Elasticsearch 6.x升级7.x 版本的注意事项及填坑

根据部署方式不同存在不同升级方式，目前有两种

• laradock部署的搜索引擎版本升级
• AWS的搜索服务版本升级

一、laradock部署的搜索引擎版本升级

1. 升级到 6.8.13
   1.1 elasticsearch/Dockerfile、kibana/Dockerfile 的版本号修改为 6.8.13
   1.2 docker-compose.yml 注释掉 elasticsearch 两个配置项：node.name=laradock-node 和 cluster.initial_master_nodes=laradock-node
   1.3 构建 elasticsearch、kibana 容器 docker-compose build --no-cache elasticsearch kibana，并启动 docker-compose up -d elasticsearch kibana
   1.4 浏览器输入地址 localhost:5601 进入kibana管理界面，找到菜单 Management -> 7.0 Upgrade Assistant 依次解决列出这些问题：
   

• 删除 .watches 索引

• docker-compose.yml 的 ealsticsearch 增加配置项：

- node.name=laradock-node
- cluster.initial_master_nodes=laradock-node
- logger.deprecation.level=warn

• 重建列出的索引

2. 升级到 7.9.3
   1.1 elasticsearch/Dockerfile、kibana/Dockerfile 的版本号修改为 7.9.3
   1.2 构建 elasticsearch、kibana 容器 docker-compose build --no-cache elasticsearch kibana，并启动 docker-compose up -d elasticsearch kibana

二、AWS搜索服务升级

帮助文档：Elasticsearch升级

三、QAQ 各类问题及解决

• 升级到6.x版本后，账号密码：elastic changeme 使用不了
  原因：6.x版本之后 elastic 默认的密码不再是 changeme

解决方法:

1 进入elasticsearch 容器 docker-compose exec elasticsearch bash

2 重置密码 elasticsearch-setup-passwords interactive

3 设置成自己的密码

• kibana 容器启动不了，报错 PollError [security_exception] missing authentication token

{"type":"log","@timestamp":"2021-01-08T06:20:56Z","tags":["warning","task_manager"],"pid":1,"message":"PollError [security_exception] missing authentication token for REST request [/_template/.kibana_task_manager?include_type_name=true&filter_path=*.version], with { header={ WWW-Authenticate=\"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\" } }"}
{"type":"log","@timestamp":"2021-01-08T06:20:58Z","tags":["license","warning","xpack"],"pid":1,"message":"License information from the X-Pack plugin could not be obtained from Elasticsearch for the [data] cluster. [security_exception] missing authentication token for REST request [/_xpack], with { header={ WWW-Authenticate=\"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\" } } :: {\"path\":\"/_xpack\",\"statusCode\":401,\"response\":\"{\\\"error\\\":{\\\"root_cause\\\":[{\\\"type\\\":\\\"security_exception\\\",\\\"reason\\\":\\\"missing authentication token for REST request [/_xpack]\\\",\\\"header\\\":{\\\"WWW-Authenticate\\\":\\\"Basic realm=\\\\\\\"security\\\\\\\" charset=\\\\\\\"UTF-8\\\\\\\"\\\"}}],\\\"type\\\":\\\"security_exception\\\",\\\"reason\\\":\\\"missing authentication token for REST request [/_xpack]\\\",\\\"header\\\":{\\\"WWW-Authenticate\\\":\\\"Basic realm=\\\\\\\"security\\\\\\\" charset=\\\\\\\"UTF-8\\\\\\\"\\\"}},\\\"status\\\":401}\",\"wwwAuthenticateDirective\":\"Basic realm=\\\"security\\\" charset=\\\"UTF-8\\\"\"}"}

解决方法:

1 进入 kibana 容器 docker-compose exec kibana bash

2 修改配置文件 vi config/kibana.yml

3 增加 elasticsearch 账号密码配置：elasticsearch.username: elastic 和
elasticsearch.password: changeme

4 重启 kibana容器 docker-compose restart kibana

• kibana容器启动报错 FATAL Error: Index .kibana belongs to a version of Kibana that cannot be automatically migrated. Reset it or use the X-Pack upgrade assistant.

解决方法:

1 进入 workspace 容器 docker-compose exec workspace bash后删除 .kibana 索引 curl -XDELETE -u elastic:changeme 'http://elasticsearch:9200/.kibana'

3 重启kibana容器 docker-compose restart kibana

• 删除 .watches 索引时报错 This endpoint is not supported for DELETE on .watches index.

解决方法: 如何删除 .watches 索引

1 docker-compose.yml 增加配置项：xpack.watcher.index.rest.direct_access=true

2 重启 elasticsearch 容器 docker-compose restart elasticsearch

3 进入 workspace 容器 docker-compose exec workspace bash 后删除 .watches 索引 curl -XDELETE -u elastic:changeme 'http://elasticsearch:9200/.watches'

4 docker-compose.yml 删除配置项：xpack.watcher.index.rest.direct_access=true

5 重启 elasticsearch 容器 docker-compose restart elasticsearch

• 构建 elasticsearch 容器时报错 failed to read local state

解决方法：

1 删除 elasticsearch 的 数据卷 docker volume rm laradock_elasticsearch

2 重新构建 elasticsearch 容器 docker-compose build --no-cache elasticsearch