Elastic 2.5 -> 5.0 all settings lost


we have updated our graylog system to latest graylog 2.5 and elastic from 2.5 to 5.

all looked fine, but then we saw that the elasticsearch was storing the data in “/var/lib/elasticsearch” instead of “/media/data/elasticsearch” short before 0 KB free space on “/”.

in all configs was the path explizit OK so we did a shutdown of the system (it’s a single-node) and reinstalled elasticsearch and graylog again with blank/new config-files.

then configured elasticsearch / graylog again and it works now with the data-path, but we have lost everything from before… it’s a complete, empty system now.

on the partition are all files shown, ACLs are fine (elasticsearch is owner)

in the documentation is shown, that all config settings are stored in the MongoDB Database, which we haven’t touched, so we thought it will pick it up and use it automatically.

is there a way, how we can “restore” the old config like LDAP, Inputs, Streams, Dashboards etc?

regards michael

Most important question is: how did you upgrade? If you used a package manager, like RPM or APT, it should have retained your original configuration files.

Now I’m going to feel silly for asking this, but: do you have backups?


we used apt, as it’s running on an ubuntu server.

I have no full backup of the Application, but the config files from graylog and elastic.

the “old” elastic-files are all present and accessable.

the most important thing for me would be to migrate the old elastic-files, if no restore via mongodb is possible.

I was now able to access the mongodb via mongo compass and all settings have been wiped to default installation :confused:

I’m now rebuilding the config. is there a script or similar, which “moves” the existing elasticsearch files to the new cluster?

regards michael

looks like as with elastic 5 the indices got a new name on the partition, which doesn’t match the name which you define in the webgui.

old Indices which matched the “names” in the gui:

new Indices which don’t match the name in the gui:

could that maybe cause the issue, why I don’t see them?


This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.