# Updated filebeat (from 6.2.4 to 7.6 ) drops all log.\*

**URL:** <https://discuss.elastic.co/t/updated-filebeat-from-6-2-4-to-7-6-drops-all-log/232724>\
**Category:** Beats\
**Tags:** ecs-elastic-common-schema, filebeat\
**Created:** [May 14, 2020, 11:32pm UTC](https://discuss.elastic.co/t/updated-filebeat-from-6-2-4-to-7-6-drops-all-log/232724 "2020-05-14T23:32:41Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![mishat-realityi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mishat-realityi/32/51878_2.png) [@mishat-realityi](https://discuss.elastic.co/u/mishat-realityi)\
**Post date:** [May 14, 2020, 11:32pm UTC](https://discuss.elastic.co/t/updated-filebeat-from-6-2-4-to-7-6-drops-all-log/232724/1 "2020-05-14T23:32:41Z")

</div>

Hi everyone,  
I have a stack filebeat \> logstash \> elasticsearch  
Here is my config of filebeat.

```auto
    filebeat.inputs:
    - type: log
     enabled: true
     paths:
       - C:\folder\*
    json.keys_under_root: true
    output.logstash:
       hosts: [my.server:5044]

```

After migrating to filebeat 7.6.4 my log.message stop arriving to elasticsearch but everything else still does. It was obvious that I got a conflict with new ECS.

I went through migration [documentation](https://www.elastic.co/blog/migrating-to-elastic-common-schema-in-beats-environments) but still can find a proper solution to my problem. I don't use filebeat modules and changing a current log schema aren't an option. I've also tried different processors but no luck either.

Would love some thoughts on how to resolve this.  
Thank you,

Misha

---

<div class="post-metadata">

**Author:** ![mishat-realityi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mishat-realityi/32/51878_2.png) [@mishat-realityi](https://discuss.elastic.co/u/mishat-realityi)\
**Post date:** [May 19, 2020, 6:58pm UTC](https://discuss.elastic.co/t/updated-filebeat-from-6-2-4-to-7-6-drops-all-log/232724/2 "2020-05-19T18:58:28Z")

</div>

Will the best solution be to create a new filebeat module ?

---

<div class="post-metadata">

**Author:** ![webmat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/webmat/32/46191_2.png) [@webmat](https://discuss.elastic.co/u/webmat)\
**Post date:** [May 20, 2020, 7:03pm UTC](https://discuss.elastic.co/t/updated-filebeat-from-6-2-4-to-7-6-drops-all-log/232724/3 "2020-05-20T19:03:52Z")

</div>

The existing documentation focuses on data sources provided by Elastic indeed. Most of those have been migrated to ECS.

However both Filebeat and Logstash can send events to custom indices per data source. So if you create an index template that defines the schema as you had it in 6.x, then point the relevant stream of events to an index that matches this index template, you should be good to continue capturing your events exactly as you had them in 6.x.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 17, 2020, 7:03pm UTC](https://discuss.elastic.co/t/updated-filebeat-from-6-2-4-to-7-6-drops-all-log/232724/4 "2020-06-17T19:03:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.