I am planing to upgrade the ELK stack from 5.1.2 to 5.5.2.
We are using daily index rotating.
Is anything happening with the old indices, which have been created with kibana 5.1.2 and where no new data has been added? Are they modified in any way or is elasticsearch them just reading in a backward compatible mode?
My thoughts are going in following direction:
If anything critical encounters after migration, I need to rollback in some kind.
Doing a snapshot of the vm and revert to the snapshot, if anything happens.
Then the data between migration and revert timestamp will be lost / needs to be reprocessed.
- pro: easy to do
- con: I cannot do it myself, a lot of process overhead in my company, additional money for the snapshot as long as it runs.
Following scenery seems to work on the first glimpse in my local developer vm:
- Before migration I will snapshot the .kibana index and all indices of the current day while still 5.1.2 is running
- migration, insert new data for today, then decission to rollback
- stop elasticsearch, logstash, kibana
- change the to the old binaries of ELK 5.1.2 to be started
- close indices of .kibana and current day
- restore snapshot made before migration
- pro: I can do it myself (-> more flexibility), probably less costs in our company
- con: more complicated, not knowing if it works in real life.
So for making my decisson I need your information, if Option 2 will work - if 5.5.2 will modify any old indexes which makes them not readable for version 5.1.2.
For option 3 (exporting all indices before starting my migration I do not have enough storage available.