fix issue #388 filebeat migrate from log to filestream

[cbeaujoin-stellar]

Filebeat log input is deprecated, migrate filebeat template from log to filestream.

[cbeaujoin-stellar]

Can you relaunch the pipeline?
It seams to be an unrelated issue with [Install packages for RHEL]

[widhalmt]

Just did. Fingers crossed!

[cbeaujoin-stellar]

Just thinking that I didn't managed retro compatibility in my PR.

Maybe I should introduce some conditional template based on ELK version ?

[widhalmt]

We're planning on removing ES 7 in the near future. So maybe it's easier, if we keep this PR open until then and merge it. How about that?

[cbeaujoin-stellar]

According to the documentation:
The filestream input has been generally available since version 7.14

Latest 7.x version is 7.17 and End of Support Term is 15-Jan-2026.

I let you trade off but I think it could be merged right now without big impact.

[cbeaujoin-stellar]

Hello @widhalmt ,

It's becoming a real problem with 9.2.0:

{"log.level":"error","@timestamp":"2025-10-31T17:17:26.886+0100","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.handleError","file.name":"instance/beat.go","file.line":1363},"message":"Exiting: Failed to start crawler: starting input failed: error while initializing input: Found log input configuration: Log input is deprecated. Use Filestream input instead. Follow our migration guide https://www.elastic.co/guide/en/beats/filebeat/current/migrate-to-filestream.html\n{\n \"enabled\": true,\n \"paths\": [\n \"/mnt/steer/log/myloh.log\"\n ],\n \"type\": \"log\"\n}","service.name":"filebeat","ecs.version":"1.6.0"}

[cbeaujoin-stellar]

@widhalmt Hello, can you merge as 7.0 is now deprecated ?