{"id":21037,"date":"2016-10-10T14:14:08","date_gmt":"2016-10-10T13:14:08","guid":{"rendered":"https:\/\/www.inovex.de\/?p=2341"},"modified":"2026-03-17T08:57:53","modified_gmt":"2026-03-17T07:57:53","slug":"death-of-an-elk","status":"publish","type":"post","link":"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/","title":{"rendered":"Death of an ELK?"},"content":{"rendered":"<p>This article will guide you through updating the ELK stack from version 1.x to 2.x, taking into account the correct order of its components Elasticsearch, Logstash and Kibana.<!--more--><\/p>\n<p>The ELK stack became popular in recent years as a centralized log solution. Based on open source tools ELK enables the collection, the storage and the analysis of log files <em>big data style<\/em>.<\/p>\n<p>As part of our inovex operations team we run ELK at a customer&#8217;s site. It stores about 11\u00a0terabytes of log data from the last 30\u00a0days. The Elasticsearch cluster consists of four data nodes and one master node. <a href=\"https:\/\/www.inovex.de\/getting-started-with-kibana-links\/\" target=\"_blank\" rel=\"noopener\">Kibana<\/a> is distributed to\u00a0two systems behind a load balancer and using nginx to <em>proxy_pass<\/em> requests. Logstash is distributed to\u00a0ten systems using <a href=\"https:\/\/www.inovex.de\/redis-more-than-caching\/\" target=\"_blank\" rel=\"noopener\">redis<\/a> as cache for incoming log events.<\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_82_2 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\"><p class=\"ez-toc-title\" style=\"cursor:inherit\"><\/p>\n<\/div><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/#End-of-Life\" >End of Life?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/#Kibana\" >Kibana<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/#Logstash\" >Logstash<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/#Elasticsearch\" >Elasticsearch<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/#Full-cluster-restart\" >Full cluster restart<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/#What-we-learned-the-hard-way\" >What we learned the hard way<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/#Summary\" >Summary<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/#Get-in-touch\" >Get in touch<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/#Were-hiring\" >We&#8217;re hiring!<\/a><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"End-of-Life\"><\/span>End of Life?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>As this infrastructure was built last year it is now past its prime. We see the following versions deployed in production:<\/p>\n<ul>\n<li>Elasticsearch 1.7.2<\/li>\n<li>Logstash 1.5.3<\/li>\n<li>Kibana 4.1.13<\/li>\n<\/ul>\n<p>These versions are\u00a0pretty common now as they were cutting edge\u00a0when people started to employ the\u00a0ELK stack back in 2015. Yet there is a problem: Both\u00a0the installed versions of Logstash and Kibana are already close to <a href=\"https:\/\/www.elastic.co\/support\/eol\" target=\"_blank\" rel=\"noopener\">their end of life date<\/a>,\u00a0meaning no one will provide any updates after this point. Elasticsearch 1.7 will be maintained until January 2017.<\/p>\n<p>In this article we will demonstrate how to upgrade the single software components of an ELK stack to their latest released versions\u00a0and provide you with all\u00a0links necessary. Our target\u00a0versions are:<\/p>\n<ul>\n<li>Elasticsearch 2.4.1<\/li>\n<li>Logstash 2.4.0<\/li>\n<li>Kibana 4.6.1<\/li>\n<\/ul>\n<p>While\u00a0it&#8217;s not difficult to upgrade\u00a0the software itself (e.g. <span class=\"lang:sh decode:true crayon-inline \">yum update Logstash<\/span>\u00a0on a Centos\/Red Hat system) there are some prerequisites to meet.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Kibana\"><\/span><a href=\"https:\/\/www.inovex.de\/blog\/getting-started-with-kibana-links\/\">Kibana<\/a><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Let&#8217;s start at the top of the stack \u2013\u00a0the front-end. As mentioned, we aim for the latest version 4.6.1.\u00a0So checking the <a href=\"https:\/\/www.elastic.co\/de\/support\/matrix#show_compatibility\" target=\"_blank\" rel=\"noopener\">support matrix page<\/a> we see this version only works with Elasticsearch 2.4. As there are no further requirements an upgrade is easy. It just has to be scheduled after the Elasticsearch update.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Logstash\"><\/span>Logstash<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>We want to update Logstash from 1.5.3 to 2.4.0 \u2013 the breaking changes are documented on the <a href=\"https:\/\/www.elastic.co\/guide\/en\/logstash\/2.4\/breaking-changes.html\" target=\"_blank\" rel=\"noopener\">Elastic website<\/a>. One\u00a0major change was affecting the Elasticsearch output plugin. So before you work\u00a0your update magic, change the Logstash config to something\u00a0like this:<\/p>\n<pre class=\"lang:default decode:true\" title=\"Logstash Output Plugin (Git diff)\">Elasticsearch {\r\n\r\n  workers =&gt; 4\r\n\r\n  index =&gt; \"some-index%{+YYYY.MM.dd}-new\"\r\n\r\n  - host =&gt; [\"Elasticsearch-host.fancy.domain\"]\r\n\r\n  - port =&gt; \"9200\"\r\n\r\n  - protocol =&gt; \"http\"\r\n\r\n  + hosts =&gt; [\"http:\/\/Elasticsearch-host.fancy.domain:9200\"]\r\n\r\n  manage_template =&gt; \"true\"\r\n\r\n  template_name =&gt; \"template\"\r\n\r\n  template_overwrite =&gt; \"true\"\r\n\r\n}<\/pre>\n<p>After this it&#8217;s just a matter of your package manager upgrading\u00a0to the new Logstash version. Keep in mind that Logstash is capable to work with any released Elasticsearch version. So it&#8217;s possible to upgrade without any dependency to the Elasticsearch upgrade.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Elasticsearch\"><\/span>Elasticsearch<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>First of all check the <a href=\"https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/2.0\/breaking-changes-2.0.html\" target=\"_blank\" rel=\"noopener\">breaking changes doc<\/a>. At this point it get&#8217;s tricky as we go\u00a0from Elasticsearch 1.7 to 2.4, which means a lot of breaking changes.<\/p>\n<p>There is a <a href=\"https:\/\/github.com\/elastic\/Elasticsearch-migration\/tree\/1.x\" target=\"_blank\" rel=\"noopener\">migration plugin<\/a> to guide\u00a0you through\u00a0the migration from Elasticsearch 1.x to 2.x. This plugin, current version 1.18, checks the Elasticsearch configuration and the stored data. It can be installed via:<\/p>\n<pre class=\"lang:sh decode:true \" title=\"Install Elasticsearch migration plugin\">\/usr\/share\/Elasticsearch\/bin\/plugin -i migration -u https:\/\/github.com\/elastic\/Elasticsearch-migration\/releases\/download\/v1.18\/Elasticsearch-migration-1.18.zip<\/pre>\n<p>It will look similar to this.<\/p>\n<figure id=\"attachment_2346\" aria-describedby=\"caption-attachment-2346\" style=\"width: 300px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-2346 size-medium\" src=\"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/10\/elk_upgrade_migration_plugin_nok-300x115.png\" alt=\"Elasticsearch Migration Plugin shows that an upgrade isn't possible yet.\" width=\"300\" height=\"115\" \/><figcaption id=\"caption-attachment-2346\" class=\"wp-caption-text\">Elasticsearch Migration Plugin shows that an upgrade isn&#8217;t possible yet.<\/figcaption><\/figure>\n<p>Here are the main\u00a0changes:<\/p>\n<ul>\n<li>The Elasticsearch option <span class=\"lang:sh decode:true crayon-inline\">network.publish_host<\/span>\u00a0config is renamed to <span class=\"lang:default decode:true crayon-inline\">network.host<\/span>.<\/li>\n<li>In case you need the Elasticsearch API\u00a0for local API\u00a0calls, e.g. for monitoring purposes, it is necessary to bind explicitly to 127.0.0.1:<\/li>\n<\/ul>\n<pre class=\"lang:yaml decode:true\" title=\"Elasticsearch Config\">network:\r\n\r\n  host: ['PublicIp', '127.0.0.1']<\/pre>\n<ul>\n<li>Starting with Elasticsearch 2.0 it is not allowed to have dots in field names. In case you need dots in field names there is a specific start option that allows this: just start the Elasticsearch process with the start option <span class=\"lang:default decode:true crayon-inline\">-Dmapper.allow_dots_in_name=true<\/span>. There might be the need for dots in field names if you are processing log events without content filtering from some application logs into an Elasticsearch index. But keep in mind: if there are any dots in field names Elasticsearch 2.x won&#8217;t start at all.<\/li>\n<\/ul>\n<p>After applying the changes the migration plugin will go from red to green:<\/p>\n<figure id=\"attachment_2347\" aria-describedby=\"caption-attachment-2347\" style=\"width: 263px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-2347 size-medium\" src=\"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/10\/elk_upgrade_migration_plugin-263x300.png\" alt=\"Elasticsearch Migration Plugin shows that an upgrade is possible. \" width=\"263\" height=\"300\" \/><figcaption id=\"caption-attachment-2347\" class=\"wp-caption-text\">Elasticsearch Migration Plugin shows that an upgrade is possible.<\/figcaption><\/figure>\n<p>Keep in mind: This migration plugin just checks the Elasticsearch config and data stored. If you use other apps connecting to your Elasticsearch cluster you have to check them separately.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Full-cluster-restart\"><\/span>Full cluster restart<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>For the sake of this example let&#8217;s assume we run on more than one Elasticsearch host. Say we have an Elasticsearch cluster with 3 nodes that share all shards and each shard has one replica. In this case it&#8217;s necessary to do a full cluster restart in order to upgrade all nodes. Otherwise just stop Elasticsearch, do an upgrade (e.g. <span class=\"lang:default decode:true crayon-inline\">yum upgrade Elasticsearch<\/span>) and restart.<\/p>\n<p>As we&#8217;ve got a cluster that will go from Elasticsearch 1.7.2 to 2.4.0 we must consider one constraint: there is no interoperability between these versions. There is a thorough\u00a0<a href=\"https:\/\/www.elastic.co\/guide\/en\/elasticsearch\/reference\/2.4\/restart-upgrade.html\" target=\"_blank\" rel=\"noopener\">guide<\/a> that will show and explain the necessary steps, here&#8217;s the gist of it:<\/p>\n<ol>\n<li>Disable shard allocation within your cluster. This reduces the time until the cluster is fully recovered afterwards.<\/li>\n<li>Perform a synced flush to stop optimization on shards.<\/li>\n<li>Remove the migration plugin. Elasticsearch won&#8217;t start if its still installed:\u00a0<span class=\"lang:sh decode:true crayon-inline\">\/usr\/share\/Elasticsearch\/bin\/plugin -r migration<\/span><\/li>\n<li>Stop all the nodes.<\/li>\n<li>Upgrade and start the nodes. Starting dedicated master nodes first will speed up the cluster start.<\/li>\n<li>Reactivate shard allocation.<\/li>\n<li>Wait until your cluster becomes\u00a0green again.\n<pre class=\"lang:default decode:true\">sh-4.1$ curl -XGET http:\/\/localhost:9200\/_cluster\/health?pretty=true\r\n\r\n{\r\n\r\n  \"cluster_name\" : \"elasticsearch\",\r\n\r\n  \"status\" : \"yellow\",\r\n\r\n  \"timed_out\" : false,\r\n\r\n  \"number_of_nodes\" : 2,\r\n\r\n  \"number_of_data_nodes\" : 2,\r\n\r\n  \"active_primary_shards\" : 6,\r\n\r\n  \"active_shards\" : 12,\r\n\r\n  \"relocating_shards\" : 0,\r\n\r\n  \"initializing_shards\" : 0,\r\n\r\n  \"unassigned_shards\" : 6,\r\n\r\n  \"delayed_unassigned_shards\" : 0,\r\n\r\n  \"number_of_pending_tasks\" : 0,\r\n\r\n  \"number_of_in_flight_fetch\" : 0\r\n\r\n}<\/pre>\n<\/li>\n<li>Don&#8217;t forget to update Kibana so that your ELK is\u00a0usable again.<\/li>\n<\/ol>\n<h2><span class=\"ez-toc-section\" id=\"What-we-learned-the-hard-way\"><\/span>What we learned the hard way<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Despite all the reading and preparations there were some pitfalls we stepped right\u00a0in. These were:<\/p>\n<ul>\n<li>After the update our Elasticsearch snapshot repository wasn&#8217;t accessible to all cluster nodes, so we weren&#8217;t able to generate backups. To solve this we had to recreate the repository.<\/li>\n<li>We use the Kopf-Plugin to manage our Elasticsearch cluster. Oddly enough nobody provided the config of this plugin with the cluster name. This causes Elasticsearch to refuse to start at the new version.\n<pre class=\"lang:sh decode:true\" title=\"Kopf Plugin Config\">sh-4.1$ cat \/usr\/share\/elasticsearch\/plugins\/kopf\/plugin-descriptor.properties\r\n\r\ndescription=kopf - simple web administration tool for Elasticsearch\r\n\r\nversion=2.0.1\r\n\r\nsite=true\r\n\r\nname=kopf<\/pre>\n<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"Summary\"><\/span>Summary<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>To wrap it up:<\/p>\n<ul>\n<li>Start updating Logstash as it&#8217;s compatible with newer Elasticsearch versions.<\/li>\n<li>Check breaking changes at your Elasticsearch (cluster) with the migration tool.<\/li>\n<li>Upgrade the Elasticsearch cluster.<\/li>\n<li>Upgrade Kibana.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"Get-in-touch\"><\/span>Get in touch<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>For all your Big Data needs visit our <a href=\"https:\/\/www.inovex.de\/en\/our-services\/big-data\/\" target=\"_blank\" rel=\"noopener\">website<\/a>, drop us an Email at <a href=\"mailto:list-blog@inovex.de\" target=\"_blank\" rel=\"noopener\">list-blog@inovex.de<\/a>\u00a0or call\u00a0<a href=\"tel:+497216190210\" target=\"_blank\" rel=\"noopener\">+49 721 619 021-0<\/a>.<\/p>\n<div style=\"margin: 7px; padding: 7px; border-left: 6px solid #9CCD00;\">\n<h2><span class=\"ez-toc-section\" id=\"Were-hiring\"><\/span>We&#8217;re hiring!<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Looking for a change? We&#8217;re hiring Big Data Systems Engineers who have mastered the ELK stack. <strong>Apply now!<\/strong><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>This article will guide you through updating the ELK stack from version 1.x to 2.x, taking into account the correct order of its components Elasticsearch, Logstash and Kibana.<\/p>\n","protected":false},"author":51,"featured_media":13112,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"ep_exclude_from_search":false,"footnotes":""},"tags":[82],"service":[504],"coauthors":[{"id":51,"display_name":"Alexander Koehler","user_nicename":"akoehler"}],"class_list":["post-21037","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","tag-search","service-search"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Death of an ELK<\/title>\n<meta name=\"description\" content=\"This article will guide you through updating the ELK stack (Elastic Search, Logstash Kibiana) from version 1.x to 2.x.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/\" \/>\n<meta property=\"og:locale\" content=\"de_DE\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Death of an ELK\" \/>\n<meta property=\"og:description\" content=\"This article will guide you through updating the ELK stack (Elastic Search, Logstash Kibiana) from version 1.x to 2.x.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/\" \/>\n<meta property=\"og:site_name\" content=\"inovex GmbH\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/inovexde\" \/>\n<meta property=\"article:published_time\" content=\"2016-10-10T13:14:08+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-03-17T07:57:53+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/10\/dead-elk.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"1080\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Alexander Koehler\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/10\/dead-elk-1024x576.png\" \/>\n<meta name=\"twitter:creator\" content=\"@inovexgmbh\" \/>\n<meta name=\"twitter:site\" content=\"@inovexgmbh\" \/>\n<meta name=\"twitter:label1\" content=\"Verfasst von\" \/>\n\t<meta name=\"twitter:data1\" content=\"Alexander Koehler\" \/>\n\t<meta name=\"twitter:label2\" content=\"Gesch\u00e4tzte Lesezeit\" \/>\n\t<meta name=\"twitter:data2\" content=\"6\u00a0Minuten\" \/>\n\t<meta name=\"twitter:label3\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data3\" content=\"Alexander Koehler\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/blog\\\/death-of-an-elk\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/blog\\\/death-of-an-elk\\\/\"},\"author\":{\"name\":\"Alexander Koehler\",\"@id\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/#\\\/schema\\\/person\\\/c8b69d79f24d10ba023c773e6f730e88\"},\"headline\":\"Death of an ELK?\",\"datePublished\":\"2016-10-10T13:14:08+00:00\",\"dateModified\":\"2026-03-17T07:57:53+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/blog\\\/death-of-an-elk\\\/\"},\"wordCount\":1063,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/blog\\\/death-of-an-elk\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.inovex.de\\\/wp-content\\\/uploads\\\/2016\\\/10\\\/dead-elk.png\",\"keywords\":[\"Search\"],\"articleSection\":[\"Analytics\",\"English Content\",\"General\"],\"inLanguage\":\"de\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.inovex.de\\\/de\\\/blog\\\/death-of-an-elk\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/blog\\\/death-of-an-elk\\\/\",\"url\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/blog\\\/death-of-an-elk\\\/\",\"name\":\"Death of an ELK\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/blog\\\/death-of-an-elk\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/blog\\\/death-of-an-elk\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.inovex.de\\\/wp-content\\\/uploads\\\/2016\\\/10\\\/dead-elk.png\",\"datePublished\":\"2016-10-10T13:14:08+00:00\",\"dateModified\":\"2026-03-17T07:57:53+00:00\",\"description\":\"This article will guide you through updating the ELK stack (Elastic Search, Logstash Kibiana) from version 1.x to 2.x.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/blog\\\/death-of-an-elk\\\/#breadcrumb\"},\"inLanguage\":\"de\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.inovex.de\\\/de\\\/blog\\\/death-of-an-elk\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/blog\\\/death-of-an-elk\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.inovex.de\\\/wp-content\\\/uploads\\\/2016\\\/10\\\/dead-elk.png\",\"contentUrl\":\"https:\\\/\\\/www.inovex.de\\\/wp-content\\\/uploads\\\/2016\\\/10\\\/dead-elk.png\",\"width\":1920,\"height\":1080,\"caption\":\"Death of an ELK title\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/blog\\\/death-of-an-elk\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Death of an ELK?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/#website\",\"url\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/\",\"name\":\"inovex GmbH\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"de\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/#organization\",\"name\":\"inovex GmbH\",\"url\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.inovex.de\\\/wp-content\\\/uploads\\\/2021\\\/03\\\/inovex-logo-16-9-1.png\",\"contentUrl\":\"https:\\\/\\\/www.inovex.de\\\/wp-content\\\/uploads\\\/2021\\\/03\\\/inovex-logo-16-9-1.png\",\"width\":1921,\"height\":1081,\"caption\":\"inovex GmbH\"},\"image\":{\"@id\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/inovexde\",\"https:\\\/\\\/x.com\\\/inovexgmbh\",\"https:\\\/\\\/www.instagram.com\\\/inovexlife\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/inovex\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UC7r66GT14hROB_RQsQBAQUQ\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/#\\\/schema\\\/person\\\/c8b69d79f24d10ba023c773e6f730e88\",\"name\":\"Alexander Koehler\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"de\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1daa2890ce81430d74625468a1646a89dfabd4398a920224e9790f71b20fee74?s=96&d=retro&r=g340076fe0f986a5b6ea4f2d21b5542ca\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1daa2890ce81430d74625468a1646a89dfabd4398a920224e9790f71b20fee74?s=96&d=retro&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1daa2890ce81430d74625468a1646a89dfabd4398a920224e9790f71b20fee74?s=96&d=retro&r=g\",\"caption\":\"Alexander Koehler\"},\"url\":\"https:\\\/\\\/www.inovex.de\\\/de\\\/blog\\\/author\\\/akoehler\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Death of an ELK","description":"This article will guide you through updating the ELK stack (Elastic Search, Logstash Kibiana) from version 1.x to 2.x.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/","og_locale":"de_DE","og_type":"article","og_title":"Death of an ELK","og_description":"This article will guide you through updating the ELK stack (Elastic Search, Logstash Kibiana) from version 1.x to 2.x.","og_url":"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/","og_site_name":"inovex GmbH","article_publisher":"https:\/\/www.facebook.com\/inovexde","article_published_time":"2016-10-10T13:14:08+00:00","article_modified_time":"2026-03-17T07:57:53+00:00","og_image":[{"width":1920,"height":1080,"url":"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/10\/dead-elk.png","type":"image\/png"}],"author":"Alexander Koehler","twitter_card":"summary_large_image","twitter_image":"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/10\/dead-elk-1024x576.png","twitter_creator":"@inovexgmbh","twitter_site":"@inovexgmbh","twitter_misc":{"Verfasst von":"Alexander Koehler","Gesch\u00e4tzte Lesezeit":"6\u00a0Minuten","Written by":"Alexander Koehler"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/#article","isPartOf":{"@id":"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/"},"author":{"name":"Alexander Koehler","@id":"https:\/\/www.inovex.de\/de\/#\/schema\/person\/c8b69d79f24d10ba023c773e6f730e88"},"headline":"Death of an ELK?","datePublished":"2016-10-10T13:14:08+00:00","dateModified":"2026-03-17T07:57:53+00:00","mainEntityOfPage":{"@id":"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/"},"wordCount":1063,"commentCount":0,"publisher":{"@id":"https:\/\/www.inovex.de\/de\/#organization"},"image":{"@id":"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/10\/dead-elk.png","keywords":["Search"],"articleSection":["Analytics","English Content","General"],"inLanguage":"de","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/","url":"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/","name":"Death of an ELK","isPartOf":{"@id":"https:\/\/www.inovex.de\/de\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/#primaryimage"},"image":{"@id":"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/#primaryimage"},"thumbnailUrl":"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/10\/dead-elk.png","datePublished":"2016-10-10T13:14:08+00:00","dateModified":"2026-03-17T07:57:53+00:00","description":"This article will guide you through updating the ELK stack (Elastic Search, Logstash Kibiana) from version 1.x to 2.x.","breadcrumb":{"@id":"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/#breadcrumb"},"inLanguage":"de","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/"]}]},{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/#primaryimage","url":"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/10\/dead-elk.png","contentUrl":"https:\/\/www.inovex.de\/wp-content\/uploads\/2016\/10\/dead-elk.png","width":1920,"height":1080,"caption":"Death of an ELK title"},{"@type":"BreadcrumbList","@id":"https:\/\/www.inovex.de\/de\/blog\/death-of-an-elk\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.inovex.de\/de\/"},{"@type":"ListItem","position":2,"name":"Death of an ELK?"}]},{"@type":"WebSite","@id":"https:\/\/www.inovex.de\/de\/#website","url":"https:\/\/www.inovex.de\/de\/","name":"inovex GmbH","description":"","publisher":{"@id":"https:\/\/www.inovex.de\/de\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.inovex.de\/de\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"de"},{"@type":"Organization","@id":"https:\/\/www.inovex.de\/de\/#organization","name":"inovex GmbH","url":"https:\/\/www.inovex.de\/de\/","logo":{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/www.inovex.de\/de\/#\/schema\/logo\/image\/","url":"https:\/\/www.inovex.de\/wp-content\/uploads\/2021\/03\/inovex-logo-16-9-1.png","contentUrl":"https:\/\/www.inovex.de\/wp-content\/uploads\/2021\/03\/inovex-logo-16-9-1.png","width":1921,"height":1081,"caption":"inovex GmbH"},"image":{"@id":"https:\/\/www.inovex.de\/de\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/inovexde","https:\/\/x.com\/inovexgmbh","https:\/\/www.instagram.com\/inovexlife\/","https:\/\/www.linkedin.com\/company\/inovex","https:\/\/www.youtube.com\/channel\/UC7r66GT14hROB_RQsQBAQUQ"]},{"@type":"Person","@id":"https:\/\/www.inovex.de\/de\/#\/schema\/person\/c8b69d79f24d10ba023c773e6f730e88","name":"Alexander Koehler","image":{"@type":"ImageObject","inLanguage":"de","@id":"https:\/\/secure.gravatar.com\/avatar\/1daa2890ce81430d74625468a1646a89dfabd4398a920224e9790f71b20fee74?s=96&d=retro&r=g340076fe0f986a5b6ea4f2d21b5542ca","url":"https:\/\/secure.gravatar.com\/avatar\/1daa2890ce81430d74625468a1646a89dfabd4398a920224e9790f71b20fee74?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1daa2890ce81430d74625468a1646a89dfabd4398a920224e9790f71b20fee74?s=96&d=retro&r=g","caption":"Alexander Koehler"},"url":"https:\/\/www.inovex.de\/de\/blog\/author\/akoehler\/"}]}},"_links":{"self":[{"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/posts\/21037","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/users\/51"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/comments?post=21037"}],"version-history":[{"count":2,"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/posts\/21037\/revisions"}],"predecessor-version":[{"id":66586,"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/posts\/21037\/revisions\/66586"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/media\/13112"}],"wp:attachment":[{"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/media?parent=21037"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/tags?post=21037"},{"taxonomy":"service","embeddable":true,"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/service?post=21037"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.inovex.de\/de\/wp-json\/wp\/v2\/coauthors?post=21037"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}