Greetings all. I have some questions in general about when beats upgrade. We have ELK running on a cluster where an orchestration platform upgrades the beats automatically. So using Logstash of course when I first used a beat I had to stop Logstash and inject the index templates by hand.
My question is do we need to do this process each time the beat is updated? Say I upgraded to Metricbeat 7.9 and through the command line injected the index templates into ES after stopping Logstash. When the beat upgrades to 7.10 do I need to do that again? Does the index structure (mapping) change when beats upgrade?
I keep seeing with the beats that there is this 3-4 lag in Kibana between when stuff is supposedly getting ingested and when it shows up in Kibana. Wonder if this is related. Also, I notice if I delete an index pattern after a beat upgrade, and then make a new one, the new "metricbeat-*" pattern now has mapping conflicts.
This is an EXTREMELY confusing situation. Just saying. Thanks!