Upgrading Logstash to 5.0

Fresh installations can and should start with the same version across the Elastic Stack.

Elasticsearch 5.0 does not require Logstash 5.0. An Elasticsearch 5.0 cluster will happily receive data from a Logstash 2.x instance via the default HTTP communication layer. This provides some flexibility to decide when to upgrade Logstash relative to an Elasticsearch upgrade. It may or may not be convenient for you to upgrade them together, and it is not required to be done at the same time as long as Elasticsearch is upgraded first.

You should upgrade in a timely manner to get the performance improvements that come with Logstash 5.0, but do so in the way that makes the most sense for your environment.

If any Logstash plugin that you require is not compatible with Logstash 5.0, then you should wait until it is ready before upgrading.

Although we make great efforts to ensure compatibility, Logstash 5.0 is not completely backwards compatible. As noted in the Elastic Stack upgrade guide, Logstash 5.0 should not be upgraded before Elasticsearch 5.0. This is both practical and because some Logstash 5.0 plugins may attempt to use features of Elasticsearch 5.0 that did not exist in earlier versions. For example, if you attempt to send the 5.x template to a cluster before Elasticsearch 5.0, then it will not be able to use it and all indexing will fail likely fail. If you use your own, custom template with Logstash, then this issue can be ignored.

Note the Elasticsearch Output Index Template change in the Breaking changes documentation for further insight into this change and how it impacts operations.