Elasticsearch migration from 7.17 to 8.15

Elastic Stack Elasticsearch
1

We need to upgrade from ES 7.17.3 to 8.15.2. We have done the following so far:

  1. Ran Upgrade Assistant on 7.17.3 and fixed any reported “Critical” issues. No Critical issue is being reported now.
  2. Taken snapshot on a NAS mounted on all the nodes

Now we intend to build a parallel 8.15.2 ES cluster on the same hosts and do the following:

  1. Create a repository (in the new Kibana) pointing to the NAS where 7.17.3 snapshot was stored
  2. Restore the snapshot to the new cluster.

Please advise if this approach looks good.

Thanks

2

8.15.2 was released over 16 months ago so it’s missing out on many improvements found in newer 8.x versions. I strongly recommend going straight onto the most recent version, currently 8.19.11.

These docs describe the recommended upgrade process. You would normally upgrade the cluster in-place rather than setting up a brand-new cluster as you suggest.

3

Thanks. Will go for 8.19.11 as you advised on this self-managed cluster.

Considering I am doing this for the first time, for some reason creating a new cluster and restoring old snapshot seems to be a safer and less error prone/ intrusive option to me.

Please guide me if the steps above would do the needful.

Thanks again!

4

This adds a lot of extra work and may introduce some issues.

What kind of snapshot are you talking about, snapshot of your data or a full cluster snapshot including system indices?

If you are including system indices this may not work, because some migration may be required, and this is done during the upgrade of Elasticsearch and Kibana.

Since you have a snapshot, I would simple upgrade the cluster and in case of any issue restore it.

1 Like
5

What a coincidence, someone was doing same, same versions, last week in this thread

Ah, it was you :wink:

It's not really considered good etiquette to open parallel threads on essentially the same topic.

Good decision. You were told 8.15.x was ages old on the other thread.

The other thread stalled when it was suggested you do the same 7.x --> 8.x upgrade on a throwaway environment first. You wrote:

"It is hard to get another environment for trial/testing purposes"

I am glad you have solved this issue and are able to deploy a completely different parallel cluster!

Anyways, I agree with @leandrojmp and @DavidTurner - in your situation I think you have better chances with an upgrade which, IMhO, is significantly simpler and is likely safer too.

6

Thanks. I will adopt the approach of doing an in-place upgrade of the instances.

7

My apologies! I opened a new thread as I thought it would be better as I would be discussing a new approach.

8

OK, so I have reasonably good news for you.

I setup a single node 7.17.3 cluster on a throwaway environment with effectively same elasticsearch.yml file as you shared on the other thread. aAd populated some indices and some dashboards while on 7.17.3.

Note I had to add the passwords for the builtin users - elastic, kibana_system, etc.

I then upgraded to 7.17.29, which is latest in 7.17.x. Both kibana and elasticsearch. No issues found.

I then upgraded to 8.19.10, which is the latest in the 8.x series.

EDIT: I forgot about 8.19.11! In meantime, I upgraded the node to 9.3.0, again without difficulty though I had to re-index my 7.x-created-indices.

elasticsearch starts fine.

kibana had a few more small issues, due to how logging works, and I had to fiddle around with the systemd kibana.service. I am using Ubuntu 24.04.3 LTS, but it works fine.

This is the now upgraded cluster:

# curl -s -k -u elastic:changeme http://localhost:9200/
{
  "name" : "HOSTNAME",
  "cluster_name" : "elasticsearch",
  "cluster_uuid" : "B6BANQ8aTUS_GwUKMnPEgA",
  "version" : {
    "number" : "8.19.10",
    "build_flavor" : "default",
    "build_type" : "deb",
    "build_hash" : "493241b351be6d9f40d52a1406c91a23b4148821",
    "build_date" : "2026-01-08T22:07:49.939644068Z",
    "build_snapshot" : false,
    "lucene_version" : "9.12.2",
    "minimum_wire_compatibility_version" : "7.17.0",
    "minimum_index_compatibility_version" : "7.0.0"
  },
  "tagline" : "You Know, for Search"
}

which is still using exactly same elasticsearch,yml it was with 7.x

cluster.name: elasticsearch
ingest.geoip.downloader.enabled: false
node.name: HOSTNAME
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
network.host: 0.0.0.0
http.cors.enabled: true
http.cors.allow-origin: /.*/
discovery.seed_hosts: ["HOSTNAME"]
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: certificate
xpack.security.transport.ssl.keystore.path: /etc/elasticsearch/certs/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path: /etc/elasticsearch/certs/elastic-certificates.p12
9

Thanks a lot! This is very useful.