这一篇建议参考原版[https://www.elastic.co/guide/en/logstash/current/upgrading-logstash-6.0.html](https://www.elastic.co/guide/en/logstash/current/upgrading-logstash-6.0.html) 升级之前记得阅读[更新日志](https://www.elastic.co/guide/en/logstash/current/breaking-changes.html)。 如果你安装了Logstash和其他Elastic Stack中的产品，还需要查看[Elastic Stack安装和升级文档](http://www.elastic.co/guide/en/elastic-stack/6.5/index.html)。 ### Issue with Logstash 6.0.0 `document_type` when writing to Elasticsearch 6.x 注:这个标题的意思大致是Logstash6.0.0使用`document_type`向Elasticsearch6.x写入时会产生的问题 . 我们想提醒我们的用户,由于Logstash6.0.0中的一些行为导致Logstash 6.0.0在向Elasticsearch 6.0+集群中写入的时候会引发一些错误.当Logstash尝试将包含多个`type`的单个索引写入Elasticsearch集群的时候,Logstash会遇到一个错误.这个错误看起来类似下面的示例,我们简化了这个信息: ```text [2017-11-21T14:26:01,991][WARN ][logstash.outputs.elasticsearch] Could not index event to Elasticsearch.{:status=>400, :response=>{"error"=>{"reason"=>"Rejecting mapping update to [myindex] as the final mapping would have more than 1 type: [type1, type2]"}}}} ``` 当Logstash从以下位置接收数据时,用户可能会遇到这个错误: + 多种类型的Beats + 追踪不同类型的多个文件的Filebeat实例 + 多个Logstash inputs且定义了不同的`type` 要在Logstash6.0.0中解决这个问题,可以在Elasticsearch output配置中添加`document_type => doc`.我们会在新版Logstash中发布一个针对此问题的补丁. Logstash历史上一直默认以`type`字段的值来设置Elasticsearch的`type`.但是Elasticsearch 6.0中[不再支持单个索引中包含多个类型](https://www.elastic.co/guide/en/elasticsearch/reference/6.0/removal-of-types.html).这也是为什么这个问题仅出现在我们即将发布补丁的Elasticsearch 6.0+ 集群上. 原文:Logstash has historically used the value of the `type` field to set the Elasticsearch `type` by default. Elasticsearch 6.0 [no longer supports more than one type](https://www.elastic.co/guide/en/elasticsearch/reference/6.0/removal-of-types.html) per index. This is why the new behavior will only be applied to Elasticsearch 6.0+ clusters with our upcoming fixes. 请阅读更多关于Logstash和Elasticsearch 6.0 Document types的信息. ### Handling Document Types inElasticsearch 6.0+ 处理Elasticsearch6.0+的文档类型 As of Elasticsearch 6.0, document types are [on the way out](https://www.elastic.co/guide/en/elasticsearch/reference/6.0/removal-of-types.html), and only a single mapping type per index is supported. For Logstash users this means transitioning to using the `type` field inside of the document instead of the document type. The effect is the same, but the usage is slightly different. This may mean reconfiguring existing Kibana dashboards to use the new `type` field instead of the document type. > <font color=#FF0000 size=4>说明</font>:上一段说Logstash使用`type`字段来设置Elasticsearch的`type`.新版Elasticsearch不支持单个索引中多个类型.也就是这两句:Logstash has historically used the value of the `type` field to set the Elasticsearch `type` by default. Elasticsearch 6.0 [no longer supports more than one type](https://www.elastic.co/guide/en/elasticsearch/reference/6.0/removal-of-types.html) per index. 但是这里又说,对于Logstash用户这意味着使用文档内的`type`字段而不是文档类型.即这一句:For Logstash users this means transitioning to using the `type` field inside of the document instead of the document type. 由于这部分涉及到Elasticsearch老版本和新版本在处理文档索引时的原理.本人不是很清楚.这里就没有翻译,而是用原文替代.具体的信息在[https://www.elastic.co/guide/en/elasticsearch/reference/6.0/removal-of-types.html](https://www.elastic.co/guide/en/elasticsearch/reference/6.0/removal-of-types.html)这里可以看到 If you are using the default mapping templates in Logstash, you will need to upgrade your mapping templates. To do this, after migrating Elasticsearch to 6.0, you must override the existing template with the 6.x template. This can be done by ensuring that all configured Elasticsearch outputs have the following setting specified: `template_overwrite => true`. ### When to Upgrade 全新安装的Elastic Stack应该保持相同的版本. Elasticsearch 6.0 不依赖Logstash 6.0 .一个Elasticsearch 6.0集群可以通过HTTP通信层接收来自Logstash 5.x 实例的数据.这给何时升级Logstash提供了灵活性.你可能方便或者不方便同时升级他们,如果你先升级Elasticsearch的话,也可以不用同时升级其他组件. 你应该及时升级以获得更好的性能提升,但是,使用上面的方法对你的环境来说更有意义.(就是不同时升级的方式) ### When Not to Upgrade 如果你使用的任何Logstash插件和Logstash 6.0不兼容,你都应该等待其准备好. 尽管我们做了巨大的努力来确保Logstash的兼容性.Logstash 6.0 并不能完全向后兼容.正如Elastic Stack 升级指南中指出的,Logstash 6.0的升级应该在Elasticsearch之后.不仅实用,而且因为Logstash 6.0 的插件会尝试访问Elasticsearch 6.0在早期版本并不存在的特性.