# Update 2.4.7 to 4.0

**URL:** https://community.graylog.org/t/update-2-4-7-to-4-0/19911
**Category:** Graylog Central (peer support)
**Created:** [May 20, 2021, 11:49am UTC](https://community.graylog.org/t/update-2-4-7-to-4-0/19911 "2021-05-20T11:49:39Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![sing](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@sing](https://community.graylog.org/u/sing)
#### Post date: [May 20, 2021, 11:49am UTC](https://community.graylog.org/t/update-2-4-7-to-4-0/19911/1 "2021-05-20T11:49:39Z")

</div>

Hello, Is it possible to update version 2.4.7 to 4.0 directly or it is necessary to install the other updates (3.0.0, 3.0.1 …)

How to retrieve the logs processed by graylog and sent to elasticsearch (if we are creating a new environment and want to import the old logs)

Thank you

---

<div class="post-metadata">

### Author: ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)
#### Post date: [May 20, 2021, 10:04pm UTC](https://community.graylog.org/t/update-2-4-7-to-4-0/19911/2 "2021-05-20T22:04:24Z")

</div>

@sing

Hello

> [@sing](#):
>
> Is it possible to update version 2.4.7 to 4.0

Yes, couple thing to keep in mind before upgrading.  
.  
Breaking changes  
[https://docs.graylog.org/en/4.0/pages/upgrade/graylog-4.0.html](https://docs.graylog.org/en/4.0/pages/upgrade/graylog-4.0.html)

Next beware of what needs to be installed for Graylog 4 and make your own accessment.

[https://docs.graylog.org/en/4.0/pages/installation.html](https://docs.graylog.org/en/4.0/pages/installation.html)

@aaronsachs explains this well.

> [@Upgrade Graylog 2.4 to 4.x](https://community.graylog.org/t/upgrade-graylog-2-4-to-4-x/19593/3):
>
> Hey there @linden06 wave I’ll confirm that @reimlima is correct. Between the OS dependencies and the fact that you’re jumping two major versions, it’s easier to stand up a new Graylog stack and import the logs than it would be to try and get your stack upgraded piece by piece. I’ll note that given you’re upgrading major versions, each major version would include some sort of breaking change, as is the case with most projects that use semantic versioning. Consider this: in order to go from 2.…

To be honest since you have much older version it almost would make sence to create a new graylog server if you can.

> [@sing](#):
>
> How to retrieve the logs processed by graylog and sent to elasticsearch (if we are creating a new environment and want to import the old logs)

There are a couple ways to deal with this issue.  
One way we done this was, since were using a Virtual machine we created another Graylog server and pointed all our clients to the new server. Since we only retain logs for 90 days we kept our old graylog server until the 90 days were up. Then just turned off the virtual machine, NOTE: we didnt delete it, just turned it off and archived the whole server.

Second way would be is elasticsearch snapshot, and mongodb dump then transfer to the new server.

> **[mongodump — MongoDB Database Tools](https://www.mongodb.com/docs/database-tools/mongodump/)**

> **[Snapshot and restore | Elasticsearch Guide \[8.11\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/snapshot-restore.html)**

Correct me if I’m wrong, but I believe that when you transfer Elasticsearch snapshot to the new server they have to be the same version.

This is time consuming and issues might occur, and all I can say is make sure you have Backups 🙂

Those are the two basic ways I know how, maybe someone here has a different way of doing it.

Hope that helps

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)
#### Post date: [June 3, 2021, 10:04pm UTC](https://community.graylog.org/t/update-2-4-7-to-4-0/19911/3 "2021-06-03T22:04:48Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
