Breaking Changesedit

We strive to maintain backward compatibility between minor versions (6.x to 6.y, for example) so that you can upgrade without changing any configuration files. Breaking changes are usually introduced only between major versions (such as 5.x to 6.y). On occasion, we are forced to break compatibility within a given major release to ensure correctness of operation.

This section covers the changes that you need to be aware of when migrating to Logstash 6.0.0 and later.

Migrating directly between non-consecutive major versions (1.x to 6.x) is not recommended.

See these topics for a description of breaking changes:

See also Release Notes.

Breaking change across PQ versions prior to Logstash 6.3.0edit

If you are upgrading from Logstash 6.2.x or any earlier version (including 5.x) and have the persistent queue enabled, we strongly recommend that you drain or delete the persistent queue before you upgrade. See Upgrading Persistent Queue from Logstash 6.2.x and Earlier for information and instructions.

We are working to resolve issues with data incompatibilities so that additional steps won’t be required for future upgrades.

Breaking changes in 6.0edit

Here are the breaking changes for 6.0.

Changes in Logstash Coreedit

These changes can impact any instance of Logstash and are plugin agnostic, but only if you are using the features that are impacted.

Application Settingsedit
  • The setting config.reload.interval has been changed to use time value strings such as 5m, 10s etc. Previously, users had to convert this to a millisecond time value themselves.
RPM/Deb package changesedit
  • For rpm and deb release artifacts, config files that match the *.conf glob pattern must be in the conf.d folder, or the files will not be loaded.
Command Line Interface behavioredit
  • The -e and -f CLI options are now mutually exclusive. This also applies to the corresponding long form options config.string and path.config. This means any configurations provided via -e will no longer be appended to the configurations provided via -f.
  • Configurations provided with -f or config.path will not be appended with stdin input and stdout output automatically.

Plugin Changesedit

Elasticsearch output changesedit
  • The default document_type has changed from logs to doc for consistency with Beats. Furthermore, users are advised that Elasticsearch 6.0 deprecates doctypes, and 7.0 will remove them. See Removal of Mapping Types for more info.
  • The options flush_size and idle_flush_time are now obsolete.
  • Please note that the _all field is deprecated in 6.0. The new mapping template has been updated to reflect that. If you are using a custom mapping template you may need to update it to reflect that.
Kafka input changesedit
  • Upgraded Kafka client support to v0.11.0.0, which only supports Kafka brokers v0.10.x or later.

    • Please refer to Kafka input plugin documentation for information about Kafka compatibility with Logstash.
  • Decorated fields are now nested under @metadata to avoid mapping conflicts with Beats.

    • See the Metadata Fields section in the Kafka input plugin documentation for more details.
  • The ssl option is now obsolete.
Kafka output changesedit
  • Upgraded Kafka client support to v0.11.0.0, which only supports Kafka brokers v0.10.x or later.

    • Please refer to Kafka output plugin documentation for information about Kafka compatibility with Logstash.
  • The options block_on_buffer_full, ssl, and timeout_ms are now obsolete.
Beats input changesedit
List of plugins bundled with Logstashedit

The following plugins were removed from the 6.0 default bundle based on usage data. You can still install these plugins manually:

  • logstash-codec-oldlogstashjson
  • logstash-input-couchdb_changes
  • logstash-input-irc
  • logstash-input-log4j
  • logstash-input-lumberjack
  • logstash-filter-uuid
  • logstash-output-xmpp
  • logstash-output-irc
  • logstash-output-statsd