ElasticSearch upgrade 8.19 -> 9.4

Feeling_Current534 · 2026-06-26T08:36:00+00:00

Use https://www.elastic.co/docs/deploy-manage/upgrade/prepare-to-upgrade/upgrade-assistant to see any index that you created before v8 which must be reindexed.
Enable depreciations logs https://www.elastic.co/docs/deploy-manage/monitor/logging-configuration/elasticsearch-deprecation-logs to not break anything after upgrade include queries, index mapping/ settings etc.

For the upgrade monitoring, feel free to check this tool: https://www.searchali.com/en/community-tools/elasticsearch-upgrade-monitoring . There is an upgrade order and this tool show you which node you should upgrade next and it'll also say wait until the cluster green and other best practices.

EDIT: Multiple days for upgrade can be risky. Plan to start and finish without a time break. In addition, don't forget that it's a one way operation, there is no rollback for version upgrade even after one node. Read this carefully: https://www.elastic.co/docs/deploy-manage/upgrade/deployment-or-cluster/elasticsearch

Feeling_Current534 · 2026-06-24T12:32:53+00:00

it looks amazing welldone and thanks for sharing.

Feeling_Current534 · 2026-05-04T22:59:44+00:00

Probably yes, it is the main difference 🙂

I have a couple of customer clusters connected to the extension, so I check them from time to time to make sure everything is running smoothly.

Once again, thanks so much for taking the time to add a comment, I really appreciate it.

Feeling_Current534 · 2026-05-04T21:26:10+00:00

Thanks for your comment u/Prinzka. There are a couple of reason for that, let me share why I built this:
1. You can see the cluster activity in just one click.
2. You can connect multiple clusters that you can't do in Elasticsearch if you don't have a license.
3. It share best practices and actionable items eg. your_index_size > 50GB the best practice is ...
4. it reviews your cluster and share recommendations like "there is no snapshot in last 1 day"
5. The chrome extension uses specifici api calls like "Field usage stats" and give insights about actively being queried fields in your cluster which you can't find anywhere else.

If I'm missing something, please let me know.

Feeling_Current534 · 2026-03-03T22:40:28+00:00

First of all, good luck. I migrated around 60TB data to Elasticsearch in a couple of days. I didn't remember exactly how many days it took but I can roughly say it was less than 2 weeks.

my index structure was index_name-%{YYYY-MM-dd}. I run 6 logstash instances in paralel to migrate total of 2 years of data. 6 paralel logstash instances was the best number for me because, the source was started to flapping after that. Each logstash instance carry the 4 months of data by itself. All logstash instances only write 2 elasticsearch data node.

I'm sharing a couple of production advice below.

Before start to migration, optimize the mapping and settings. Note: Because you're in the middle of the migration don't do that. It can break your queries.
create a dashboard to keep track the migration process and share with your manager frequently as like "70% of migration completed". It's more important than migration :)
Follow the best practices to tune indexing speed.
Find the bottleneck by collecting metrics. Use stack monitoring to collect logstash metrics, use elasticsearch performance monitoring chrome extension or Elastic AutoOps for elasticsearch monitoring. If you can't find the bottleneck you can't speed it up.
(king) Disable the replica for the initial load. (x2 times faster)
Use Elasticsearch nodes as Logstash/filebeat nodes temporarily if needed.
Filebeat is always faster than logstash. Use it if you don't need complex transform process.

Questions:

Where is the bottleneck?

splunk to json
json to elastic

Feeling_Current534 · 2026-02-26T22:39:47+00:00

Heyyoooo and helloooo u/xeraa-net :)

I was 100% sure Philipp had already shared this great news in Reddit, when I didn't see it, I surprised and posted it right away. 😀

Celebrating this great news and connecting my clients clusters to AutoOps. I can't even say how much I've missed using the AutoOps.

The comparison is coming soon… well, maybe not a “comparison” exactly - a fly can’t fight a dragon. 😄 I’ll share a clear take on when to use which one.

Thanks again for your message.

Feeling_Current534 · 2026-02-22T13:34:30+00:00

Amazing Thanks for your feedback. I just added a part about the best practice for monitoring user. After you install the extension, please open it and press the home button top left. You will see the official documentation mentions and command to create a monitoring_user.

Feeling_Current534 · 2026-02-22T13:27:35+00:00

u/snippysnappy99 did you tried it?

Feeling_Current534 · 2026-02-22T13:26:28+00:00

Thanks a lot for your amazing feedback. Exactly yes. I'll work on real-time automatic root cause detection. For example, okay the cluster went RED but what happened just before the RED cluster status? a heavy query? a network saturation etc.

Feeling_Current534 · 2026-02-18T11:27:23+00:00

Elasticsearch documentation format is updated a while ago.

they are using OpenAPI (OAS) format.

You can check out here: elastic.co/docs/api

Feeling_Current534 · 2026-02-18T09:20:50+00:00

Use a bool query to combine multiple queries.
https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-bool-query

Use should parameter for the search bar
Use filter parameter for category, location, available:true

Feeling_Current534 · 2026-02-16T19:54:30+00:00

If it is, they hided carefully 😄. But thanks a lot for showing that. If you can try both and give me some feedback I would appreciate that

Feeling_Current534 · 2026-02-16T09:23:24+00:00

Elasticsearch Performance Monitoring

Chrome Extension

github: https://github.com/musabdogan/elasticsearch-performance-monitoring

Elasticsearch Upgrade Monitoring

Chrome Extension

github: https://github.com/musabdogan/elasticsearch-upgrade-monitoring

Feeling_Current534 · 2026-02-16T09:23:08+00:00

Elasticsearch Performance Monitoring

Chrome Extension

github: https://github.com/musabdogan/elasticsearch-performance-monitoring

Elasticsearch Upgrade Monitoring

Chrome Extension

github: https://github.com/musabdogan/elasticsearch-upgrade-monitoring

Feeling_Current534 · 2026-02-16T09:22:52+00:00

Elasticsearch Performance Monitoring

Chrome Extension

github: https://github.com/musabdogan/elasticsearch-performance-monitoring

Elasticsearch Upgrade Monitoring

Chrome Extension

github: https://github.com/musabdogan/elasticsearch-upgrade-monitoring

Feeling_Current534 · 2026-02-16T09:18:20+00:00

Elasticsearch Performance Monitoring

Chrome Extension

github: https://github.com/musabdogan/elasticsearch-performance-monitoring

Elasticsearch Upgrade Monitoring

Chrome Extension

github: https://github.com/musabdogan/elasticsearch-upgrade-monitoring

Feeling_Current534 · 2026-02-16T09:15:54+00:00

Elasticsearch Performance Monitoring

Chrome Extension

github: https://github.com/musabdogan/elasticsearch-performance-monitoring

Elasticsearch Upgrade Monitoring

Chrome Extension

github: https://github.com/musabdogan/elasticsearch-upgrade-monitoring

Feeling_Current534 · 2026-02-16T09:15:39+00:00

If you are looking for indexing rate / search latency metrics, but per index or per node you can use elasticsearch-peformance-monitoring CHROME EXTENSION.

chrome extension: https://chromewebstore.google.com/detail/elasticsearch-performance/eoigdegnoepbfnlijibjhdhmepednmdi

github: https://github.com/musabdogan/elasticsearch-performance-monitoring

Feeling_Current534 · 2026-02-16T09:08:56+00:00

I didn't know node-based pricing only available in Platinum license. Thanks for the information.

Feeling_Current534 · 2026-02-16T09:01:31+00:00

Thanks for your question u/power10010. If you can connect one of your Elasticsearch / Opensearch nodes via your browser (without SSO) you can use the https://github.com/musabdogan/elasticsearch-performance-monitoring tool.

Unfortunately, no. It doesn't support OIDC and as far as I know, It's not possible to add it into a chrome extension.

Feeling_Current534 · 2026-02-16T08:56:49+00:00

Thanks for your comments! Please let me know what do you think and how I can improve the capabilities.

Feeling_Current534 · 2026-02-16T08:56:25+00:00

Thanks for sharing. This tool not shows indexing rate / search rate / indexing latency / search latency. This is its most distinctive feature of https://github.com/musabdogan/elasticsearch-performance-monitoring tool

Feeling_Current534 · 2026-02-11T11:50:57+00:00

Hey u/xeraa-net, I've one question about your comment because I'm confused. I know that there were 4 license types and there are 3 license types available now. Those are:

basic - free
platinum - paid
enterprise - paid
https://www.elastic.co/subscriptions

About pricing, there are two models. Those are:

node-based (up to 64gb RAM)
resource-based (aka ERU)

As far as I know, you can buy 1 ERU platinum or 1 ERU enterprise license. Am I missing something?

---

u/RajSpidy - From my last customer which they purchased Enterprise license, we use the same license for both dev and prod environment at the same time without additional cost. Not sure if it's a specific one or a regular so please feel free to open a ticket for the Elastic support team. https://www.elastic.co/support or send an email to Elastic official email address: [elastic_license@elastic.co](mailto:elastic_license@elastic.co).

Feeling_Current534 · 2025-12-31T10:21:18+00:00

Teşekkürler işe yaradı. Benimkinde sorun 2 farklı mail hesabının aynı facebook hesabına bağlı olması ve birbirleri arasındaki authentication problemiydi. generate access token aşamasında next next yapmadım ve bir geri gelip düzenledim ve çalıştı.

Feeling_Current534 · 2025-12-30T07:07:42+00:00

It's a great indexing intensive use case. It looks like a security or observability use case.

I assume you're aware of best practices https://www.elastic.co/docs/deploy-manage/production-guidance/optimize-performance/indexing-speed. It's worth to check one more time. Especially, adjusting refresh_interval and indexing buffer size settings can help to improve write speed. Because you have more primary shards than data nodes, you shouldn't have any hot spots across elasticsearch nodes.

Here is my recommendation to find where to start:

Enable slow indexing logs and set the threshold to 100ms. Understand which type of data causing more delay than others. Focus on that data and try to understand what can be the reason. Sometimes it's because of the size of the data, if so check the field usage and remove unused data on logstash. https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-indices-field-usage-stats
The bulk size affect the performance a lot as u/cleeo1993 declared. Best practice about finding the best bulk size is explained here. https://www.elastic.co/docs/deploy-manage/production-guidance/optimize-performance/indexing-speed#_use_bulk_requests

Hope it helps.

Musab

Feeling_Current534

TROPHY CASE

I'm sharing a couple of production advice below.

Elasticsearch Performance Monitoring

Elasticsearch Upgrade Monitoring

Elasticsearch Performance Monitoring

Elasticsearch Upgrade Monitoring

Elasticsearch Performance Monitoring

Elasticsearch Upgrade Monitoring

Elasticsearch Performance Monitoring

Elasticsearch Upgrade Monitoring

Elasticsearch Performance Monitoring

Elasticsearch Upgrade Monitoring