {:status=\>400, :action=\>["index", {:\_id=\>nil, :\_index=\>"winlogbeat-2017.11.16", :\_type=\>"wineventlog", :\_routing=\>nil}, #LogStash::Event:0x1d52d6b3], :response=\>{"index"=\>{"\_index"=\>"winlogbeat-2017.11.16", "\_type"=\>"wineventlog", "\_id"=\>"gL5Uxl8BA5Maqd7NT5eO", "status"=\>400, "error"=\>{"type"=\>"illegal\_argument\_exception", "reason"=\>"Rejecting mapping update to [winlogbeat-2017.11.16] as the final mapping would have more than 1 type: [doc, wineventlog]"}}}}
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [November 16, 2017, 8:38pm UTC](https://discuss.elastic.co/t/migrating-from-filebeat-5-5-2-to-6-0-0/107968/4 "2017-11-16T20:38:15Z")
Did you install the latest index template from winlogbeat 6.0.0 to Elasticsearch? Since you are using Logstash you have to do in manually because the Beat isn't directly connection to ES.
```auto
# Write the template to disk.
PS> .\winlogbeat.exe export template | Out-File -Encoding UTF8 winlogbeat.template.json
# Install it to ES.
PS > Invoke-RestMethod -Method Put -ContentType "application/json" -InFile winlogbeat.template.json -Uri http://elasticsearch:9200/_template/winlogbeat-6.0.0
```
And after you have installed the index template to ES check your Logstash config to make sure that it is using a version in the index name like shown [in these docs](https://www.elastic.co/guide/en/beats/libbeat/6.0/logstash-installation.html#logstash-setup).
```auto
output {
elasticsearch {
hosts => "localhost:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
```
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [November 16, 2017, 9:18pm UTC](https://discuss.elastic.co/t/migrating-from-filebeat-5-5-2-to-6-0-0/107968/5 "2017-11-16T21:18:06Z")
Another method of installing the template is like this:
```auto
PS C:\Program Files\Winlogbeat> .\winlogbeat.exe setup --template -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["elasticsearch:9200"]'
```
where `elasticsearch` is the hostname/IP of your ES server.
---
### Author:  [@Maekee](https://discuss.elastic.co/u/Maekee)
#### Post date: [November 17, 2017, 8:56am UTC](https://discuss.elastic.co/t/migrating-from-filebeat-5-5-2-to-6-0-0/107968/6 "2017-11-17T08:56:26Z")
You are correct, i did not update the template. But i have now. Is it enough to do this once? and then all winlogbeat agents will use that template? (I dont need to do that once per client?).
I updated and now they are coming in as they should.
Found this info, dont know if its because of that:
> The Beats shipper automatically sets the type field on the event. You cannot override this setting in the Logstash config. If you specify a setting for the type config option in Logstash, it is ignored.
---
### Author:  [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)
#### Post date: [November 17, 2017, 3:39pm UTC](https://discuss.elastic.co/t/migrating-from-filebeat-5-5-2-to-6-0-0/107968/7 "2017-11-17T15:39:15Z")
Correct you only need to do this once because it will apply to all indices created in elasticsearch that match `winlogbeat-6.0.0-*`. When you upgrade to 6.0.1 you should repeat this before starting the beat (the template should be there before any data shows up to ensure it gets index properly).
That statement about types in Logstash is unrelated to the problem. The `type => log` setting does nothing and that is all this statement is saying.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 7, 2017, 3:12pm UTC](https://discuss.elastic.co/t/migrating-from-filebeat-5-5-2-to-6-0-0/107968/8 "2017-12-07T15:12:52Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.