# Unsure on upgrading from Graylog 4.2.12 to Graylog 4.3.X

**URL:** https://community.graylog.org/t/unsure-on-upgrading-from-graylog-4-2-12-to-graylog-4-3-x/25309
**Category:** Graylog Central (peer support)
**Tags:** documentation
**Created:** [August 16, 2022, 11:56am UTC](https://community.graylog.org/t/unsure-on-upgrading-from-graylog-4-2-12-to-graylog-4-3-x/25309 "2022-08-16T11:56:37Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Arie](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/arie/32/8094_2.png) [@Arie](https://community.graylog.org/u/Arie)
#### Post date: [August 16, 2022, 11:56am UTC](https://community.graylog.org/t/unsure-on-upgrading-from-graylog-4-2-12-to-graylog-4-3-x/25309/1 "2022-08-16T11:56:37Z")

</div>

**Our question**

We are running Graylog Open and Enterprise in a reasonable standard singel node setup and want to upgrade to the 4.3.x branch. Due to the documentation we are little unsure what to do to upgrade, and if we can jump straight tot the latest 4.3 version.

installation documentation still points to 4.2:

```auto
sudo rpm -Uvh https://packages.graylog2.org/repo/packages/graylog-4.2-repository_latest.rpmsudo yum install graylog-server graylog-enterprise-plugins graylog-integrations-plugins graylog-enterprise-integrations-plugins

```

And we think that we should do something here to upgrade the pointer to the repo as mentioned here:  
[Operating System Packages - Installing Graylog](https://docs.graylog.org/docs/operating-system-packages)  
And the first check if the updates are visible (yum check-update)

As we understand some changes need to be made to the server.conf file as mentioned here:  
[Upgrading to Graylog 4.3.x - Upgrading Graylog](https://docs.graylog.org/docs/upgrading-to-graylog-43x)

Is changing the repo’s, updating to the latest 4.3.x and making the small adjustments to server.conf adequate for us, we do not want to harm our environment 😉

**our environment:**

- OS Information: Rocky Linux 8

- Package Version:Graylog 4.2.12 / Elasticsearch 7.10.2

Any advice would be appreciated.

our unsureness arises due to the information here, pointing to multiple directions  
[Upgrading to Graylog 4.3.x - Upgrading Graylog](https://docs.graylog.org/docs/upgrading-to-graylog-43x))

Arie

---

<div class="post-metadata">

### Author: ![H2Cyber](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/h2cyber/32/12536_2.png) [@H2Cyber](https://community.graylog.org/u/H2Cyber)
#### Post date: [August 17, 2022, 4:40pm UTC](https://community.graylog.org/t/unsure-on-upgrading-from-graylog-4-2-12-to-graylog-4-3-x/25309/2 "2022-08-17T16:40:20Z")

</div>

I have upgraded my environment (Ubuntu) using DEB packages and APT from 4.2 to 4.3 with minor issues which got progressively resolved in the `4.3.X` minor releases. As far as I remember I did not have to change configs in `server.conf`.

One thing to note : the pre-flight checks, introduced in 4.3, might stop your Graylog service from running. Pre-flight checks and other notable changes are documented in the [release notes](https://docs.graylog.org/docs/changelog).

Overall I would recommend upgrading, but cannot guarantee it would be flawless for your environment.

---

<div class="post-metadata">

### Author: ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)
#### Post date: [August 17, 2022, 11:29pm UTC](https://community.graylog.org/t/unsure-on-upgrading-from-graylog-4-2-12-to-graylog-4-3-x/25309/3 "2022-08-17T23:29:04Z")

</div>

Adding on to @H2Cyber ,

If you using GeoIP the field names have change.

> <https://github.com/Graylog2/graylog2-server/issues/13203>
>
> After upgrading to \`4.3.1\`, I noticed that the field names for geo-located-IPs h…ave changed from :
> 
> \`\`\`
> src\_city\_name
> src\_country\_code
> src\_geolocation
> \`\`\`
> 
> to :
> 
> \`\`\`
> src\_geo\_city
> src\_geo\_coordinates
> src\_geo\_country
> src\_geo\_country\_iso
> src\_geo\_name
> src\_geo\_region
> src\_geo\_timezone
> \`\`\`
> 
> I have therefore went throught all my event definitions, dashboards and views to update the field names. 
> 
> Now, and after upgrading to \`4.3.4\`, it seems the old field names are being reused again, so I am back from :
> 
> \`\`\`
> src\_geo\_city
> src\_geo\_coordinates
> src\_geo\_country
> src\_geo\_country\_iso
> src\_geo\_name
> src\_geo\_region
> src\_geo\_timezone
> \`\`\`
> 
> to :
> 
> \`\`\`
> src\_city\_name
> src\_country\_code
> src\_geolocation
> \`\`\`
> 
> I guess I'll have no choice but to revert the changes I've done previousely on all event definitions, dashboards and views that used the new field names.
> 
> Meanwhile, and to avoid this back and forth for other users, can we please have an extra option in the Geo-Location Processor that lets the user decide which format to use (legacy vs new) ?

---

<div class="post-metadata">

### Author: ![H2Cyber](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/h2cyber/32/12536_2.png) [@H2Cyber](https://community.graylog.org/u/H2Cyber)
#### Post date: [August 18, 2022, 8:17am UTC](https://community.graylog.org/t/unsure-on-upgrading-from-graylog-4-2-12-to-graylog-4-3-x/25309/4 "2022-08-18T08:17:38Z")

</div>

Indeed, but the changes in geo field names were rolled back in 4.3.5. So there should be no change or impact with this regard for those going from 4.2. to 4.3.5.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)
#### Post date: [September 1, 2022, 8:18am UTC](https://community.graylog.org/t/unsure-on-upgrading-from-graylog-4-2-12-to-graylog-4-3-x/25309/5 "2022-09-01T08:18:34Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
