Please see Breaking changes in Elasticsearch 2.0 for details.

The blog article Key points to be aware of when upgrading from Elasticsearch 1.x to 2.x also contains interesting information about the upgrade path from Elasticsearch 1.x to 2.x.

Multicast Discovery

Multicast discovery has been removed from Elasticsearch 2.x (although it is still provided as an Elasticsearch plugin for now).

To reflect this change, the elasticsearch_discovery_zen_ping_unicast_hostsnow has to contain the address of at least one Elasticsearch node in the cluster which Graylog can connect to.

Default Network Host

The network interface which Elasticsearch binds to (elasticsearch_network_host) has been changed to localhost (i. e. 127.0.0.1or ::1); see Network changes/Bind to localhost.

If Elasticsearch is not running on the same machine, elasticsearch_network_host
must be set to a host name or an IP address which can be accessed by the other Elasticsearch nodes in the cluster.

Index Range Types

Some Graylog versions stored meta information about indices in Elasticsearch, alongside the messages themselves. Since Elasticsearch 2.0 having multiple types with conflicting mappings is no longer possible, which means that the index_rangetype must be removed before upgrading to Elasticsearch 2.x.

Find out if your setup is affected by running (replace $elasticsearchwith the address of one of your Elasticsearch nodes) curl -XGET $elasticsearch:9200/_all/_mapping/index_range; echoIf the output is {}you are not affected and can skip this step.

Otherwise, you need to delete the index_rangetype, Graylog does not use it anymore.
As Graylog sets older indices to read-only, first we need to remove the write block on those indices. Since we’ll be working with Elasticsearch’s JSON output, we recommend installing the jqutility which should be available on all popular package managers or directly at GitHub.

for i in `curl -s -XGET $elasticsearch:9200/_all/_mapping/index_range | jq -r "keys[]"`; do    
    echo -n "Updating index $i: "    
    echo -n "curl -XPUT $elasticsearch:9200/$i/_settings -d '{\"index.blocks.read_only\":false, \"index.blocks.write\":false}' : "    
    curl -XPUT $elasticsearch:9200/$i/_settings -d '{"index.blocks.read_only":false, "index.blocks.write":false}'    
    echo
done

The output for each of the curl commands should be {"acknowledged":true}. Next we have to delete the index_rangemapping. We can perform this via the next command.

for i in `curl -s -XGET $elasticsearch:9200/_all/_mapping/index_range | jq -r "keys[]"`; do    
    echo -n "Updating index $i: "    
    curl -XDELETE $elasticsearch:9200/$i/index_range    
    echo
done

It is not strictly necessary to set the indices back to read only, but if you prefer to do that, note the index names and commands during the first step and change the falseinto true.

Graylog Index Template

Graylog applies a custom index template to ensure that the indexed messages adhere to a specific schema.

The index template being used by Graylog 1.x is incompatible with Elasticsearch 2.x and has to be removed prior to upgrading.

In order to delete the index template the following curl command has to be issued against on of the Elasticsearch nodes:

curl - X DELETE http://localhost:9200/_template/graylog-internal 

Graylog will automatically create the new index template on the next startup.

Dots in Field Names

One of the most important breaking changes in Elasticsearch 2.x is that field names may not contain dots anymore.

Using the Elasticsearch Migration Plugin might help to highlight some potential pitfalls if an existing Elasticsearch 1.x cluster should be upgraded to Elasticsearch 2.x.

MongoDB

MongoDB Version Compatibility

When upgrading from MongoDB 2.0 or 2.2 to a supported version, make sure to read the Release Notes for the particular version.

Log4j 2 Migration

Graylog switched its logging backend from Log4j 1.2 to Log4j 2.

Please refer to the Log4j Migration Guide for information on how to update your existing logging configuration.

Dead Letters Feature Removed

The Dead Letters feature, which stored messages that couldn’t be indexed into Elasticsearch for various reasons, has been removed.

This feature has been disabled by default. If you have enabled the feature the configuration file, please check the dead_letters_enabledcollection in MongoDB and remove it afterward.

Removed Configuration Settings

Index Retention and Rotation Settings

In 2.0.0 the index rotation and retention settings have been moved from the Graylog server config file to the database and are now configurable via the web interface.

The old settings from the graylog.confor /etc/graylog/server/server.confwill be migrated to the database.

Overview

Some settings, which have been deprecated in previous versions, have finally been removed from the Graylog configuration file.

Changed Configuration Defaults

For better consistency, the defaults of some configuration settings have been changed after the project has been renamed from Graylog2 to Graylog .

Changed Prefixes for Configuration Override

In the past it was possible to override configuration settings in Graylog using environment variables or Java system properties with a specific prefix.
For better consistency, these prefixes have been changed after the project has been renamed from Graylog2 to Graylog .

REST API Changes

The output ID key for the list of outputs in the /streams/*endpoints has been changed from _idto id.

{ 
    "id" : "564f47c41ec8fe7d920ef561" , 
    "creator_user_id" : "admin" , 
    "outputs" : [ 
        {  
            "id"  :   "56d6f2cce45e0e52d1e4b9cb"  ,   // ==> Changed from `_id` to `id`  
            "title" : "GELF Output" , 
            "type" : "org.graylog2.outputs.GelfOutput" , 
            "creator_user_id" : "admin" , 
            "created_at" : "2016-03-02T14:03:56.686Z" , 
            "configuration" : { 
                "hostname" : "127.0.0.1" , 
                "protocol" : "TCP" , 
                "connect_timeout" : 1000 , 
                "reconnect_delay" : 500 , 
                "port" : 12202 , 
                "tcp_no_delay" : false , 
                "tcp_keep_alive" : false , 
                "tls_trust_cert_chain" : "" , 
                "tls_verification_enabled" : false 
                }, 
                "content_pack" : null 
        } 
    ], 
"matching_type" : "AND" , 
"description" : "All incoming messages" , 
"created_at" : "2015-11-20T16:18:12.416Z" , 
"disabled" : false , "rules" : [], 
"alert_conditions" : [], 
"title" : "ALL" , 
"content_pack" : null 
} 

Web Interface Config Changes

The web interface has been integrated into the Graylog server and was rewritten in React. Therefore, configuring it has changed fundamentally since the last version(s). Please consult Web interface for details.

Please take note that the application.contextconfiguration parameter present in Graylog 1.x (and earlier) is not existing anymore. The web interface can currently only be served without a path prefix.