You are looking at preliminary documentation for a future release.
Not what you want? See the
current release documentation.
If something went wrongedit
If for whatever reason you’d like to revert the configuration after running the migrated configuration
and return to old log inputs the files that were taken by filestream inputs, you need to do the following:
- Stop Filebeat as soon as possible
- Save its debug-level logs for further investigation
-
Find your
registry.path/filebeatdirectory -
Find the created backup files, they have the
<timestamp>.baksuffix. If you have multiple backups for the same file, choose the one with the more recent timestamp. -
Replace the files with their backups, e.g.
log.jsonshould be replaced bylog.json-1674152412247684000.bak -
Run Filebeat with the old configuration (no
filestreaminputs withtake_over: true).
Reverting to backups might cause some events to repeat, depends on the amount of time the new configuration was running.