No visualization after upgrade to 6.2.2 from 5.6.5

[raamee]

Hi,

I recently upgraded our ELK setup to 6.2.2 from 5.6.5. I have two types of log and previously in 5.6.5, I used document_type (in filebeat) and separated those two logs in to separate index in logstash. So the _type field determines what type of log it is and based on that visualizations are drawn.

Now that _type is deprecated , I see in Kibana that _type field simply equals to doc and the visualizations are not working. Although, I get the logs in discover page.

Once I downgraded both logstash and filebeat to 5.6.5, I can see the visualizations (with _type field equals to the log type).

Any help appreciated.

Thank you.

[tylersmalley]

Not sure I understand what your question is.

Since we have begun deprecating mapping types, you are no longer able to create indices with a _type.

Your log data:

The limitation on type is that an index can only contain one. It sounds like we were (or are now) splitting the index up by type. If this is correct, you shouldn't have to do anything here.

The Kibana index:

Since Kibana utilizes Elasticsearch to persist data, we too had to handle the deprecation of mapping types. Upgrading to 6.x requires the data to be migrated. You can either do this with the migration UI in X-Pack basic (free) or by manually migrating the data.

[raamee]

I have already migrated / re-indexed using the upgrade assistant UI using x-pack. But I am not getting the visualizations.

I see that even after using the upgrade assistant UI , I still see _type field in the index.