{"id":16088,"date":"2023-04-09T02:51:12","date_gmt":"2023-04-08T23:51:12","guid":{"rendered":"https:\/\/kifarunix.com\/?p=16088"},"modified":"2024-03-10T09:01:08","modified_gmt":"2024-03-10T06:01:08","slug":"how-to-upgrade-elk-stack-7-x-to-elk-stack-8-x","status":"publish","type":"post","link":"https:\/\/kifarunix.com\/how-to-upgrade-elk-stack-7-x-to-elk-stack-8-x\/","title":{"rendered":"How to Upgrade ELK Stack 7.x to ELK Stack 8.x"},"content":{"rendered":"\n<p>How to upgrade Elasticsearch 7 to 8? In this guide, you will learn how to upgrade ELK Stack 7.x to ELK Stack 8.x. ELK\/Elastic 8 is an improvement version over Elastic 7 that brings about a number of performance improvements, security enhancements, and new features.<\/p>\n\n\n\n<div class=\"wp-block-rank-math-toc-block\" id=\"rank-math-toc\"><h2>Table of Contents<\/h2><nav><ul><li><a href=\"#upgrading-elk-stack-7-x-to-elk-stack-8-x\">Upgrading ELK Stack 7.x to ELK Stack 8.x<\/a><ul><li><a href=\"#backup-your-elastic-data\">Backup your Elastic Data<\/a><\/li><li><a href=\"#prepare-elk-stack-7-x-for-upgrade-to-8-x\">Prepare ELK Stack 7.x for Upgrade to 8.x<\/a><\/li><li><a href=\"#upgrading-elk-stack-7-x-to-elk-stack-8-x-1\">Upgrading ELK Stack 7.x to ELK Stack 8.x<\/a><ul><li><a href=\"#upgrade-elasticsearch-7-x-to-elasticsearch-8-x\">Upgrade Elasticsearch7.x to Elasticsearch 8.x<\/a><\/li><li><a href=\"#install-elasticsearch-8-x\">Install Elasticsearch 8.x<\/a><\/li><li><a href=\"#start-an-upgraded-elasticsearch\">Start an Upgraded Elasticsearch<\/a><\/li><\/ul><\/li><li><a href=\"#upgrade-other-elastic-components\">Upgrade Other Elastic Components<\/a><\/li><li><a href=\"#reference\">Reference<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"upgrading-elk-stack-7-x-to-elk-stack-8-x\">Upgrading ELK Stack 7.x to ELK Stack 8.x<\/h2>\n\n\n\n<p>So, you might be running an Elastic stack that is a bit dated. for example, in my environment, i am running ELK\/Elastic stacj v7.17.0. In order to enjoy the \u00a0a new era of speed, scale, relevance, and simplicity brought about by Elastic 8, you definitely have to upgrade!<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"backup-your-elastic-data\">Backup your Elastic Data<\/h3>\n\n\n\n<p>Before you even think of upgrading your ELK Stack 7.x to ELK Stack 8.x, ensure that you have your data backed up. Just in case things go south, you should be able to restore and access your data.<\/p>\n\n\n\n<p>You can either take snapshots of your ELK stack 7.x servers from the hypervisor or<\/p>\n\n\n\n<p>check how to backup using <a href=\"https:\/\/kifarunix.com\/backup-and-restore-elasticsearch-index-data\/\" target=\"_blank\" rel=\"noreferrer noopener\">Elasticsearch snapshots<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"prepare-elk-stack-7-x-for-upgrade-to-8-x\">Prepare ELK Stack 7.x for Upgrade to 8.x<\/h3>\n\n\n\n<p>In this tutorial, we will be upgrading Elastic stack 7.17.0 to Elastic 8.7.0. If you are on a version lower than 7.17.0, you MUST first upgrade to 7.17.0 before upgrading to 8.x.<\/p>\n\n\n\n<p>The major components that we will start upgrade to upgrade are Elasticsearch and Kibana. <em>Beats and Logstash 7.n are compatible with Elasticsearch 8.7.0 to give you flexibility in scheduling the upgrade.<\/em><\/p>\n\n\n\n<p>Let&#8217;s confirm our current versions of Kibana and Elasticsearch;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1888\" height=\"613\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/kibana-v7.17.0.png\" alt=\"\" class=\"wp-image-16104\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/kibana-v7.17.0.png?v=1680983481 1888w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/kibana-v7.17.0-768x249.png?v=1680983481 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/kibana-v7.17.0-1536x499.png?v=1680983481 1536w\" sizes=\"(max-width: 1888px) 100vw, 1888px\" \/><\/figure>\n\n\n\n<p>Or just do;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>curl http:\/\/<strong>ES-NODE-IP<\/strong>:9200<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\n{\n  \"name\" : \"debian11\",\n  \"cluster_name\" : \"elasticsearch\",\n  \"cluster_uuid\" : \"pE3v-1oSTfaiF3Dp2VbOjg\",\n  \"version\" : {\n    <strong>\"number\" : \"7.17.0\",<\/strong>\n    \"build_flavor\" : \"default\",\n    \"build_type\" : \"deb\",\n    \"build_hash\" : \"bee86328705acaa9a6daede7140defd4d9ec56bd\",\n    \"build_date\" : \"2022-01-28T08:36:04.875279988Z\",\n    \"build_snapshot\" : false,\n    \"lucene_version\" : \"8.11.1\",\n    \"minimum_wire_compatibility_version\" : \"6.8.0\",\n    \"minimum_index_compatibility_version\" : \"6.0.0-beta1\"\n  },\n  \"tagline\" : \"You Know, for Search\"\n}\n<\/code><\/pre>\n\n\n\n<p>You can use Kibana Upgrade Assistant in preparation for upgrading ELK Stack 7.x to ELK Stack 8.x. <em>The assistant identifies deprecated settings in your configuration and guides you through the process of resolving issues if any deprecated features are enabled<\/em>.<\/p>\n\n\n\n<p>Thus, after you have CONFIRMED your Elastic Data backup, and as an administrative user, of course, login to Kibana and navigate to <strong>Management &gt; Stack Management &gt; Stack &gt; Upgrade Assistant<\/strong>.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1895\" height=\"1422\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/Kibana-v7.17.0-Upgrade-Assistant-Elastic.png\" alt=\"How to Upgrade ELK Stack 7.x to ELK Stack 8.x\" class=\"wp-image-16105\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/Kibana-v7.17.0-Upgrade-Assistant-Elastic.png?v=1680983821 1895w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/Kibana-v7.17.0-Upgrade-Assistant-Elastic-768x576.png?v=1680983821 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/Kibana-v7.17.0-Upgrade-Assistant-Elastic-1536x1153.png?v=1680983821 1536w\" sizes=\"(max-width: 1895px) 100vw, 1895px\" \/><\/figure>\n\n\n\n<p>So, before you upgrade;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>As you can see, even the upgrade assistant starts with &#8220;Backup your data&#8221;. Very important! In our setup, we have already backed up our data and thus we are good to go.<\/li>\n\n\n\n<li>Migrate system indices to prepare them for upgrade. From the assistant, this is done already!<\/li>\n\n\n\n<li>Review deprecated settings and resolve issues.<\/li>\n<\/ul>\n\n\n\n<p>As you can see, we have some critical issue on Elasticsearch and some warning issues on Kibana. Let&#8217;s try to find out about them and fix them;<\/p>\n\n\n\n<p>Thus, click on Elasticsearch to view the issues;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1879\" height=\"606\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/elasticsearch-critial-issues.png\" alt=\"\" class=\"wp-image-16106\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/elasticsearch-critial-issues.png?v=1680985031 1879w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/elasticsearch-critial-issues-768x248.png?v=1680985031 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/elasticsearch-critial-issues-1536x495.png?v=1680985031 1536w\" sizes=\"(max-width: 1879px) 100vw, 1879px\" \/><\/figure>\n\n\n\n<p>As you can see, the issue is about enabling security features on our cluster. Note the in my current setup, there is no any security features enabled in our cluster.<\/p>\n\n\n\n<p>Thus, click on the issue to view more details and probably get more information and suggestions on how to fix it.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1901\" height=\"731\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/elasticsearch-critial-issues-sec-features.png\" alt=\"\" class=\"wp-image-16107\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/elasticsearch-critial-issues-sec-features.png?v=1680985332 1901w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/elasticsearch-critial-issues-sec-features-768x295.png?v=1680985332 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/elasticsearch-critial-issues-sec-features-1536x591.png?v=1680985332 1536w\" sizes=\"(max-width: 1901px) 100vw, 1901px\" \/><\/figure>\n\n\n\n<p>So, enable security features if you didn&#8217;t do that already.<\/p>\n\n\n\n<p>Usually, when you deploy new Elasticsearch 8.x, it will automatically enable authentication and authorization, setup TLS for transport and HTTP layers.<\/p>\n\n\n\n<p>So, you need to setup the same on Elastic 7.17.0 before upgrade.<\/p>\n\n\n\n<p>Stop both Kibana and Elasticsearch on ALL nodes in the cluster;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl stop kibana<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl stop elasticsearch<\/code><\/pre>\n\n\n\n<p>Enable authentication and Configure Transport Layer Security (TLS) between the cluster nodes by following the guides below;<\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/how-to-enable-basic-authentication-on-elk-stack\/#create-passwords-for-in-built-elastic-users\" target=\"_blank\" rel=\"noreferrer noopener\">Enable Basic Authentication<\/a><\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/enable-https-connection-between-elasticsearch-nodes\/\">Enable HTTPS Connection Between Elasticsearch Nodes<\/a><\/p>\n\n\n\n<p>When the cluster is up, login back to Kibana and check the Upgrade assistant, and refresh the page! Elasticsearch issue should be fixed now!<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1887\" height=\"634\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/fixed-elasticsearch-deprecated-issues.png\" alt=\"\" class=\"wp-image-16127\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/fixed-elasticsearch-deprecated-issues.png?v=1680989192 1887w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/fixed-elasticsearch-deprecated-issues-768x258.png?v=1680989192 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/fixed-elasticsearch-deprecated-issues-1536x516.png?v=1680989192 1536w\" sizes=\"(max-width: 1887px) 100vw, 1887px\" \/><\/figure>\n\n\n\n<p>The Warning should be gone as well.<\/p>\n\n\n\n<p>Now, again, let&#8217;s find out what is deprecated about Kibana, by clicking on the warnings. See below what is deprecated in our Kibana.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1880\" height=\"702\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/kibana-deprecated-settings.png\" alt=\"\" class=\"wp-image-16135\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/kibana-deprecated-settings.png?v=1680994755 1880w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/kibana-deprecated-settings-768x287.png?v=1680994755 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/kibana-deprecated-settings-1536x574.png?v=1680994755 1536w\" sizes=\"(max-width: 1880px) 100vw, 1880px\" \/><\/figure>\n\n\n\n<p>Click on each issue to see suggestions on how to fix them;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>For the first identified issue on <strong>Kibana logging format<\/strong>, we have no special handling of current Kibana logs. So I am okay with new logging format. If this is different for you, then check their guide on how to fix that.<\/li>\n<\/ul>\n\n\n\n<p>Thus, remove the logging.dest configuration on kibana.yml;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sed -i.bak-log '\/^logging.dest\/s\/^\/#\/' \/etc\/kibana\/kibana.yml<\/code><\/pre>\n\n\n\n<p>Also, remove the same setting on Kibana systemd unit file.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sed -i.bak 's|--logging.dest=\"\/var\/log\/kibana\/kibana.log\"||' \/etc\/systemd\/system\/kibana.service<\/code><\/pre>\n\n\n\n<p>Reload systemd unit files and restart Kibana;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl daemon-reload;systemctl restart kibana<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>For the <strong>The &#8220;xpack.reporting.roles&#8221; setting<\/strong> issue, we have taken suggested steps to fix;\n<ul class=\"wp-block-list\">\n<li>Set &#8220;<strong><code>xpack.reporting.roles.enabled<\/code><\/strong>&#8221; to &#8220;<code><strong>false<\/strong><\/code>&#8221; in kibana.yml;<br><br><code>echo \"xpack.reporting.roles.enabled: false\" &gt;&gt; \/etc\/kibana\/kibana.yml<\/code><br><\/li>\n\n\n\n<li>Remove &#8220;<strong><code>xpack.reporting.roles.allow<\/code><\/strong>&#8221; in kibana.yml, if present.<br><br><code>sed -i.bak '\/xpack.reporting.roles.allow\/d' \/etc\/kibana\/kibana.yml<\/code><br><\/li>\n\n\n\n<li>Go to Management &gt; Security &gt; Roles to create one or more roles that grant the Kibana application privilege for Reporting.<\/li>\n\n\n\n<li>Grant Reporting privileges to users by assigning one of the new roles.<\/li>\n\n\n\n<li>Check the <a href=\"https:\/\/www.elastic.co\/guide\/en\/kibana\/current\/secure-reporting.html\" target=\"_blank\" rel=\"noreferrer noopener\">Kibana reporting configuration guide<\/a>.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>&#8220;xpack.security.session.idleTimeout&#8221; is now 8 hours&#8221;<\/strong>: I will leave this setting for my setup. To configure a custom timeout, set &#8220;<strong><code>xpack.security.session.idleTimeout<\/code><\/strong>&#8220;. Use the format <strong><code>&lt;count&gt;\u2060[ms|s|m|h|d|w|M|Y]<\/code><\/strong>, for example, 20m, 24h, 7d, 1w. A value of 0 disables the timeout.<\/li>\n\n\n\n<li><strong>&#8220;xpack.security.session.lifespan&#8221; is now 30 days&#8221;<\/strong>: Similarly, I will leave this as is. To configure a custom timeout, set &#8220;<strong><code>xpack.security.session.lifespan<\/code><\/strong>&#8220;. Use the format <strong><code>&lt;count&gt;\u2060[ms|s|m|h|d|w|M|Y]<\/code><\/strong>, for example, 20m, 24h, 7d, 1w. A value of 0 disables the timeout.<\/li>\n\n\n\n<li>If you made any changes to Kibana, restart it to apply the changes.<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl stop kibana &amp;&amp; systemctl start kibana<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"upgrading-elk-stack-7-x-to-elk-stack-8-x-1\">Upgrading ELK Stack 7.x to ELK Stack 8.x<\/h3>\n\n\n\n<p>Once you have fixed all the issues identified by the upgrade assistant, proceed to upgrade Elastic stack 7.x to Elastic stack 8.x.<\/p>\n\n\n\n<p>The upgrade process will now involve upgrading each Elastic components individually.<\/p>\n\n\n\n<p>As usual, upgrade Elastic components in the following order;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Elasticsearch &gt; Kibana &gt; Logstash &gt; Beats &gt; Elastic Agents (if you are using them)<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"upgrade-elasticsearch-7-x-to-elasticsearch-8-x\">Upgrade Elasticsearch7.x to Elasticsearch 8.x<\/h4>\n\n\n\n<p>Before you can begin the Elasticsearch 7.x upgrade process;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Temporarily disable shard\/replica allocation since Elasticsearch will need to be restarted when upgraded. You can disable shard\/replica allocation via Elasticsearch API from command line or simply from Kibana Dev Tools console. We use command line as follows (if no authentication is enabled, omit <strong><code>-u elastic<\/code><\/strong> option);<\/li>\n<\/ul>\n\n\n\n<p>Replace the addresses of the nodes accordingly.<\/p>\n\n\n\n<pre class=\"scroll-sz\"><code>\ncurl -X PUT \"node01:9200\/_cluster\/settings?pretty\" -u elastic -H 'Content-Type: application\/json' -d'\n{\n  \"persistent\": {\n    \"cluster.routing.allocation.enable\": \"primaries\"\n  }\n}\n'\n<\/code><\/pre>\n\n\n\n<p>Sample output;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\n{\n  \"acknowledged\" : true,\n  \"persistent\" : {\n    \"cluster\" : {\n      \"routing\" : {\n        \"allocation\" : {\n          \"enable\" : \"primaries\"\n        }\n      }\n    }\n  },\n  \"transient\" : { }\n}\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>(Optional) Stop indexing and perform a flush to ensure a quicker shard recovery.<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -X POST \"node01:9200\/_flush?pretty\" -u elastic<\/code><\/pre>\n\n\n\n<pre class=\"scroll-sz\"><code>\nEnter host password for user 'elastic':\n{\n  \"_shards\" : {\n    \"total\" : 16,\n    \"successful\" : 14,\n    \"failed\" : 0\n  }\n}\n<\/code><\/pre>\n\n\n\n<ul class=\"wp-block-list\">\n<li>(Optional) Temporarily stop machine learning jobs and datafeeds and prevent new jobs from opening by enabling upgrade mode.<\/li>\n<\/ul>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -X POST \"node01:9200\/_ml\/set_upgrade_mode?enabled=true&amp;pretty\" -u elastic<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>Enter host password for user 'elastic':\n{\n  \"acknowledged\" : true\n}<\/code><\/pre>\n\n\n\n<p>It is now time to upgrade Elasticsearch!<\/p>\n\n\n\n<p>If you are running an Elasticsearch cluster, you need to upgrade one node at a time to avoid service interruption. This is called <strong>rolling upgrade<\/strong>.<\/p>\n\n\n\n<p>Follow this order to upgrade Elasticsearch nodes;<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Upgrade non-master-eligible&nbsp;nodes first. These are node with the setting, <strong><code>node.master: false<\/code><\/strong>.<\/li>\n\n\n\n<li>Upgrade nodes tier-by-tier, in the order: <strong><code>frozen tier &gt; the cold tier &gt; the warm tier &gt; the hot tier<\/code><\/strong> last.<\/li>\n\n\n\n<li>Upgrade the master-eligible nodes last. These are nodes with the setting, <strong><code>node.master: true<\/code><\/strong>.<\/li>\n<\/ol>\n\n\n\n<p>We are running a three node cluster in this guide. All nodes are master legible.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>curl node03:9200\/_cat\/nodes?v -u elastic<\/code><\/pre>\n\n\n\n<pre class=\"scroll-sz\"><code>\nip             heap.percent ram.percent cpu load_1m load_5m load_15m node.role master name\n192.168.56.154            9          97   9    0.23    0.42     0.35 dim       -      node03\n192.168.58.22            39          74  16    0.26    0.65     0.60 dim       -      node01\n192.168.56.10            61          97  15    0.18    0.62     0.50 dim       *      node02\n<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"install-elasticsearch-8-x\">Install Elasticsearch 8.x<\/h4>\n\n\n\n<p>Note that it&#8217;s always a good idea to carefully review any changes that are made during a package update and to make sure your configuration files are backed up before updating, so you can restore them if necessary.<\/p>\n\n\n\n<p>Note that you have to upgrade on one node at a time, and start the upgraded one when done. Go next etc&#8230;<\/p>\n\n\n\n<p>On Ubuntu;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apt update<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>apt install apt-transport-https gnupg2 -y<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>wget -qO - https:\/\/artifacts.elastic.co\/GPG-KEY-elasticsearch | \\\ngpg --dearmor &gt; \/etc\/apt\/trusted.gpg.d\/elk.gpg<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>echo \"deb https:\/\/artifacts.elastic.co\/packages\/8.x\/apt stable main\" \\\n&gt; \/etc\/apt\/sources.list.d\/elastic-8.x.list<\/code><\/pre>\n\n\n\n<p>Stop Elasticsearch service, backup config and upgrade Elasticsearch 7.x to 8.x;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl stop elasticsearch.service<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>cp -r \/etc\/elasticsearch{,-7.17.0}<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>apt update<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>apt install --only-upgrade elasticsearch<\/code><\/pre>\n\n\n\n<p>When prompted, DO NOT override the configurations!<\/p>\n\n\n\n<p>On RHEL derivatives;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>rpm --import https:\/\/packages.elastic.co\/GPG-KEY-elasticsearch<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\ncat > \/etc\/yum.repos.d\/elastic.repo << 'EOL'\n[elastic-8.x]\nname=Elastic repository for 8.x packages\nbaseurl=https:\/\/artifacts.elastic.co\/packages\/8.x\/yum\ngpgcheck=1\ngpgkey=https:\/\/artifacts.elastic.co\/GPG-KEY-elasticsearch\nenabled=1\nautorefresh=1\ntype=rpm-md\n<\/code><\/pre>\n\n\n\n<p>Stop Elasticsearch service and upgrade Elasticsearch 7.x to 8.x;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl stop elasticsearch.service<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>cp -r \/etc\/elasticsearch{,-7.17.0}<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>yum update elasticsearch<\/code><\/pre>\n\n\n\n<p>If you have any plugins installed, then simply re-run the install command (<code>\/usr\/share\/elasticsearch\/bin\/elasticsearch-plugin<\/code>) to upgrade them.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"start-an-upgraded-elasticsearch\">Start an Upgraded Elasticsearch<\/h4>\n\n\n\n<p>On the node that you have upgraded Elasticsearch, start the service;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl start elasticsearch<\/code><\/pre>\n\n\n\n<p>Repeat the upgrade for other nodes on the cluster and bring them back online when upgrade is done.<\/p>\n\n\n\n<p>When all is done, the upgrade assistant will tell you all about it!<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1897\" height=\"730\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/cluster-upgraded.png\" alt=\"How to Upgrade ELK Stack 7.x to ELK Stack 8.x\" class=\"wp-image-16128\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/cluster-upgraded.png?v=1680992244 1897w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/cluster-upgraded-768x296.png?v=1680992244 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/cluster-upgraded-1536x591.png?v=1680992244 1536w\" sizes=\"(max-width: 1897px) 100vw, 1897px\" \/><\/figure>\n\n\n\n<p>Check the cluster version;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>curl https:\/\/node03:9200 -u elastic<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\nEnter host password for user 'elastic':\n{\n  \"name\" : \"node03\",\n  \"cluster_name\" : \"elasticsearch\",\n  \"cluster_uuid\" : \"pE3v-1oSTfaiF3Dp2VbOjg\",\n  \"version\" : {\n   <strong> \"number\" : \"8.7.0\",<\/strong>\n    \"build_flavor\" : \"default\",\n    \"build_type\" : \"deb\",\n    \"build_hash\" : \"09520b59b6bc1057340b55750186466ea715e30e\",\n    \"build_date\" : \"2023-03-27T16:31:09.816451435Z\",\n    \"build_snapshot\" : false,\n    \"lucene_version\" : \"9.5.0\",\n    \"minimum_wire_compatibility_version\" : \"7.17.0\",\n    \"minimum_index_compatibility_version\" : \"7.0.0\"\n  },\n  \"tagline\" : \"You Know, for Search\"\n}\n<\/code><\/pre>\n\n\n\n<p>We also have all nodes in the cluster;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>curl node03:9200\/_cat\/nodes?v -u elastic<\/code><\/pre>\n\n\n\n<pre class=\"scroll-box\"><code>\nip             heap.percent ram.percent cpu load_1m load_5m load_15m node.role   master name\n192.168.58.22            74          97   3    0.58    0.35     0.34 cdfhilmrstw *      node01\n192.168.56.10            48          96  12    0.53    0.75     0.44 dim         -      node02\n192.168.56.154           30          97   1    0.05    0.11     0.15 dim         -      node03\n<\/code><\/pre>\n\n\n\n<p>Next, re-enable shard allocation on the cluster;<\/p>\n\n\n\n<pre class=\"scroll-box\"><code>\ncurl -X PUT \"node01:9200\/_cluster\/settings?pretty\" -u elastic -H 'Content-Type: application\/json' -d'\n{\n  \"persistent\": {\n    \"cluster.routing.allocation.enable\": null\n  }\n}'\n<\/code><\/pre>\n\n\n\n<p>Disable upgrade mode;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>curl -X POST \"node01:9200\/_ml\/set_upgrade_mode?enabled=false&amp;pretty\" -u elastic<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"upgrade-other-elastic-components\">Upgrade Other Elastic Components<\/h3>\n\n\n\n<p>At this point, tough task is done and you can now proceed to upgrade other Elastic components.<\/p>\n\n\n\n<p>In my stack, let's begin by upgrading Kibana.<\/p>\n\n\n\n<p>So, stop all instances of Kibana and upgrade them one by one. Kibana does not support rolling upgrades.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl stop kibana<\/code><\/pre>\n\n\n\n<p>Depending on your previous method of installation, upgrade Kibana.<\/p>\n\n\n\n<p>In our setup, Kibana was installed via Elastic APT repos. Thus, since we have Elastic 8.x repos in place, we will just upgrade it as follows;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>apt install --only-upgrade kibana<\/code><\/pre>\n\n\n\n<p>Again, DO NOT override the configs when prompted!<\/p>\n\n\n\n<p>Upgrade all your plugins using the&nbsp;<code>kibana-plugin<\/code>&nbsp;script as well.<\/p>\n\n\n\n<p>Also, disable any plugins that are not compatible with Kibana. For example, I had Wazuh manager integrated with ELK. But, as of this writing, current versions of Wazuh is not compatible with ELK 8.x.;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/share\/kibana\/bin\/kibana-plugin list<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>wazuh@4.3.6-4307<\/code><\/pre>\n\n\n\n<p>To remove a plugin, use the command;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/share\/kibana\/bin\/kibana-plugin remove &lt;plugin&gt;<\/code><\/pre>\n\n\n\n<p>e.g;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/usr\/share\/kibana\/bin\/kibana-plugin remove wazuh<\/code><\/pre>\n\n\n\n<p>When all is done, restart Kibana;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl restart kibana<\/code><\/pre>\n\n\n\n<p>Confirm Upgrades from UI;<\/p>\n\n\n\n<div><a href=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/kibana-upgraded-to-v8.7.0.png\" class=\"td-modal-image\"><figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1871\" height=\"589\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/kibana-upgraded-to-v8.7.0.png\" alt=\"How to Upgrade ELK Stack 7.x to ELK Stack 8.x\" class=\"wp-image-16137\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/kibana-upgraded-to-v8.7.0.png?v=1680996319 1871w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/kibana-upgraded-to-v8.7.0-768x242.png?v=1680996319 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/kibana-upgraded-to-v8.7.0-1536x484.png?v=1680996319 1536w\" sizes=\"(max-width: 1871px) 100vw, 1871px\" \/><\/figure><\/a><\/div>\n\n\n\n<p>Kibana 8 discovr tab;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1905\" height=\"926\" src=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/kibana-8.7.0-discover-data.png\" alt=\"\" class=\"wp-image-16138\" title=\"\" srcset=\"https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/kibana-8.7.0-discover-data.png?v=1680997064 1905w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/kibana-8.7.0-discover-data-768x373.png?v=1680997064 768w, https:\/\/kifarunix.com\/wp-content\/uploads\/2023\/04\/kibana-8.7.0-discover-data-1536x747.png?v=1680997064 1536w\" sizes=\"(max-width: 1905px) 100vw, 1905px\" \/><\/figure>\n\n\n\n<p>Navigate to upgrade assistant to see if there are any issues with previous indices and sort them if any.<\/p>\n\n\n\n<p>That  brings up to the end of our guide on upgrading ELK Stack 7.x to ELK Stack 8.x.<\/p>\n\n\n\n<p>You can upgrade other components such as Logstash, or beats if you have them running older versions.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"reference\">Reference<\/h3>\n\n\n\n<p><a href=\"https:\/\/www.elastic.co\/guide\/en\/elastic-stack\/current\/upgrading-elastic-stack-on-prem.html\" target=\"_blank\" rel=\"noreferrer noopener\">Upgrade Elastic on-prem<\/a><\/p>\n\n\n\n<p>Other Tutorials<\/p>\n\n\n\n<p><a href=\"https:\/\/kifarunix.com\/?s=upgrade\" target=\"_blank\" rel=\"noreferrer noopener\">How to Upgrade Tutorials<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>How to upgrade Elasticsearch 7 to 8? In this guide, you will learn how to upgrade ELK Stack 7.x to ELK Stack 8.x. ELK\/Elastic 8<\/p>\n","protected":false},"author":10,"featured_media":16140,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rank_math_lock_modified_date":false,"footnotes":""},"categories":[72,910,121],"tags":[6516,6511,6515,6512,6513,6514],"class_list":["post-16088","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-monitoring","category-elastic-stack","category-howtos","tag-assistant-upgrade-elk-7-x","tag-how-to-upgrade-elk-stack-7-x-to-elk-stack-8-x","tag-kibana-upgrade","tag-ugrade-elasticsearch-7-x-to-elasticsearch-8-x","tag-upgrade-elastic-7-x-to-elastic-8-x","tag-upgrade-elk-8","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/16088"}],"collection":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/comments?post=16088"}],"version-history":[{"count":27,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/16088\/revisions"}],"predecessor-version":[{"id":20733,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/posts\/16088\/revisions\/20733"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media\/16140"}],"wp:attachment":[{"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/media?parent=16088"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/categories?post=16088"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kifarunix.com\/wp-json\/wp\/v2\/tags?post=16088"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}