Concerns in the process of migrating to NLS 2024R2

[IT_LAS]

Hello,
We are in the process of migrating our current NLS 2024R1.3.1 installation to version 2024R2 and there are some doubts regarding the Logstash snapshots. How can we migrate them to the new version, is there a correct way to import them without losing information, is it worth migrating them or is it better to temporarily keep the old NLS installation until the full maintenance cycle is completed, or is it better to temporarily keep the old NLS installation until the full maintenance cycle is completed?

[jmichaelson]

Hi IT_LAS, here's a few notes for you about the migration process. When i comes to actual log data, the migration can only migrate indexes that are open on your source cluster. If you have snapshot and maintenance policies that close and delete "old" indexes after a certain amount of time, you will have to open the index (or restore it from a snapshot if it was otherwise deleted) before the data can be migrated to the 2024R2 cluster. These are limitations of the remote reindex process used to migrate the data. As far as your old snapshots themselves, I am unaware of a way to migrate them from the old Elasticsearch backend used prior to 2024R2 and the OpenSearch backend used in 2024R2.

If you have a significantly sized snapshot repository and that is the only source of old indexes (for instance because you have your log server configured to delete old indexes, then your simplest option may be to maintain your old NLS cluster for as long as your data retention requirements demand access to that data.

Which way is "better"? its hard to say. I think a lot of that decision has more to do with the requirements of your environment (data retention, etc.), your budget to have a sufficiently large cluster to store old data along with the new, and how much time you want to put into the migration. If all of your existing indexes are merely closed and not deleted, it may be worth the time to open a few at a time, migrate them, and then move on to the next batch.

[DoubleDoubleA]

Hi @IT_LAS,

You can contact your CSM (csm@nagios.com) and ask for an additional activation for Log Server, and in this way you can keep your "old" server running and licensed for as long as you need to be satisfied with the migration. The migration is a copy, so the old server will remain intact.

Aaron

[kowilax389]

Thanks, Jason and Aaron, for the detailed insights! It seems like keeping the old NLS instance running for data retention while migrating gradually might be the safest approach. I'll check with our CSM regarding activation for paper ioLog Server. Appreciate the help.