Our graylogs server is very out of date. 2.4.6. I am upgrading it to latest compatible releases, along with elasticsearch and mongo.
I’d like to do this with as little downtime as possible.
Following is my plan for moving the data over. Please let me know if this makes sense. I’ve tested it and believe it should work but want to avoid gotchas.
- Graylogs creates new indices with number 0 for each index set by default.
- Identify the highest number for each index set on the old server (for example, logs_55). On the new server, manually create a new index one higher for each index set (for example, logs_56).
- Each index set now has an active write index that is one higher than the existing index sets on the old server.
- On the new server, delete the default _0 indicies for each index set.
- Update IPs on the servers to steal incoming log traffic from the old server.
- All logging now happening on the new server to the newly created indices.
- On old server, rotate all index sets to move the active write index off of the current index.
- Use elasticsearch reindex from remote to copy all indices (except the last one that was just rotated and should be empty) to new server.
Thank you for your time.