Upgrading Elasticsearch

This is the process for in-place upgrades of Elasticsearch (ES), using an existing Search feed and index data.

Required

This upgrade is for Elasticsearch 6.8.6 and 7.5.2 or higher with a Search feed created on Swarm 11 or higher.
See Migrating from Older Elasticsearch for migrating from Elasticsearch 2.3.3 or 5.6.12.

Upgrading Elasticsearch by script

On each node in an Elasticsearch cluster, follow this process and run the files from the Swarm download bundle:

Before upgrading, query the Elasticsearch cluster for the list of nodes.
```
curl -i http://ELASTICSEARCH:9200/_cat/nodes
```
Example output:
[root@elasticsearch Elasticsearch]# curl -i http://<ip-address>:9200/_cat/nodes
HTTP/1.1 200 OK
content-type: text/plain; charset=UTF-8
content-length: 300
<ip-node1> 14 99 1 0.02 0.14 0.15 dilm - <hostname-node1>
<ip-node2> 1 71 1 0.01 0.09 0.08 dilm - <hostname-node2>
<ip-node3> 72 99 0 0.08 0.06 0.08 dilm - <hostname-node3>
<ip-node4> 50 99 0 0.03 0.04 0.05 dilm * <hostname-node4>
<ip-node5> 47 99 1 0.08 0.14 0.22 dilm - <hostname-node5>
The node with the * is the Elasticsearch master node. It is recommended to upgrade the node last to avoid problems electing a new master node.
Backup the existing configurations so a record exists of any customizations. Run ./techsupport-bundle-grab.sh from your Support tools directory to do this, making sure to upgrade your support tools prior to running the script. Instructions are here.
Start by installing the latest Swarm Search, which is the caringo-elasticsearch-search RPM.
```
yum install caringo-elasticsearch-search-VERSION.noarch.rpm
```

Tip

The error: "ES_PATH_CONF must be set to the configuration path chown: cannot access '/etc/elasticsearch/elasticsearch.keystore': No such file or directory" displays if Elasticsearch 7 RPM was inadvertently installed. Install the caringo-elasticsearch-search RPM to proceed.

Run the script that installs and configures the upgrade.
If the script detects that Elasticsearch is installed and configured, it runs with --upgrade instead of configuring a new cluster, automating the Elasticsearch rolling upgrade steps (https://www.elastic.co/guide/en/elasticsearch/reference/7.17/rolling-upgrades.html).

/usr/share/caringo-elasticsearch-search/bin/configure_elasticsearch_with_swarm_search.py

The upgrade requires Internet access to download the Elasticsearch rpm. Place elasticsearch-7.17.*.rpm in the current directory if Internet access is unavailable.

Warning

The configure script currently requires node.name to be set in /etc/elasticsearch/elasticsearch.yml. This is not the case with an SCI-installed VM; uncomment the setting and set it to the default value of ${HOSTNAME}.

Compare the backup file to the newly created elasticsearch.yml and add back any customizations needed, such as node.attr.rack and systemctl restart elasticsearch if the configuration was modified.

Note

thread_pool.write.queue_size: 1000, xpack.ml.enabled, xpack.security.enabled, and prometheus.indices are no longer required.

Verify that all nodes are accounted for, all shards are assigned, and the status is green.
```
curl -i 'http://ELASTICSEARCH:9200/_cat/health?v'
```

The script updates the configuration files and restarts the service if Elasticsearch 7 is already installed.

Troubleshooting

Change permissions if the Elasticsearch service fails and journalctl -u elasticsearch shows access is denied (BootstrapException/AccessDeniedException):

chown elasticsearch /etc/elasticsearch

Important

Type Ctrl-C once when the upgrade script is stuck in retrying status checks and proceed to the next node after the script finishes if the cluster loses master during the upgrade process and does not recover. Review /etc/elasticsearch/elasticsearch.yml and tail -F /var/log/elasticsearch/<cluster-name>.log for configuration errors.

The nodes elect the master and recover once all nodes have started on Elasticsearch 7.5.2. Health status goes yellow, then eventually green. Re-enable shard allocation, otherwise /_cat/health?v stops at 50% with health status yellow.

Upgrading Elasticsearch manually

These are the steps the script automates if you need to upgrade manually:

It fixes /etc/sysconfig/elasticsearch to the correct ES6 version (the same as ES7).
It increases the systemd timeout in /etc/systemd/system/elasticsearch.service.d/override.conf (see github.com/elastic/elasticsearch/issues/60140)
A prompt to continue with the yum upgrade to 7.5.2 appears after refreshing the config files for Elasticsearch 6.
It disables shard allocation and does a POST synced-flush for safer rolling upgrades.
Important

Disabling shard allocation or sync-flush can fail to contact the node, but do not proceed to upgrade the next node until the cluster health is green again.
It uninstalls the Prometheus Exporter plugin if it exists.
It shells out to yum to install the Elasticsearch 7 RPM in the current directory or from artifacts.elastic.co, if unavailable.
It updates elasticsearch.yml for version 7 compatibility, including discovery.initial_master_nodes instead of discovery.zen.unicast.hosts, and jvm.options.
It starts the upgraded Elasticsearch 7 and waits for it to be ready.
The cluster re-enables shard allocation and prompts to repeat these two steps on the next node if the cluster health is green or yellow.