Upgrade from 8 to 9 resolve issues in bulk

On the path to version 9 from version 7 I am currently on 8.19. Upgrade assistant shows a lot of deprecation issues that needs to be solved first. Mostly older indexes with compatibility version < 8.0. It is possible to click it one by one to replace index and create alias, but is it possible to do suggested actions in bulk? Or could someone provide an api example how to do that without downtime? Much appreciated! :slightly_smiling_face:

What is your use case? Are yoiu using time-based indices that generally go read-only as they get old or are you continously updating and/or deleting from your indices?

I believe the upgrade process, whether you let Kibana run this or automate it yourself via the official APIs, involve reindexing data into new indices and then removing the old index before creating an alias. As reindexing works based on a snapshot of the data in the index when it starts, this process can as far as I know not be done without downtime unless some potential data loss (if index is not read-only) is acceptable.

I dont have much experience with elastic and got a one time task to upgrade existing instances. Indices are constantly used although I think can get away with reindexing during the night. Clicking in upgrade assistant seems easy to do, but time consuming. Is there like an api endpoint to execute this action, as I am afraid that I will mess something up when preparing script to create new indices, waiting for tasks, reindexing, deleting etc.

Welcome to the forum ...

... but. tbh, thats a bit of problem. N.x to N.y is usually pretty straightforward. But N.x to (N+1).y is a major version upgrade, what to do if the process goes wrong, without having "much experience"? And you are on N.x to (N+2).y, which is even harder.

The "system indices" are handled with the Kibana tool, though you need to "press the button".

For your own indices, it reindexes only what was in the index when the reindexing task started. Yes, there is an API to do that re-indexing, so you could script most of it. There's a API way to identify all the indices that are the 7.x version, the kibana UI tells you too obviously. And you need be careful with re-indexing, if you were to be careless you might re-index into a used index-pattern and ... confusion.

How long it all takes depends on your load / hardware / count / size of the indices. And if there is data flowing, you probably need stop it temporarily.

Before doing anything, you should make a full snapshot, which is also what the Upgrade Advisor tells you.

Thank you for your comments. When I reindex a large index, can I run reindexing again to copy only changes since last reindexing? Will that be faster than initial one?

well, it sort of depends.

Do you update existing documents, or delete documents, in the to-be-reindexed indices?

If every doc is just inserted / indexed once, and never modified or deleted, then it's easier. As you can do incremental _reindex via a flag field.

Also if the data always arrives in purely sequential time order, and you have a field to track that, you can do similar. e.g. often there is a field updated_at or ingest_timestamp or similar.

This may vary as there are few instances used for different purposes. One is destination for fluentd logs.

If I reindex do I have to worry about policies too or it will work by alias?

Thanks for all the help :melting_face:

I doubt any log use case will overwrite or delete existing individual documents, generally it's just streaming logs into effectively a log bucket.

Er, it depends. On the specific policies and alias. You might have a setup where it does not matter, but you might have a setup where it does. You absolutely surely need to check.

The level of difficulty here is really just on how long re-indexing would take. If it's "minutes", just stop the flow. You dont need to re-index then instantly upgrade to 9.x, you can also chip away at the issue one index-pattern at a time.

Also, if you have time based indices, e.g. daily logs in index called myapp-2025-12-17, and they live of say a month, just wait a month. You are on 8.x already, al new indices are already good and dont need reindexing. If you can rollover, then rollover.

That wonderful to hear! Just wait and problem will solve itself :slight_smile: thanks