Users that send data from Beats to LS need to update their LS configuration to specify a new index name that includes the Beat version. Previously we recommended
output {
elasticsearch {
hosts => "localhost:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
And in 6.0 we updated to:
output {
elasticsearch {
hosts => "localhost:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
document_type => "%{[@metadata][type]}"
}
}
The index templates we supply all apply to [beat]-[version]-* so if you don't update LS the template won't be applied.
Users that send data from Beats to LS need to update their LS configuration to specify a new index name that includes the Beat version. Previously we recommended
And in 6.0 we updated to:
The index templates we supply all apply to
[beat]-[version]-*so if you don't update LS the template won't be applied.