Graylog2
Sidecars: Filebeat default config not using built-in executable in upgraded clusters
Expected Behavior
After upgrading a Graylog cluster to the latest version and installing Sidecars in version 5.1 I expect the Sidecars to be ready to use, as stated in the documentation.
Current Behavior
Sidecars will start and get assigned the default configuration, but Filebeat cannot successfully be started because the Sidecar is not using the correct path to the packaged executable.
The ready-to-use sidecar configuration was designed to work for completely new Graylog clusters. For new clusters, a collector config for Filebeat is provided, which points to the executable shipped together with Sidecar in the most recent version. Additionally, a default config is provided, which uses the collector.
However, for existing clusters, during an upgrade, a default config is provided, which points to an existing collector. This collector will not use the built-in executable, because previously, no Filebeat executable was packaged together with the Sidecar. The executable path of the existing collector was correctly not modified, because that would have stopped existing Sidecars using this collector from working properly.
Possible Solution
After upgrading their Graylog cluster, if users want to use the new built-in Filebeat with their Sidecars, they need to create a new Filebeat Collector using the built-in path and use that collector in the default configuration, or edit the existing Filebeat collector to use the new path, if all their Sidecars are at the latest version.
The necessary steps should at least be documented properly.
Context
[HS-2105922109]
#15570
Your Environment
- Graylog Version: 5.2.1
- Sidecar Version: 5.1
A couple of thoughts of something that may help.
- definitely in product documentation, laying out clearly what they will and won't work for.
- theoretically it should be a problem between different versions of sidecar, so maybe the different sidecars could have their own default tag (default1-5), there could also be some kind of warning if you try and assign the external path config to a sidecar 1.5 as Graylog knows what sidecar version is running.
~@thll is this the same as https://github.com/Graylog2/graylog2-server/issues/17040 ?~
I guess not. the other fix only changed the templates, not the executable path. sorry for the noise
