search

sherifabdlnaby / elastdocker

🐳 Elastic Stack (ELK) v8+ on Docker with Compose. Pre-configured out of the box to enable Logging, Metrics, APM, Alerting, ML, and SIEM features. Up with a Single Command.
https://towardsdatascience.com/running-securing-and-deploying-elastic-stack-on-docker-f1a8ebf1dc5b
MIT License
1.81k stars 319 forks source link

Warning on ELK version change and volume data index mismatch between Lucene and volume #105

Closed mburaksayici closed 4 months ago

mburaksayici commented 1 year ago

Update readme for elasticsearch volume warning during version change in .env ELK_VERSION

(Thanks for sending a pull request! Please make sure you click the link above to view the contribution guidelines, then fill out the blanks below.)

What does this implement/fix? Explain your changes.

Spent too much time experimenting, I've realised that errors caused by ELK version change. When user runs ELK, volume for elastic becomes already created with 8.8.0. Then when you try to switch <8.6.0, required Lucene version for indexing becomes different.

Does this close any currently open issues?

No

Any relevant logs, error output, etc?

java.lang.IllegalArgumentException: Could not load codec 'Lucene95'. Did you forget to add lucene-backward-codecs.jar?

Any other comments?

It's not confusing, however volume attached to docker is not on local, so it took time for me to realise that. I'm newbie to ELK, so I didn't know Lucene, indexing, elastic stores in docker volume not on local etc.

Where has this been tested?

Ubuntu 20.04, on a typical Amazon EC2 server

mburaksayici commented 1 year ago

And may be during the prune inside Makefile, deleting the elastic volume can be an option

sherifabdlnaby commented 1 year ago

@mburaksayici Can we move this to the notes section? I believe it should be reworded that Downgrades are not always supported, and if you don't care about the data you can remove the volumes.