Old Graylog migration

Graylog Central (peer support)
1

Hello,
After a lot of research, I finally got lost and that’s why I’m making this request.

I have a server under Debian 10 with an old Graylog 2.4.7
I have a single node and three indexes for a total of 100GB of data.

I would like to set up a new server and migrate my indexes but I don’t know if I should favour intermediate versions (Debian & Graylog) or go directly to Debian 12 and Graylog 6 …

I’ve seen quite a few posts about migrations, but often with only one version difference.

I’m probably dreaming, but is there a plugin that can read the indexes on the source server and convert them in the process?

Thank you in advance for your help and guidance.

2

Hey @threepwood,

As the version of Graylog you are on is quite old there isn’t a simple path to have that data available with a newer system.

The simplest method would be to reindex your old data into a new system and once there add a new streamID of those reindexed messages to make them searchable within your cluster. Hopefully this option is available on the version of Elastic you are using.

3

Hello,
I’ll keep you posted on my progress.
In the end, as a first step, I set up a Debian 10 with Graylog 3.
I was able to import my snapshot and my indexes are ok.
question, since version 3, what is the best way to upgrade?
thanks.

4

@threepwood

Check the upgrade matrix here and ensure when moving between versions at least the minimum dependencies are being met.

When upgrading ensure you go between minor versions of Graylog and at each upgrade start the Graylog service and ensure the data is available.

Depending on the version of Elastic you are on there could be issues with indices created in older versions being compatible in a newer version.