IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Configuring Security in Logstash X-Pack Breaking Changes »
Elastic Docs ›Logstash Reference [6.0]

Breaking Changes

edit

Breaking Changes

edit

This section discusses the changes that you need to be aware of when migrating to Logstash 6.0.0 from the previous major releases.

See also:

Changes in Logstash Core

edit

These changes can impact any instance of Logstash and are plugin agnostic, but only if you are using the features that are impacted.

Application Settings

edit
  • The setting config.reload.interval has been changed to use time value strings such as 5m, 10s etc. Previously, users had to convert this to a millisecond time value themselves.

RPM/Deb package changes

edit
  • For rpm and deb release artifacts, config files that match the *.conf glob pattern must be in the conf.d folder, or the files will not be loaded. If there are non-configuration files in this folder this can be problematic.

Command Line Interface behavior

edit
  • The -e and -f CLI options are now mutually exclusive. This also applies to the corresponding long form options config.string and path.config. This means any configurations provided via -e will no longer be appended to the configurations provided via -f.
  • Configurations provided with -f or config.path will not be appended with stdin input and stdout output automatically.

Plugin Changes

edit

Note that the list of plugins included with Logstash has changed. Please check that the new plugin list still includes all plugins you use.

Elasticsearch output changes

edit
  • The default document_type has changed from logs to doc for consistency with Beats. Furthermore, users are advised that Elasticsearch 6.0 deprecates doctypes, and 7.0 will remove them. See Removal of Mapping Types for more info.
  • The options flush_size and idle_flush_time are now obsolete.
  • Please note that the _all field is deprecated in 6.0. The new mapping template has been updated to reflect that. If you are using a custom mapping template you may need to update it to reflect that.

Kafka input changes

edit

  • Upgraded Kafka client support to v0.11.0.0, which only supports Kafka brokers v0.10.x or later.

    • Please refer to Kafka input plugin documentation for information about Kafka compatibility with Logstash.

  • Decorated fields are now nested under @metadata to avoid mapping conflicts with Beats.

    • See the Metadata Fields section in the Kafka input plugin documentation for more details.
  • The ssl option is now obsolete.

Kafka output changes

edit

  • Upgraded Kafka client support to v0.11.0.0, which only supports Kafka brokers v0.10.x or later.

    • Please refer to Kafka output plugin documentation for information about Kafka compatibility with Logstash.
  • The options block_on_buffer_full, ssl, and timeout_ms are now obsolete.

Beats input changes

edit

TCP Input Changes

edit
  • Changed the behaviour of the host field to contain the resolved peer hostname for a connection instead of its peer IP.
  • Removed the data_timeout and ssl_cacert options because they are now obsolete.
  • Moved the peer’s IP to the new field ip_address.

TCP Output Changes

edit
  • Breaking: removed the message_format option because it is now obsolete.

SQS Output Changes

edit
  • Breaking: removed the batch and batch_timeout options because they are now obsolete.

Redis Output Changes

edit
  • Removed the name and queue options because they are now obsolete.

RabbitMQ Input/Output Changes

edit
  • Removed the debug, tls_certificate_path, and tls_certificate_password options because they are now obsolete.

Logstash Output HTTP

edit
  • Removed the ssl_certificate_verify option because it is now obsolete.

Logstash Input HTTP Poller

edit
  • Removed the ssl_certificate_verify option because it is now obsolete.

GeoIP Changes

edit
  • Removed the lru_cache_size option because it is now obsolete.

CEF Codec Changes

edit
  • Removed the sev and deprecated_v1_fields options because they are now obsolete.

List of plugins bundled with Logstash

edit

The following plugins were removed from the 6.0 default bundle based on usage data. You can still install these plugins manually:

  • logstash-codec-oldlogstashjson
  • logstash-input-couchdb_changes
  • logstash-input-irc
  • logstash-input-log4j
  • logstash-input-lumberjack
  • logstash-filter-uuid
  • logstash-output-xmpp
  • logstash-output-irc
  • logstash-output-statsd
« Configuring Security in Logstash X-Pack Breaking Changes »