Opensearch compatibility version

[skunkwerks (dch)]

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:

My version of OpenSearch is apparently unsupported, but has been
in use for 6+ months. What should I do to address this?

The documentation is clear:

Warning: We caution you not to install or upgrade to OpenSearch 2.16+! It is not supported. Doing so will break your instance!

But my instance is not AFAICT broken in any meaningful way. Yet

2. Describe your environment:

• Package Version:

• Graylog 6.1.2, moving to 6.2.3
• OpenSearch 2.17

3. What steps have you already taken to try and solve the problem?

Nothing yet, this is rather concerning, so I am waiting for guidance.

This appears to have been functioning for months without problems. It’s a low-volume single server setup, with non-essential data at this point. It’s possible to drop it, and move to a supported version, but I would prefer not to, unless necessary.

4. How can the community help?

Is the original warning still valid?

If so, what does “breakage” actually mean, what should I look for in logs or problems?

Can I roll back my OpenSearch 2.17 to 2.10 or similar without issues?

Are there any plans to support Opensearch 3.0 (or any > 2.16 ? ) Yes - Bump OpenSearch to 2.19.0 by moesterheld · Pull Request #21537 · Graylog2/graylog2-server · GitHub & Support for Opensearch 3.x · Issue #22662 · Graylog2/graylog2-server · GitHub

[Joel_Duffield]

I believe our inability to support it was started by this [BUG] Range aggregation ignores query · Issue #15169 · opensearch-project/OpenSearch · GitHub then subsequent fixes didnt nessasarily work properly either, then there have also been timing issues around our release rimeline and theirs for what we can test.

Afaik none of the issues would cause data loss, they could cause things like false positives in alerts and some thing like that. If you arent seeing issues you may just not be using the effected features.

We should be supporting future versions its just a question of when that will be possible.

[skunkwerks (dch)]

thanks @Joel_Duffield I can imagine validation and testing this range of versions is really complex!

Should I roll back, or just stay with the OpenSearch version I currently have, then?

[Joel_Duffield]

Hard to say rollback can sometimes be tricky, if you aren’t seeing any issues I would probably stay put personally.

[drewmiranda-gl (Drew Miranda)]

to add some further context, the primary reason is that we consider compatibility across both Graylog and Graylog Data Node.

Currently Graylog Data node is using OpenSearch 2.15. Graylog Data Node has the ability to “import” existing OpenSearch data, but ONLY if the OpenSearch data was created with the same or earlier version. Using OpenSearch >=2.16 would prevent Graylog Data Node from reading these files.

Graylog also has to consider support with regards to all functionality that Graylog has that interacts with OpenSearch and that we’ve found several issues with versions like 2.14 and 2.16 and even 2.19.0.

All this to say, if 2.17.0 is working for you I wouldn’t worry too much about it. We will bump the OpenSearch version in Graylog Data Node likely this year (though don’t quote me on that)