Elasticsearch 7.0 can read indices created in version 6.0 or above. An Elasticsearch 7.0 node will not start in the presence of indices created in a version of Elasticsearch before 6.0.
https://www.elastic.co/guide/en/elasticsearch/reference/7.x/breaking-changes-7.0.html#_indices_created_before_7_0
Who could imagine what’s hiding behind this sentence ?
To be honest, we managed to support Elasticsearch 7.x pretty quickly ! But only for new and recent installations and instances — read, initially installed with Elasticsearch 6.x.
The harder part was ensure older instances, with indexes created with Elasticsearch 5.x, can migrate smoothly like for previous migrations: «stop the application, update the database software, update application and restart everything ». You might have to put your hands on the keyboard.
⚠️ TheHive 3.5.0-RC1 and Cortex 3.1.0-RC1 are not recommended for production use. These versions are intended for test only ; please, read carefully the full blog post and the associated documentation. Feel free to try it, try your migration and send us your feedbacks.
New and recent installations
If your instance has been initiated with Elasticsearch 6.x, you can follow the following process :
- Stop TheHive version 3.4.2
- Stop Elasticsearch version 6.x
- Update Elasticsearch configuration file
- Update Elasticsearch to version 7.x and restart the service
- Update TheHive and restart the service
- Update Cortex and restart the service
Instructions to install TheHive 3.5.0-RC1 or Cortex 3.1.0-RC1 can be found in this guide.
At this stage, connect TheHive and Cortex with your browser and you should be invited to update the database :
Older indexes
This is the tricky part. If you are using an instance initiated with Elasticsearch older that version 6.0, it is highly probable that you have to follow an heavier process to upgrade. In few words, you will have to :
- Stop TheHive and Cortex applications
- Create new indexes in Elasticsearch 6.x with part of the settings of your current indexes
- Do specific reindexing operations to this new indexes
- Delete old indexes.
How to identify if your index is ready for Elasticsearch 7
You can easily identify if indexes are ready for Elasticsearch 7. On the index named the_hive_15 run the following command:
curl -s http://127.0.0.1:9200/the_hive_15?human | jq '.the_hive_15.settings.index.version.created_string'
If the version is 6.x.x then the index will be read by Elasticsearch 7.8.x. Otherwise (version is 5.x.x of below), reindexing the index is required.
Migration guide
You are not left alone there. A dedicated documentation is available. It should help you run this specific actions on your Elasticsearch database, and also install or update application whether you are using DEB, RPM or binary packages, and even docker images :
How to report issues
Please open an issue on GitHub using the template made for TheHive 3.x if you’d like to report a bug on this version. We will monitor those closely and respond accordingly.
TheHive Project 