github-mirrors/logstash
1
0
Fork 0
mirror of https://github.com/elastic/logstash.git synced 2025-04-24 06:37:19 -04:00
Code Issues Projects Releases Packages Wiki Activity

Release notes for 6.0.1, remove upgrade guide section on 6.0.0 type bug

Browse source 
Fixes #8789
This commit is contained in:
Andrew Cholakian 2017-12-03 17:58:11 -06:00
parent 400075d715
commit c9087b18a8
2 changed files with 11 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/static/releasenotes.asciidoc vendored
View file

@ -3,6 +3,7 @@
This section summarizes the changes in the following releases:
* <<logstash-6-0-1,Logstash 6.0.1>>
* <<logstash-6-0-0,Logstash 6.0.0>>
ifdef::include-xpack[]
@ -11,6 +12,16 @@ See also:
* <<release-notes-xls>>
endif::include-xpack[]
[[logstash-6-0-1]]
=== Logstash 6.0.1 Release Notes
* Elasticsearch Output: We now ignore an event's type field for the purpose of setting the document _type if the cluster is Elasticsearch 6.x or above.
* Fixed bug where plugins that used nested hashes for configuration would not work correctly
* Improved shutdown process by ensuring that Logstash terminates on second SIGINT. Prior to this release, there were some situations where executing two SIGNINTs would not kill Logstash.
* Fixed a bug where persistent queue could not be opened when in some states
* Fixed an issue where the aggregate filter would not always shut down correctly
* Fixed a large performance regression in the grok filter that has been with us since Logstash 5.x.
Users should see a significant improvement in grok performance.
[[logstash-6-0-0]]
=== Logstash 6.0.0 Release Notes

24
docs/static/upgrading.asciidoc vendored
View file

@ -66,30 +66,6 @@ Before upgrading Logstash, remember to read the <<breaking-changes,breaking chan
If you are installing Logstash with other components in the Elastic Stack, also see the
{stack-ref}/index.html[Elastic Stack installation and upgrade documentation].
==== Issue with Logstash 6.0.0 `document_type` when writing to Elasticsearch 6.x
We’d like to alert users to behavior in Logstash 6.0.0 that can cause errors when writing to Elasticsearch 6.0+ clusters. When Logstash attempts to index events that result in multiple `type` values, Logstash encounters indexing errors. These errors look similar to the following example, which has been shortened from the full message:
[source,shell]
----
[2017-11-21T14:26:01,991][WARN ][logstash.outputs.elasticsearch] Could not index
event to Elasticsearch.{:status=>400, :response=>{"error"=>{"reason"=>"Rejecting
mapping update to [myindex] as the final mapping would have more than 1 type:
[type1, type2]"}}}}
----
Users are likely to encounter this error when Logstash is receiving data from:
* multiple types of Beats
* instances of Filebeat tailing mutliple files with different types
* multiple Logstash inputs that specify different `type` values
To work around this problem in Logstash 6.0.0, add the setting `document_type => doc` to the Elasticsearch output configuration. We will issue a patch to address this issue soon in a new version of Logstash.
Logstash has historically used the value of the `type` field to set the Elasticsearch `type` by default. Elasticsearch 6.0 https://www.elastic.co/guide/en/elasticsearch/reference/6.0/removal-of-types.html[no longer supports more than one type] per index. This is why the new behavior will only be applied to Elasticsearch 6.0+ clusters with our upcoming fixes.
Please read on for more information about document types with Logstash and Elasticsearch 6.0
==== Handling Document Types in Elasticsearch 6.0+
As of Elasticsearch 6.0, document types are https://www.elastic.co/guide/en/elasticsearch/reference/6.0/removal-of-types.html[on the way out], and only a single mapping type per index is supported. For Logstash users this means transitioning to using the `type` field inside of the document instead of the document type. The effect is the same, but the usage is slightly different. This may mean reconfiguring existing Kibana dashboards to use the new `type` field instead of the document type.