Upgrade of Elasticsearch and deprecation


I want to upgrade my Graylog Elasticsearch cluster from 5.6 to the latest 6.x. I am finding two errors in my deprecation log for Elasticsearch

Error #1
[2019-01-07T13:36:59,877][WARN ][o.e.d.e.NodeEnvironment ] ES has detected the [path.data] folder using the cluster name as a folder [/data], Elasticsearch 6.0 will not allow the cluster name as a folder within the data path

I believe this is because my cluster name is graylog and my path is /data/graylog/nodes. I see in the Elasticsearch documentation I could move the data and then change path.data elasticsearch.yml, but it currently points at /data. So, how would I get rid of the graylog in the path?

Error #2
[2019-01-07T13:24:41,667][WARN ][o.e.d.i.m.TypeParsers ] Expected a boolean [true/false] for property [index] but got [not_analyzed]

I saw another post which said this is a known issue, and it will be fixed. It sounds like this is not supported in 6.x, however. Will this get fixed?

Thank you,



please look at the breaking changes of Elasticsearch for your question #1


The question #2 can be answered with - yes if the reason for the message is the same.

Hi Jan,

Thank you for your reply. To clarify, currently I have in elasticsearch.yml:

path.data = /data

Error message #1 is appearing in the deprecation log. To fix this problem before upgrade, am I supposed to move my Elasticsearch files from /data/graylog/nodes to /data/graylog? So, the process would be:

  1. Stop Elasticsearch and Graylog
  2. Move the files from /data/graylog/nodes to /data/nodes.
  3. Upgrade to Elasticsearch 6.x
  4. Start Elasticsearch and Graylog again.
  5. No changes to path.data are needed.

For issue #2, do I have to wait for the fix to be made by Graylog developers? Is there a pull request for this issue?

Thank you!


If you do that one ES node at a time, there is no need to stop Graylog.

If I remember correctly, ES5.6 already does that in the new way, so you can clean up the directory structure before update and still use ES5.6, until you are otherwise ready.

when you have currently path.data = /data why not just change that to /data/graylog/ in the 6.x configuration and no need to move any data …

for your second question - yes, it should but i’ll not drill that down for you, please look into the closed prs yourself.


This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.