From 502fb816b05236595e4018c4b6b7c73497aea78e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=C3=81lex=20Ruiz?= Date: Mon, 4 Mar 2024 09:02:04 +0100 Subject: [PATCH 1/2] Add step to the wazuh-indexer upgrade guide to remove old ss4o templates --- .../upgrade-guide/upgrading-central-components.rst | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/source/upgrade-guide/upgrading-central-components.rst b/source/upgrade-guide/upgrading-central-components.rst index be19a79eb2..ecf677a30a 100644 --- a/source/upgrade-guide/upgrading-central-components.rst +++ b/source/upgrade-guide/upgrading-central-components.rst @@ -62,17 +62,23 @@ Upgrading the Wazuh indexer To ensure compatibility with the latest Wazuh indexer and Wazuh dashboard, please update manually installed plugins accordingly. For additional information, check the `distribution matrix `__. -In the case of having a Wazuh indexer cluster with multiple nodes, the cluster will remain available throughout the upgrading process. This rolling upgrade allows shutting down one Wazuh indexer node at a time for minimal disruption of service. Repeat these steps for every Wazuh indexer node. - .. note:: - Replace ````, ````, and ```` before running the commands below. +When upgrading to Wazuh 4.8.0 or higher, remove the deprecated ss4o index templates. + + .. code-block:: bash + + curl -X DELETE "https://WAZUH_INDEXER_IP_ADDRESS:9200/_index_template/ss4o_*_template" -u : -k + +In the case of having a Wazuh indexer cluster with multiple nodes, the cluster will remain available throughout the upgrading process. This rolling upgrade allows shutting down one Wazuh indexer node at a time for minimal disruption of service. Repeat these steps for every Wazuh indexer node. + #. Disable shard allocation. .. code-block:: bash - curl -X PUT "https://:9200/_cluster/settings" -u : -k -H 'Content-Type: application/json' -d' + curl -X PUT "https://:9200/_cluster/settings" -u : -k -H 'Content-Type: application/json' -d' { "persistent": { "cluster.routing.allocation.enable": "primaries" From a6accefe1537223a8115972b62067a787b689d11 Mon Sep 17 00:00:00 2001 From: Javier Medeot Date: Mon, 4 Mar 2024 17:50:25 -0300 Subject: [PATCH 2/2] Add review changes --- .../upgrade-guide/upgrading-central-components.rst | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/source/upgrade-guide/upgrading-central-components.rst b/source/upgrade-guide/upgrading-central-components.rst index ecf677a30a..f293c95f8f 100644 --- a/source/upgrade-guide/upgrading-central-components.rst +++ b/source/upgrade-guide/upgrading-central-components.rst @@ -62,17 +62,15 @@ Upgrading the Wazuh indexer To ensure compatibility with the latest Wazuh indexer and Wazuh dashboard, please update manually installed plugins accordingly. For additional information, check the `distribution matrix `__. -.. note:: +In a Wazuh indexer cluster with multiple nodes, the cluster remains available throughout the upgrading process. This rolling upgrade allows shutting down one Wazuh indexer node at a time for minimal disruption of service. - - Replace ````, ````, and ```` before running the commands below. +As a first step, remove the *ss4o* index templates. Replace ````, ````, and ```` before running any command below. -When upgrading to Wazuh 4.8.0 or higher, remove the deprecated ss4o index templates. +.. code-block:: bash - .. code-block:: bash - - curl -X DELETE "https://WAZUH_INDEXER_IP_ADDRESS:9200/_index_template/ss4o_*_template" -u : -k + curl -X DELETE "https://:9200/_index_template/ss4o_*_template" -u : -k -In the case of having a Wazuh indexer cluster with multiple nodes, the cluster will remain available throughout the upgrading process. This rolling upgrade allows shutting down one Wazuh indexer node at a time for minimal disruption of service. Repeat these steps for every Wazuh indexer node. +Then, repeat the following steps for every Wazuh indexer node. #. Disable shard allocation.