# Upgraded to 6.0.0, where is my latest data!?

**URL:** <https://discuss.elastic.co/t/upgraded-to-6-0-0-where-is-my-latest-data/107926>\
**Category:** Logstash\
**Created:** [November 16, 2017, 11:53am UTC](https://discuss.elastic.co/t/upgraded-to-6-0-0-where-is-my-latest-data/107926 "2017-11-16T11:53:13Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![cosmo](https://avatars.discourse-cdn.com/v4/letter/c/46a35a/32.png) [@cosmo](https://discuss.elastic.co/u/cosmo)\
**Post date:** [November 16, 2017, 11:53am UTC](https://discuss.elastic.co/t/upgraded-to-6-0-0-where-is-my-latest-data/107926/1 "2017-11-16T11:53:14Z")

</div>

Hello

I upgraded from 5.6 to 6.0 yesterday.

I have a cron to download a daily log, then pass that into logstash to index all the events.  
eg `bin/logstash -f custom-config.yml < /logs/log-2017-11-15.log`

I haven't changed the config, but logstash seems to have hidden my data somewhere.

Normally it would create an index `logstash-2017.11.15` (the default pattern) but I can't find that index for yesterday.

I am using xpack with a basic license, I don't know if that could have effected anything?

I just installed xpack in logstash, and have now got the Logstash monitoring in Kibana, which says it has received and emitted about a million events, which is about right for the log file. But I can't for the life of me find them!

I have run the command manually with `--debug` but that doesn't tell me anything, and there don't seem to be any errors in `/var/log/elasticsearch/elasticsearch.log`

Have I missed some obvious step in the upgrade??

Thanks  
Chris

---

<div class="post-metadata">

**Author:** ![cosmo](https://avatars.discourse-cdn.com/v4/letter/c/46a35a/32.png) [@cosmo](https://discuss.elastic.co/u/cosmo)\
**Post date:** [November 16, 2017, 11:59am UTC](https://discuss.elastic.co/t/upgraded-to-6-0-0-where-is-my-latest-data/107926/2 "2017-11-16T11:59:07Z")

</div>

Also just to add, I have a custom PHP script that inserts documents straight into the same elasticsearch and that is still working fine (after upgrading the php elastic module version)

---

<div class="post-metadata">

**Author:** ![cosmo](https://avatars.discourse-cdn.com/v4/letter/c/46a35a/32.png) [@cosmo](https://discuss.elastic.co/u/cosmo)\
**Post date:** [November 16, 2017, 1:55pm UTC](https://discuss.elastic.co/t/upgraded-to-6-0-0-where-is-my-latest-data/107926/3 "2017-11-16T13:55:10Z")

</div>

I think I've figure this out.  
I'm using the default logstash templates, but didn't read the part of the docs saying I now have to set `template_overwrite = true`

[https://www.elastic.co/guide/en/logstash/current/upgrading-logstash-6.0.html](https://www.elastic.co/guide/en/logstash/current/upgrading-logstash-6.0.html)  
(also [pull request](https://github.com/elastic/logstash/pull/8687) to correct overwrite\_template to template\_overwrite)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 14, 2017, 1:55pm UTC](https://discuss.elastic.co/t/upgraded-to-6-0-0-where-is-my-latest-data/107926/4 "2017-12-14T13:55:29Z")

</div>

Closed on December 14, 2017, 1:55pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.