Thanks! https://www.elastic.co/guide/en/beats/libbeat/5.4/release-notes-5.4.0.html Selective excerpt: "Affecting all Beats Improve error message when downloading the dashboards fails. 3805 Fix potential Elasticsearch output URL parsing error if protocol scheme is missing. 3671 Downgrade Elasticsearch per batch item failure log to debug level. 3953 Make @timestamp accessible from format strings. 3721 Filebeat Allow log lines without a program name in the Syslog fileset. 3944 Don’t stop Filebeat when modules are used with the Logstash output. 3929 Properly shut down crawler in case one prospector is misconfigured. 4037 Addededit Affecting all Beats Update index mappings to support future Elasticsearch 6.X. 3778 Filebeat Add auditd module for reading audit logs on Linux. 3750 3941 Add fileset for the Linux authorization logs. 3669"
Got en error when starting filebeat-5.4.0: * Checking your configuration ... Exiting: error initializing publisher: Error loading template /etc/filebeat/filebeat.template-es6x.json: open /etc/filebeat/filebeat.template-es6x.json: no such file or directory Symlinking filebeat.template.json solves the problem.
(In reply to Thomas Stein from comment #1) > Got en error when starting filebeat-5.4.0: > > * Checking your configuration ... > Exiting: error initializing publisher: Error loading template > /etc/filebeat/filebeat.template-es6x.json: open > /etc/filebeat/filebeat.template-es6x.json: no such file or directory > > Symlinking filebeat.template.json solves the problem. Thanks for the info. I've tested with logstash output, but seems like you have the elasticsearch output for which this is required? I'll open a PR to include the new es6x.json mapping, they do differ from es2x.json, so it's best to use the new one.
https://github.com/gentoo/gentoo/pull/4741
Fixed in 5.4.0-r1.
