Data Node migration with Docker

Graylog Central (peer support)
,
1

1. Describe your incident:
As mentioned in this other post here Migrating Opensearch Graylog to DataNode Graylog maintaining the config i’m tring to migrate my Opensearch container to DataNode to avoid the hassle of configuring Opensearch internally for each node.

I found a lot of documentation about:

However, I can’t find any posts or documentation about in-place DataNode migration using Docker.

I could start testing various deployment scenarios, but I thought it would be wiser to check with the community to find the best way to approach this task.

2. Describe your environment:

  • OS Information: 2 VMs running Ubuntu 22.04, Docker Swarm to manage the Graylog VM (and MongoDB) and the second VM is slave with only Opensearch.

  • Package Version: GraylogOpen 6.1.1, MongoDB 6.0, Opensearch 2.15.0

  • Service logs, configurations, and environment variables: I will try to use the CA we use of the rest of our sites. Other than that, I haven’t changed much from the default settings for this migration.

3. What steps have you already taken to try and solve the problem?
I’ve upgraded Graylog and Opensearch to the latest supported versions, hoping to encounter as few problems as possible.

4. How can the community help?

Has anyone already managed what I’m trying to do? Is there an order for deploying the DataNode and removing the Opensearch one, or do I have to keep DataNode and Opensearch in parallel, configure DataNode first with the migration wizard, then remove the Opensearch one?

Thanks

2

Hello @soc,

As long as all your indexes meet the base required version of Lucene for OS 2.15 then this should work.

You won’t need both DataNode and OS running at the same time, you would spin down the OS nodes and Graylog will begin caching incoming logs (ensure the journal can store these messages for as long as the upgrade takes). Spin up the the data node ensuring that the data store from your OS node is mounted as a volume on /var/lib/graylog-datanode.

Configure the DataNode, then remove the GRAYLOG_ELASTICSEARCH_HOSTS from your Graylog docker config and restart the Graylog hosts.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.