Hey @Arethusa, you can upgrade elasticsearch with Graylog online. While the ES service is restarted for the upgrade messages will queue in the Graylog buffers / disk queue.
anyone upgrading to ES 7 should read the ES 7 Upgrade notes in the Graylog documentation and make sure your indices are all at least 6.0 indices. If you don’t run the check before because you assume you have all 6.0 indices and you upgrade, elasticsearch will check prior to starting and will fail to start with an error that will require you to “downgrade” reindex and then upgrade. And technically there is no way to downgrade Elasticsearch.