Need to recreate/reindex when upgrading beats?

Greetings all. I have some questions in general about when beats upgrade. We have ELK running on a cluster where an orchestration platform upgrades the beats automatically. So using Logstash of course when I first used a beat I had to stop Logstash and inject the index templates by hand.

My question is do we need to do this process each time the beat is updated? Say I upgraded to Metricbeat 7.9 and through the command line injected the index templates into ES after stopping Logstash. When the beat upgrades to 7.10 do I need to do that again? Does the index structure (mapping) change when beats upgrade?

I keep seeing with the beats that there is this 3-4 lag in Kibana between when stuff is supposedly getting ingested and when it shows up in Kibana. Wonder if this is related. Also, I notice if I delete an index pattern after a beat upgrade, and then make a new one, the new "metricbeat-*" pattern now has mapping conflicts.

This is an EXTREMELY confusing situation. Just saying. Thanks!

It'd be better to do it, so you know you are always running the latest templates.
Otherwise you may get caught out.

Adding that I think that beats are automatically upgrading the templates but only when directly connected to Elasticsearch.

It does not happen when connected through Logstash.

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.