IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Step 3: Use new option names Migrating from a Deprecated Filebeat Module »
Elastic Docs ›Filebeat Reference [8.14] ›How to guides ›Migrate log input configurations to filestream

If something went wrong

edit

If something went wrong

edit

If for whatever reason you’d like to revert the configuration after running the migrated configuration and return to old log inputs the files that were taken by filestream inputs, you need to do the following:

  1. Stop Filebeat as soon as possible
  2. Save its debug-level logs for further investigation
  3. Find your registry.path/filebeat directory
  4. Find the created backup files, they have the <timestamp>.bak suffix. If you have multiple backups for the same file, choose the one with the more recent timestamp.
  5. Replace the files with their backups, e.g. log.json should be replaced by log.json-1674152412247684000.bak
  6. Run Filebeat with the old configuration (no filestream inputs with take_over: true).

Reverting to backups might cause some events to repeat, depends on the amount of time the new configuration was running.

« Step 3: Use new option names Migrating from a Deprecated Filebeat Module »