This is the process for in-place upgrades of Elasticsearch (ES), using an existing Search feed and index data.

Required

This upgrade is for Elasticsearch 6.8.6 and 7.5.2 or higher with a Search feed created on Swarm 11 or higher.
If you are using elasticsearch 6.8.6 see How to Upgrade Swarm | Upgrading from Unsupported Elasticsearch for a specific version and live-upgrade ordering requirements.
For users running Elasticsearch 7.5.2, use the latest configure_elasticsearch_with_swarm_search.py script on each node instead of directly installing the 7.17.9 RPM. This script updates /etc/sysconfig/elasticsearch to use the default bundled JDK from Elasticsearch.
See Migrating from Older Elasticsearch for migrating from Elasticsearch 2.3.3 or 5.6.12.

Upgrading Elasticsearch by Script

On each node in an Elasticsearch cluster, follow this process and run the files from the Swarm download bundle:

Before upgrading, query the Elasticsearch cluster for the list of nodes.
curl -i http://ELASTICSEARCH:9200/_cat/nodes
Example output:
[root@elasticsearch Elasticsearch]# curl -i http://<ip-address>:9200/_cat/nodes
HTTP/1.1 200 OK
content-type: text/plain; charset=UTF-8
content-length: 300
<ip-node1> 14 99 1 0.02 0.14 0.15 dilm - <hostname-node1>
<ip-node2> 1 71 1 0.01 0.09 0.08 dilm - <hostname-node2>
<ip-node3> 72 99 0 0.08 0.06 0.08 dilm - <hostname-node3>
<ip-node4> 50 99 0 0.03 0.04 0.05 dilm * <hostname-node4>
<ip-node5> 47 99 1 0.08 0.14 0.22 dilm - <hostname-node5>

The node with the * is the Elasticsearch master node. It is recommended to upgrade the node last to avoid problems electing a new master node.
Backup the existing configurations so a record exists of any customizations. Run ./techsupport-bundle-grab.sh from your Support tools directory to do this, making sure to upgrade your support tools prior to running the script. Instructions are here.
Start by installing the latest Swarm Search, which is the caringo-elasticsearch-search RPM.
yum install caringo-elasticsearch-search-VERSION.noarch.rpm

Tip

The error: "ES_PATH_CONF must be set to the configuration path chown: cannot access '/etc/elasticsearch/elasticsearch.keystore': No such file or directory" displays if Elasticsearch 7 RPM was inadvertently installed. Install the caringo-elasticsearch-search RPM to proceed.

Run the script that installs and configures the upgrade.
If the script detects that Elasticsearch is installed and configured, it runs with --upgrade instead of configuring a new cluster, automating the Elasticsearch rolling upgrade steps (https://www.elastic.co/guide/en/elasticsearch/reference/7.17/rolling-upgrades.html).

/usr/share/caringo-elasticsearch-search/bin/configure_elasticsearch_with_swarm_search.py

Important

The upgrade requires Internet access to download the Elasticsearch rpm. Place elasticsearch-7.17.*.rpm in the current directory if Internet access is unavailable.

Compare the backup file to the newly created elasticsearch.yml and add back any customizations needed and systemctl restart elasticsearch if the configuration was modified.

Verify that all nodes are accounted for, all shards are assigned, and the status is green.

The script updates the configuration files and restarts the service if Elasticsearch 7 is already installed.

Upgrading Elasticsearch Manually

These are the steps the script automates if you need to upgrade manually:

It fixes /etc/sysconfig/elasticsearch to the correct ES6 version (the same as ES7).
It increases the systemd timeout in /etc/systemd/system/elasticsearch.service.d/override.conf (see github.com/elastic/elasticsearch/issues/60140)
A prompt to continue with the yum upgrade to 7.5.2 appears after refreshing the config files for Elasticsearch 6.
It disables shard allocation and does a POST synced-flush for safer rolling upgrades.

It uninstalls the Prometheus Exporter plugin if it exists.
It shells out to yum to install the Elasticsearch 7 RPM in the current directory or from artifacts.elastic.co, if unavailable.
It updates elasticsearch.yml for version 7 compatibility, including discovery.initial_master_nodes instead of discovery.zen.unicast.hosts, and jvm.options.
It starts the upgraded Elasticsearch 7 and waits for it to be ready.
The cluster re-enables shard allocation and prompts to repeat these two steps on the next node if the cluster health is green or yellow.