IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« Configuring Security in Logstash X-Pack Breaking Changes »

›

Breaking Changes

edit

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Breaking Changes

edit

This section discusses the changes that you need to be aware of when migrating to Logstash 6.0.0 from the previous major releases.

Changes in Logstash Core

edit

These changes can impact any instance of Logstash and are plugin agnostic, but only if you are using the features that are impacted.

Application Settings

edit

The setting config.reload.interval has been changed to use time value strings such as 5m, 10s etc. Previously, users had to convert this to a millisecond time value themselves.

RPM/Deb package changes

edit

For rpm and deb release artifacts, config files that match the *.conf glob pattern must be in the conf.d folder, or the files will not be loaded. If there are non-configuration files in this folder this can be problematic.

Command Line Interface behavior

edit

The -e and -f CLI options are now mutually exclusive. This also applies to the corresponding long form options config.string and path.config. This means any configurations provided via -e will no longer be appended to the configurations provided via -f.
Configurations provided with -f or config.path will not be appended with stdin input and stdout output automatically.

Plugin Changes

edit

Note that the list of plugins included with Logstash has changed. Please check that the new plugin list still includes all plugins you use.

Elasticsearch output changes

edit

The default document_type has changed from logs to doc for consistency with Beats. Furthermore, users are advised that Elasticsearch 6.0 deprecates doctypes, and 7.0 will remove them. See Removal of Mapping Types for more info.
The options flush_size and idle_flush_time are now obsolete.
Please note that the _all field is deprecated in 6.0. The new mapping template has been updated to reflect that. If you are using a custom mapping template you may need to update it to reflect that.

Kafka input changes

edit

Upgraded Kafka client support to v0.11.0.0, which only supports Kafka brokers v0.10.x or later.
- Please refer to Kafka input plugin documentation for information about Kafka compatibility with Logstash.
Decorated fields are now nested under @metadata to avoid mapping conflicts with Beats.
- See the Metadata Fields section in the Kafka input plugin documentation for more details.
The ssl option is now obsolete.

Kafka output changes

edit

Upgraded Kafka client support to v0.11.0.0, which only supports Kafka brokers v0.10.x or later.
- Please refer to Kafka output plugin documentation for information about Kafka compatibility with Logstash.
The options block_on_buffer_full, ssl, and timeout_ms are now obsolete.

Beats input changes

edit

Logstash will no longer start when Multiline codec plugin is used with the Beats input plugin.
- It is recommended to use the multiline support in Filebeat as a replacement - see configuration options available in Filebeat for details.
The options congestion_threshold and target_field_for_codec are now obsolete.

TCP Input Changes

edit

Changed the behaviour of the host field to contain the resolved peer hostname for a connection instead of its peer IP.
Removed the data_timeout and ssl_cacert options because they are now obsolete.
Moved the peer’s IP to the new field ip_address.