Graylog2 / Graylog2/graylog2-server
Sidecars: Filebeat default config not using built-in executable in upgraded clusters
- Dominant language
- Java
- Stars
- 8.1k
- Forks
- 1.1k
- Avg merge
- 1d 20h
- Merged PRs (30d)
- 217
Description
## Expected Behavior
After upgrading a Graylog cluster to the latest version and installing Sidecars in version 5.1 I expect the Sidecars to be ready to use, as stated [in the documentation](https://go2docs.graylog.org/5-2/getting_in_log_data/graylog_sidecar.html#ReadytoUseSidecarConfigurations).
## Current Behavior
Sidecars will start and get assigned the default configuration, but Filebeat cannot successfully be started because the Sidecar is not using the correct path to the packaged executable.
The ready-to-use sidecar configuration was designed to work for completely new Graylog clusters. For new clusters, a collector config for Filebeat is provided, which points to the executable shipped together with Sidecar in the most recent version. Additionally, a default config is provided, which uses the collector.
However, for existing clusters, during an upgrade, a default config is provided, which points to an existing collector. This collector will not use the built-in executable, because previously, no Filebeat executable was packaged together with the Sidecar. The executable path of the existing collector was correctly not modified, because that would have stopped existing Sidecars using this collector from working properly.
## Possible Solution
After upgrading their Graylog cluster, if users want to use the new built-in Filebeat with their Sidecars, they need to create a new Filebeat Collector using the built-in path and use that collector in the default configuration, or edit the existing Filebeat collector to use the new path, if all their Sidecars are at the latest version.
The necessary steps should at least be documented properly.
## Context
[HS-2105922109]
#15570
## Your Environment
* Graylog Version: 5.2.1
* Sidecar Version: 5.1
Contributor guide
Assessment
This issue has not been assessed yet.