After ElasticSearch Upgrade 7.15.2 : "Unable to perform search query [1:608] [bool] unknown field [disable_coord]"

[Memorist23]

I know this one has come up before but I’ve been through as many of the other tickets and can’t find a solution for this one.

I did a live upgrade\migration to new nodes on my ES cluster which went really smoothly for the ES side.
Kibana is up and running with the new Cluster.
1 of my Graylog nodes is up and running without any issues.
2nd Node is giving me error as per subject.

Graylog is on version 3.1.1
I know node 2 can see the cluster because there is in/out progress in the top right
And In system overview it is reporting the right details of the cluster.
Green. Shards 1728 active, 0 on everything else.

This if the first log error I can’t figure out where to resolve it.

[query_string] query does not support [use_dis_max].
ElasticsearchException{message=Unable to perform search query

Screenshot attached as well. If it helps

[gsmith]

Hello && Welcome

@Memorist23

Graylog is on version 3.1.1

I don’t think Graylog 3.1.1 is able to use elasticsearch version 7.15.

Might want to look here.
https://archivedocs.graylog.org/en/3.1/pages/installation/os/centos.html

[tellistone (Tully Elliston)]

https://docs.graylog.org/docs/installing#

You’re running an unsupported version of Elasticsearch, which is likely to cause you problems. The only way to roll back Elasticsearch is revert to an earlier backup taken from before you updated it. If you don’t have such a backup, I’m sorry to say you may need to consider scrapping your ES data and re-installing if you want your cluster to be stable.

[Memorist23]

That explains why the other node is working.
It’s Graylog version is 4.0.1

[gsmith]

Had a feeling it might be that.
I would highly suggest you look over at the documentation As @tellistone suggested also about elasticsearch down grading there will be lose reverting ES to an earlier version.