I have issue while starting opensearch (1.3.2). Start process reads existing global-*.st and fails on reading persistent_tasks and parsing field [xpack/rollup/job]
Is there a workaround for that?
Hi,
I had the same problems and unfortunately there is no way to move data.
Only migration from Elasticsearch OSS to OpenSearch is supported because XPACK is missing.
If you try to delete the “_state” folder, OpenSearch can know the name of the index from the shard but can’t actually process the data.
You can try this on a replica-only node, which won’t hurt if you need to delete the data on that node. Perhaps this problem only occurred in my home environment.
You can try re-indexing the data via Remote Reindex:
Another solution could be to install OpenSearch in parallel on the Elasticsearch node and change the default search engine if you want to use OpenSearch as your SIEM system. Here’s how to deploy the old data on the Elasticsearch cluster and index the new data in your OpenSearch cluster
EDIT:
If you just Delete the “_state” folder in the Data Directory you are left with the pure Indices.
After you point OpenSearch to the Data you can see in the Logs that he knows the Shards and tell you that they are added to the dangling Indices.
You can ether add the Option to auto add the Shards to the Cluster or you can add them with the API. Both Steps require that the same Name don’t exist in the Cluster.
Here the Documentation from Elasticsearch, but i can confirm that this works with OpenSearch.