docs/reference/libbeat/upgrading.md
This section gives general recommendations for upgrading {{beats}} shippers:
As a general rule, you can upgrade between minor versions (for example, 9.x to 9.y, where x < y) by simply installing the new release and restarting the Beat process. {{beats}} typically maintain backwards compatibility for configuration settings and exported fields. Please review the review the release notes for potential exceptions.
Upgrading between non-consecutive major versions (e.g. 7.x to 9.x) is not supported.
Before upgrading your {{beats}}, review the release notes and be aware of any documented breaking changes.
If you’re upgrading other products in the stack, also read the {{stack}} upgrade steps.
We recommend that you fully upgrade {{es}} and {{kib}} to version 9.0 before upgrading {{beats}}. The {{beats}} version must be lower than or equal to the {{es}} version. {{beats}} cannot send data to older versions of {{es}}.
If you use the Uptime app in {{kib}}, make sure you add heartbeat-9* and synthetics-* to Uptime indices on the Settings page. The first index is used by newer versions of a Beat, while the latter is used by {{fleet}}.
::::{important} Please read through all upgrade steps before proceeding. These steps are required before running the software for the first time. ::::
Before upgrading:
Stop the existing {{beats}} process by using the appropriate command for your system.
Back up the data and config directories by copying them to another location.
::::{tip}
The location of these directories depends on the installation method. To see the current paths, start the Beat from a terminal, and the data and config paths are printed at startup.
::::
To upgrade using a Debian or RPM package:
rpm or dpkg to install the new package. All files are installed in the appropriate location for the operating system and {{beats}} config files are not overwritten.To upgrade using a zip or compressed tarball:
Extract the zip or tarball to a new directory. This is critical if you are not using external config and data directories.
Set the following options in the {{beats}} configuration file:
path.config to point to your external config directory. If you are not using an external config directory, copy your old configuration over to the new installation.path.data to point to your external data directory. If you are not using an external data directory, copy your old data directory over to the new installation.path.logs to point to the location where you want to store your logs. If you do not specify this setting, logs are stored in the directory you extracted the archive to.Complete the upgrade tasks described in the following sections before restarting the {{beats}} process.
We recommend that you load the 9.x {{kib}} dashboards after upgrading {{kib}} and {{beats}}. That way, you can take advantage of improvements added in 9.0. To load the dashboards, run:
:::::::{tab-set}
::::::{tab-item} DEB
beatname setup --dashboards
::::::
::::::{tab-item} RPM
beatname setup --dashboards
::::::
::::::{tab-item} MacOS
./beatname setup --dashboards
::::::
::::::{tab-item} Linux
./beatname setup --dashboards
::::::
::::::{tab-item} Docker
docker run --rm --net="host" docker.elastic.co/beats/beatname:9.0.0 setup --dashboards
::::::
::::::{tab-item} Windows Open a PowerShell prompt as an Administrator (right-click the PowerShell icon and select Run As Administrator).
From the PowerShell prompt, change to the directory where you installed a Beat, and run:
PS > .\beatname.exe setup --dashboards
::::::
:::::::
All Elastic {{beats}} send events with ECS-compliant field names. If you have any custom {{kib}} dashboards or visualizations that use old fields, adjust them now to use ECS field names.
To learn more about ECS, refer to the ECS overview.
After you’ve completed the migration, start the upgraded Beat. Use the command that works with your system.
Check the console and logs for errors.
In {{kib}}, go to Discover and verify that events are streaming into {{es}}.
This section describes common problems you might encounter when upgrading to {{beats}} 9.x.
Data streams are designed for use cases where existing data is rarely, if ever, updated. You cannot send update or deletion requests for existing documents directly to a data stream.
If needed, you can update or delete documents by submitting requests directly to the document’s backing index. To learn how, refer to the docs about using a data stream.
{{beats}} requires a timestamp field to send data to data streams. If the timestamp field added by {{beats}} is inadvertently removed by a processor, {{beats}} will be unable to index the event. To fix the problem, modify your processor configuration to avoid removing the timestamp field.