Upgrade from 5.2 to 6.0 Fails

Graylog Central (peer support)
1

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident: Upgrade from 5.2 to 6.X/7.X fails

Used article: Upgrade Graylog on Ubuntu

Error:

2026-07-27T13:45:56.471-04:00 INFO [ImmutableFeatureFlagsCollector] Following feature flags are used: {default properties file=[frontend_hotkeys=on, field_types_management=on, cloud_inputs=on, data_tiering_cloud=off, scripting_api_preview=on, composable_index_templates=off, search_filter=on, preflight_web=on, data_node_migration=off, instant_archiving=off]}
2026-07-27T13:45:56.971-04:00 INFO [CmdLineTool] Loaded plugin: AWS plugins 6.0.14+508aa86 [org.graylog.aws.AWSPlugin]
2026-07-27T13:45:56.972-04:00 INFO [CmdLineTool] Loaded plugin: Integrations 6.0.14+508aa86 [org.graylog.integrations.IntegrationsPlugin]
2026-07-27T13:45:56.972-04:00 INFO [CmdLineTool] Loaded plugin: Threat Intelligence Plugin 6.0.14+508aa86 [org.graylog.plugins.threatintel.ThreatIntelPlugin]
2026-07-27T13:45:56.972-04:00 INFO [CmdLineTool] Loaded plugin: Elasticsearch 7 Support 6.0.14+508aa86 [org.graylog.storage.elasticsearch7.Elasticsearch7Plugin]
2026-07-27T13:45:56.973-04:00 INFO [CmdLineTool] Loaded plugin: OpenSearch 2 Support 6.0.14+508aa86 [org.graylog.storage.opensearch2.OpenSearch2Plugin]

Jul 27 10:33:50 autlxappslog1p graylog-server[520622]: Exception in thread "main" java.lang.NullPointerException: Cannot invoke "org.graylog2.featureflag.FeatureFlags.isOn(String)" because "this.featureFlags" is null
Jul 27 10:33:50 autlxappslog1p graylog-server[520622]: at org.graylog.storage.elasticsearch7.Elasticsearch7Plugin.modules(Elasticsearch7Plugin.java:45)
Jul 27 10:33:50 autlxappslog1p graylog-server[520622]: at org.graylog2.shared.plugins.PluginLoader$PluginAdapter.modules(PluginLoader.java:169)
Jul 27 10:33:50 autlxappslog1p graylog-server[520622]: at org.graylog2.bootstrap.CmdLineTool.lambda$installPluginConfig$2(CmdLineTool.java:370)
Jul 27 10:33:50 autlxappslog1p graylog-server[520622]: at java.base/java.util.stream.ReferencePipeline$7$1.accept(Unknown Source)
Jul 27 10:33:50 autlxappslog1p graylog-server[520622]: at java.base/java.util.HashMap$KeySpliterator.forEachRemaining(Unknown Source)
Jul 27 10:33:50 autlxappslog1p graylog-server[520622]: at java.base/java.util.stream.AbstractPipeline.copyInto(Unknown Source)
Jul 27 10:33:50 autlxappslog1p graylog-server[520622]: at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(Unknown Source)
Jul 27 10:33:50 autlxappslog1p graylog-server[520622]: at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(Unknown Source)
Jul 27 10:33:50 autlxappslog1p graylog-server[520622]: at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(Unknown Source)
Jul 27 10:33:50 autlxappslog1p graylog-server[520622]: at java.base/java.util.stream.AbstractPipeline.evaluate(Unknown Source)
Jul 27 10:33:50 autlxappslog1p graylog-server[520622]: at java.base/java.util.stream.ReferencePipeline.forEach(Unknown Source)
Jul 27 10:33:50 autlxappslog1p graylog-server[520622]: at org.graylog2.bootstrap.CmdLineTool.installPluginConfig(CmdLineTool.java:372)
Jul 27 10:33:50 autlxappslog1p graylog-server[520622]: at org.graylog2.bootstrap.CmdLineTool.doRun(CmdLineTool.java:299)
Jul 27 10:33:50 autlxappslog1p graylog-server[520622]: at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:267)
Jul 27 10:33:50 autlxappslog1p graylog-server[520622]: at org.graylog2.bootstrap.Main.main(Main.java:55)
Jul 27 10:33:50 autlxappslog1p systemd[1]: graylog-server.service: Main process exited, code=exited, status=1/FAILURE
Jul 27 10:33:50 autlxappslog1p systemd[1]: graylog-server.service: Failed with result 'exit-code'.
Jul 27 10:33:50 autlxappslog1p systemd[1]: graylog-server.service: Consumed 2.383s CPU time.

2. Describe your environment:

  • OS Information: Ubuntu 22.04.5 LTS

  • Package Version: Graylog 6.0.14 | MongoDB 7.0.39 | Opensearch 2.14.0

  • Service logs, configurations, and environment variables: Basic installation

3. What steps have you already taken to try and solve the problem?

Google searching.

Updated MongoDB from v6 to v7. Updated “compatflags”.
{ featureCompatibilityVersion: { version: '7.0' }, ok: 1 }

Roll back to 5.2, restore backups, and everything works fine.

Upgrade to 6.0 again, and fails with the same error.

Compared my initial-build 5.2 server.conf to the default 6.0 server.conf to ensure no critical changes (none).

Compared my 5.2 /etc/default/graylog-server to the default 6.0, no noticeable changes.

OpenSearch is running:
{
"name" : "autlxappslog1p",
"cluster_name" : "graylog",
"cluster_uuid" : "_2qDos10QzOEfgSj0Pqpeg",
"version" : {
"distribution" : "opensearch",
"number" : "2.14.0",
"build_type" : "deb",
"build_hash" : "aaa555453f4713d652b52436874e11ba258d8f03",
"build_date" : "2024-05-09T18:50:48.052504416Z",
"build_snapshot" : false,
"lucene_version" : "9.10.0",
"minimum_wire_compatibility_version" : "7.10.0",
"minimum_index_compatibility_version" : "7.0.0"
},
"tagline" : "The OpenSearch Project"
}

4. How can the community help?

Looking for a solution to the issue, not sure where to start.

Figured that it would be a plugin, but I can’t find any direction here.

Thank you,

Jonathan

2

I did make some changes to the /etc/default/graylog-server file. It had no effect.

# Path to a custom java executable. By default the java executable of the
# bundled JVM is used.
#JAVA=/usr/bin/java

# Default Java options for heap and garbage collection.
#GRAYLOG_SERVER_JAVA_OPTS="-Xms1g -Xmx1g -server -XX:+UseG1GC -XX:-OmitStackTraceInFastThrow"
GRAYLOG_SERVER_JAVA_OPTS="-Xms1g -Xmx6g -XX:+UseG1GC -XX:-OmitStackTraceInFastThrow"

# Avoid endless loop with some TLSv1.3 implementations.
GRAYLOG_SERVER_JAVA_OPTS="$GRAYLOG_SERVER_JAVA_OPTS -Djdk.tls.acknowledgeCloseNotify=true"

# Fix for log4j CVE-2021-44228
GRAYLOG_SERVER_JAVA_OPTS="$GRAYLOG_SERVER_JAVA_OPTS -Dlog4j2.formatMsgNoLookups=true"

# Additional variables found at https://community.graylog.org/t/graylog7-0-unable-to-access/36781/2
GRAYLOG_SERVER_JAVA_OPTS="$GRAYLOG_SERVER_JAVA_OPTS -Dlog4j.configurationFile=file:///etc/graylog/server/log4j2.xml -Dgraylog2.installation_source=deb"

# Pass some extra args to graylog-server. (i.e. "-d" to enable debug mode)
GRAYLOG_SERVER_ARGS=""

# Program that will be used to wrap the graylog-server command. Useful to
# support programs like authbind.
GRAYLOG_COMMAND_WRAPPER=""
3

Solved myself, thanks to AI.

Purge Legacy Plugin Jars (For Bare-Metal/Package Installs)

If you already upgraded your database to OpenSearch/ES8 but are still getting this error, Graylog’s plugin directory contains lingering legacy files from your previous Graylog 5.x/4.x installations.

  1. Navigate to your Graylog plugins folder:

    bash

    cd /usr/share/graylog-server/plugin/

Discovered two sets of files in the folder, moved the older set out, and service fired right up.

/usr/share/graylog-server/plugin$ ls -las
total 132836
4 drwxr-xr-x 2 root root 4096 Jul 24 14:37 .
4 drwxr-xr-x 5 root root 4096 Jul 24 14:37 ..
28960 -rwxr-xr-x 1 root root 29652141 Jul 24 14:30 graylog-storage-elasticsearch7-5.2.6.jar
28960 -rw-r–r-- 1 root root 29652929 Apr 3 2025 graylog-storage-elasticsearch7-6.0.14.jar
39324 -rwxr-xr-x 1 root root 40265162 Jul 24 14:30 graylog-storage-opensearch2-5.2.6.jar
35584 -rw-r–r-- 1 root root 36435978 Apr 3 2025 graylog-storage-opensearch2-6.0.14.jar

4

Off to update to 6.1/6.2/6.3/7.0/7.1 – wish me luck!