diff --git a/CHANGELOG.md b/CHANGELOG.md
index 955bb52c..9a883ccd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,8 @@ The **patch** part changes incrementally at each release.
 ### Added
 
 * apache: new variables for logrotate + server-status
+* filebeat: package can be upgraded to latest (default: False)
+* metricbeat: package can be upgraded to latest (default: False)
 * nginx: add access to server status on default VHost
 * postfix: add smtpd_relay_restrictions in configuration
 
diff --git a/filebeat/defaults/main.yml b/filebeat/defaults/main.yml
index 322aba46..598a08ed 100644
--- a/filebeat/defaults/main.yml
+++ b/filebeat/defaults/main.yml
@@ -21,3 +21,4 @@ filebeat_logstash_auth_password: ""
 filebeat_use_config_template: False
 filebeat_update_config: True
 filebeat_force_config: True
+filebeat_upgrade_package: False
diff --git a/filebeat/tasks/main.yml b/filebeat/tasks/main.yml
index 34feb5c7..a8941f86 100644
--- a/filebeat/tasks/main.yml
+++ b/filebeat/tasks/main.yml
@@ -30,15 +30,17 @@
 - name: Filebeat is installed
   apt:
     name: filebeat
-    state: present
+    state: "{% if filebeat_upgrade_package %}latest{% else %}present{% endif %}"
+  notify: restart filebeat
   tags:
-  - filebeat
-  - packages
+    - filebeat
+    - packages
 
 - name: Filebeat service is enabled
   systemd:
     name: filebeat
     enabled: yes
+    notify: restart filebeat
 
 - name: is logstash-plugin available?
   stat:
diff --git a/metricbeat/defaults/main.yml b/metricbeat/defaults/main.yml
index 51113271..3e74556f 100644
--- a/metricbeat/defaults/main.yml
+++ b/metricbeat/defaults/main.yml
@@ -13,6 +13,7 @@ metricbeat_processors_cloud_metadata: False
 metricbeat_use_config_template: False
 metricbeat_update_config: True
 metricbeat_force_config: True
+metribeat_upgrade_package: False
 
 # Example :
 # metricbeat_tags:
diff --git a/metricbeat/tasks/main.yml b/metricbeat/tasks/main.yml
index 1ae3a2cd..d148f1cd 100644
--- a/metricbeat/tasks/main.yml
+++ b/metricbeat/tasks/main.yml
@@ -30,15 +30,17 @@
 - name: Metricbeat is installed
   apt:
     name: metricbeat
-    state: present
+    state: "{% if metribeat_upgrade_package %}latest{% else %}present{% endif %}"
+  notify: restart metricbeat
   tags:
-  - metricbeat
-  - packages
+    - metricbeat
+    - packages
 
 - name: Metricbeat service is enabled
   systemd:
     name: metricbeat
     enabled: yes
+  notify: restart metricbeat
 
 # When we don't use a config template (default)
 - block: