# Registry Error Upgrading Beats, Safe to Delete Registry File?

**URL:** <https://discuss.elastic.co/t/registry-error-upgrading-beats-safe-to-delete-registry-file/127394>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [April 9, 2018, 10:06pm UTC](https://discuss.elastic.co/t/registry-error-upgrading-beats-safe-to-delete-registry-file/127394 "2018-04-09T22:06:34Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![aidanhl](https://avatars.discourse-cdn.com/v4/letter/a/9e8a1a/32.png) [@aidanhl](https://discuss.elastic.co/u/aidanhl)\
**Post date:** [April 9, 2018, 10:06pm UTC](https://discuss.elastic.co/t/registry-error-upgrading-beats-safe-to-delete-registry-file/127394/1 "2018-04-09T22:06:34Z")

</div>

Hello,

I am upgrading filebeat from version 1.0.0 to 6.2.3. I have the process just about ready to go against a group of machines, but filebeat 6.2.3 fails to start with the full error:

`Exiting: Could not start registrar: Error loading state: Error decoding states: json: cannot unmarshal object into Go value of type []file.State`

Reading through the discussions on here it seems like the consensus was to delete the registry file and try again. That works in starting the service, but is that a safe procedure to do? Is there another option?

---

<div class="post-metadata">

**Author:** ![aidanhl](https://avatars.discourse-cdn.com/v4/letter/a/9e8a1a/32.png) [@aidanhl](https://discuss.elastic.co/u/aidanhl)\
**Post date:** [April 9, 2018, 11:41pm UTC](https://discuss.elastic.co/t/registry-error-upgrading-beats-safe-to-delete-registry-file/127394/2 "2018-04-09T23:41:20Z")

</div>

There appears to be conflicting answers on the discussion board.

One suggesting to delete the regfile to fix the issue, and one saying that deleting the regfile is not a safe procedure.

> [@Exiting: Could not start registrar: Error loading state: Error decoding states: EOF](https://discuss.elastic.co/t/exiting-could-not-start-registrar-error-loading-state-error-decoding-states-eof/74430):
>
> My environment: # cat /etc/redhat-release Red Hat Enterprise Linux Server release 7.3 (Maipo) # rpm -q filebeat filebeat-5.2.0-1.x86\_64 # systemctl: # systemctl stop filebeat # systemctl start filebeat # echo $? 0 # systemctl status filebeat ● filebeat.service - filebeat Loaded: loaded (/usr/lib/systemd/system/filebeat.service; enabled; vendor preset: disabled) Active: failed (Result: start-limit) since Wed 2017-02-08 15:32:17 EST; 8min ago Docs: https://www.elastic.co/guide/en/b…

> [@Deleting Filebeat Registry File](https://discuss.elastic.co/t/deleting-filebeat-registry-file/46112/6):
>
> This issue should potentially solve this problem: [https://github.com/elastic/beats/issues/1022](https://github.com/elastic/beats/issues/1022) Please have a look and let me know if this would help.

---

<div class="post-metadata">

**Author:** ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)\
**Post date:** [April 10, 2018, 11:11am UTC](https://discuss.elastic.co/t/registry-error-upgrading-beats-safe-to-delete-registry-file/127394/3 "2018-04-10T11:11:49Z")

</div>

Deleting the registry file means filebeat will have to restart all over. The registry file keeps the file states, like last lines being read. If this file is removed, all old logs will be published again.

Filebeat 1.0.0 is EOL for quite some time. But if you want to migrate, you will have to use 5.0 first. The registry format has changed between 1.x and 5.x, but on first start of 5.0, the file will be converted. Using the new file, you can upgrade to 6.x.

If you can life with old logs being published again, just deleting the registry file is the easier option here.

---

<div class="post-metadata">

**Author:** ![aidanhl](https://avatars.discourse-cdn.com/v4/letter/a/9e8a1a/32.png) [@aidanhl](https://discuss.elastic.co/u/aidanhl)\
**Post date:** [April 10, 2018, 4:43pm UTC](https://discuss.elastic.co/t/registry-error-upgrading-beats-safe-to-delete-registry-file/127394/4 "2018-04-10T16:43:49Z")

</div>

Thanks for the clear answer.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 8, 2018, 4:43pm UTC](https://discuss.elastic.co/t/registry-error-upgrading-beats-safe-to-delete-registry-file/127394/5 "2018-05-08T16:43:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
