Migrating data from Opendistro to the Wazuh indexer
This guide assumes that you previously deployed the version 4.2.x production cluster.
This guide shows how to migrate data from Opendistro to Wazuh Indexer in Docker production deployments (v4.2.x to v4.4). This procedure also upgrades the other Wazuh components to the most recent versions.
Run the following command from the
wazuh-dockerdirectory to stop the current v4.2.x environment:
# docker-compose -f production-cluster.yml stop
Check that Elasticsearch volumes are present:
# docker volume ls --filter name='wazuh-docker_elastic-data'
Inspect Elasticsearch volumes and save the
com.docker.compose.versionvalue to use it in step 7:
# docker volume inspect wazuh-docker_elastic-data-1
Stop and remove the containers of the current v4.2.x environment:
# docker-compose -f production-cluster.yml down
Exit the current
wazuh-dockerdirectory and rename it to
Clone the Wazuh 4.4 repository to your system:
# git clone https://github.com/wazuh/wazuh-docker.git -b v4.4.3
Navigate to the
multi-nodedirectory and run the
volume-migratorscript. This script creates new volumes for 4.4 and copies data from old volumes to the newly created volumes. Use the Docker-compose version and project name as the arguments. You can see an example below. You can also do this step manually, see steps 5 and 6 in Wazuh Docker Github:
# ./volume-migrator.sh 1.29.2 multi-node
Start the 4.4 environment:
# docker-compose -f generate-indexer-certs.yml run --rm generator # docker-compose up -d