這一篇建議參考原版[https://www.elastic.co/guide/en/logstash/current/upgrading-logstash-6.0.html](https://www.elastic.co/guide/en/logstash/current/upgrading-logstash-6.0.html) 升級之前記得閱讀[更新日志](https://www.elastic.co/guide/en/logstash/current/breaking-changes.html)。 如果你安裝了Logstash和其他Elastic Stack中的產品，還需要查看[Elastic Stack安裝和升級文檔](http://www.elastic.co/guide/en/elastic-stack/6.5/index.html)。 ### Issue with Logstash 6.0.0 `document_type` when writing to Elasticsearch 6.x 注:這個標題的意思大致是Logstash6.0.0使用`document_type`向Elasticsearch6.x寫入時會產生的問題 . 我們想提醒我們的用戶,由于Logstash6.0.0中的一些行為導致Logstash 6.0.0在向Elasticsearch 6.0+集群中寫入的時候會引發一些錯誤.當Logstash嘗試將包含多個`type`的單個索引寫入Elasticsearch集群的時候,Logstash會遇到一個錯誤.這個錯誤看起來類似下面的示例,我們簡化了這個信息: ```text [2017-11-21T14:26:01,991][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch.{:status=>400, :response=>{"error"=>{"reason"=>"Rejecting mapping update to [myindex] as the final mapping would have more than 1 type: [type1, type2]"}}}} ``` 當Logstash從以下位置接收數據時,用戶可能會遇到這個錯誤: + 多種類型的Beats + 追蹤不同類型的多個文件的Filebeat實例 + 多個Logstash inputs且定義了不同的`type` 要在Logstash6.0.0中解決這個問題,可以在Elasticsearch output配置中添加`document_type => doc`.我們會在新版Logstash中發布一個針對此問題的補丁. Logstash歷史上一直默認以`type`字段的值來設置Elasticsearch的`type`.但是Elasticsearch 6.0中[不再支持單個索引中包含多個類型](https://www.elastic.co/guide/en/elasticsearch/reference/6.0/removal-of-types.html).這也是為什么這個問題僅出現在我們即將發布補丁的Elasticsearch 6.0+ 集群上. 原文:Logstash has historically used the value of the `type` field to set the Elasticsearch `type` by default. Elasticsearch 6.0 [no longer supports more than one type](https://www.elastic.co/guide/en/elasticsearch/reference/6.0/removal-of-types.html) per index. This is why the new behavior will only be applied to Elasticsearch 6.0+ clusters with our upcoming fixes. 請閱讀更多關于Logstash和Elasticsearch 6.0 Document types的信息. ### Handling Document Types inElasticsearch 6.0+ 處理Elasticsearch6.0+的文檔類型 As of Elasticsearch 6.0, document types are [on the way out](https://www.elastic.co/guide/en/elasticsearch/reference/6.0/removal-of-types.html), and only a single mapping type per index is supported. For Logstash users this means transitioning to using the `type` field inside of the document instead of the document type. The effect is the same, but the usage is slightly different. This may mean reconfiguring existing Kibana dashboards to use the new `type` field instead of the document type. > <font color=#FF0000 size=4>說明</font>:上一段說Logstash使用`type`字段來設置Elasticsearch的`type`.新版Elasticsearch不支持單個索引中多個類型.也就是這兩句:Logstash has historically used the value of the `type` field to set the Elasticsearch `type` by default. Elasticsearch 6.0 [no longer supports more than one type](https://www.elastic.co/guide/en/elasticsearch/reference/6.0/removal-of-types.html) per index. 但是這里又說,對于Logstash用戶這意味著使用文檔內的`type`字段而不是文檔類型.即這一句:For Logstash users this means transitioning to using the `type` field inside of the document instead of the document type. 由于這部分涉及到Elasticsearch老版本和新版本在處理文檔索引時的原理.本人不是很清楚.這里就沒有翻譯,而是用原文替代.具體的信息在[https://www.elastic.co/guide/en/elasticsearch/reference/6.0/removal-of-types.html](https://www.elastic.co/guide/en/elasticsearch/reference/6.0/removal-of-types.html)這里可以看到 If you are using the default mapping templates in Logstash, you will need to upgrade your mapping templates. To do this, after migrating Elasticsearch to 6.0, you must override the existing template with the 6.x template. This can be done by ensuring that all configured Elasticsearch outputs have the following setting specified: `template_overwrite => true`. ### When to Upgrade 全新安裝的Elastic Stack應該保持相同的版本. Elasticsearch 6.0 不依賴Logstash 6.0 .一個Elasticsearch 6.0集群可以通過HTTP通信層接收來自Logstash 5.x 實例的數據.這給何時升級Logstash提供了靈活性.你可能方便或者不方便同時升級他們,如果你先升級Elasticsearch的話,也可以不用同時升級其他組件. 你應該及時升級以獲得更好的性能提升,但是,使用上面的方法對你的環境來說更有意義.(就是不同時升級的方式) ### When Not to Upgrade 如果你使用的任何Logstash插件和Logstash 6.0不兼容,你都應該等待其準備好. 盡管我們做了巨大的努力來確保Logstash的兼容性.Logstash 6.0 并不能完全向后兼容.正如Elastic Stack 升級指南中指出的,Logstash 6.0的升級應該在Elasticsearch之后.不僅實用,而且因為Logstash 6.0 的插件會嘗試訪問Elasticsearch 6.0在早期版本并不存在的特性.