Comment 7 for bug 1553256

Before anyone goes off the rails with logstash, and writing a new charm - a quick note here about that:

http://github.com/juju-solutions/layer-logstash

We've been cycling on this charm for a couple days now and the layer is very minimal, but this layer is a great starting point for a few things:

- using a recent logstash
- Clearly defined interface-layers to boot
- You can build off this to make a mega-logstash-grokk-hub if you have crazy requirements for NGROK filters and services

its stand-alone and doesn't use any of the redis queue features the older logstash charm encapsulated. From what I can tell we're missing 2 things from this layer that existed in the prior logstash charm - which is agent support (now filebeat), and nrpe-external-monitor relationship(s)

-- Now with regards to updating the ES cluster

You're right, it does nothing for migrating the data to the 2.x series. The data buckets format has changed, and i'm not sure if its even something that Elastic has said is supported. With it being a major update, i doubt it, unless there were some kind of data-river plugin to migrate it.

With that being the case, we have an impass on what to do here :( As we cant upgrade existing deploys, and the only thing that *really* needed to happen (in terms of delivery) was just a single template file needed network_host: [__site__, __local__] added to it. The rest just worked.