# Unable to upgrade os from 1.x to 3.x

**URL:** <https://forum.opensearch.org/t/unable-to-upgrade-os-from-1-x-to-3-x/27162>\
**Category:** Security\
**Created:** [September 29, 2025, 11:03am UTC](https://forum.opensearch.org/t/unable-to-upgrade-os-from-1-x-to-3-x/27162 "2025-09-29T11:03:08Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ved144kumar](https://avatars.discourse-cdn.com/v4/letter/v/ccd318/32.png) [@ved144kumar](https://forum.opensearch.org/u/ved144kumar)\
**Post date:** [September 29, 2025, 11:03am UTC](https://forum.opensearch.org/t/unable-to-upgrade-os-from-1-x-to-3-x/27162/1 "2025-09-29T11:03:08Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):

**Describe the issue** : Unable to upgrade os from 1.x to 3.x, because it says .opendistro\_security format is not supported in os3.x. Since its created with Lucene8.x format which is not compatible with Os3.x, if I remove the .opendistro\_security in 1.x , I’m getting “OpenSearch Security not initialized.”

**Configuration** :

**Relevant Logs or Screenshots** :

---

<div class="post-metadata">

**Author:** ![Leeroy](https://avatars.discourse-cdn.com/v4/letter/l/eb9ed0/32.png) [@Leeroy](https://forum.opensearch.org/u/Leeroy)\
**Post date:** [October 2, 2025, 10:46am UTC](https://forum.opensearch.org/t/unable-to-upgrade-os-from-1-x-to-3-x/27162/2 "2025-10-02T10:46:38Z")

</div>

Hey @ved144kumar ,

What version in 1.x are you using and what 3.x are you planning to upgrade to?

Leeroy.

---

<div class="post-metadata">

**Author:** ![ved144kumar](https://avatars.discourse-cdn.com/v4/letter/v/ccd318/32.png) [@ved144kumar](https://forum.opensearch.org/u/ved144kumar)\
**Post date:** [October 2, 2025, 12:32pm UTC](https://forum.opensearch.org/t/unable-to-upgrade-os-from-1-x-to-3-x/27162/3 "2025-10-02T12:32:02Z")

</div>

Hi @Leeroy ,  
Thanks for the response.  
I’m currently using `1.3.20`, and intend to upgrade it to OS `3.2.0`

---

<div class="post-metadata">

**Author:** ![Leeroy](https://avatars.discourse-cdn.com/v4/letter/l/eb9ed0/32.png) [@Leeroy](https://forum.opensearch.org/u/Leeroy)\
**Post date:** [October 7, 2025, 9:51am UTC](https://forum.opensearch.org/t/unable-to-upgrade-os-from-1-x-to-3-x/27162/4 "2025-10-07T09:51:38Z")

</div>

Hi @ved144kumar ,

In order to go from 1.x to 3.x you will first need to go to 2.x.

I tested this and got it working, I first setup 1.3.20, then upgraded to 2.19.2.

Then I backed up the security indices, deleted them and restored them. This will recreate the versions on 2.19.2. Which afterwards the upgrade will run successfully giving the version is no longer restricting.

You can backup and restore using the following with security admin -

Backup

```auto
"/usr/share/opensearch/plugins/opensearch-security/tools/securityadmin.sh" -backup "/usr/share/opensearch/config/opensearch-security" -icl -key "/usr/share/opensearch/config/kirk-key.pem" -cert "/usr/share/opensearch/config/kirk.pem" -cacert "/usr/share/opensearch/config/root-ca.pem" -nhnv

```

Restore

```auto
"/usr/share/opensearch/plugins/opensearch-security/tools/securityadmin.sh" -cd "/usr/share/opensearch/config/opensearch-security" -icl -key "/usr/share/opensearch/config/kirk-key.pem" -cert "/usr/share/opensearch/config/kirk.pem" -cacert "/usr/share/opensearch/config/root-ca.pem" -nhnv

```

Then after upgrading you can run the following to confirm versions of the new indices -

```auto
curl -XGET --cert ./kirk.pem --key ./kirk-key.pem --cacert ./root-ca.pem "https://localhost:9200/.opendistro_security/_settings?human"
{".opendistro_security":{"settings":{"index":{"replication":{"type":"DOCUMENT"},"creation_date_string":"2025-10-06T11:14:00.019Z","number_of_shards":"1","auto_expand_replicas":"0-all","provided_name":".opendistro_security","creation_date":"1759749240019","number_of_replicas":"1","uuid":"ZDKyfhKCTfaKuqIdhxfOtA","version":{"upgraded":"137237827","created_string":"2.19.2","upgraded_string":"3.2.0","created":"136408027"}}}}} 

```

You can see the created\_string is updated from backup, delete, and restore in 2.19.2, which was 1.3.20. Which enabled the upgrade to 3.2.0.

Leeroy.

---

<div class="post-metadata">

**Author:** ![ved144kumar](https://avatars.discourse-cdn.com/v4/letter/v/ccd318/32.png) [@ved144kumar](https://forum.opensearch.org/u/ved144kumar)\
**Post date:** [October 7, 2025, 10:28am UTC](https://forum.opensearch.org/t/unable-to-upgrade-os-from-1-x-to-3-x/27162/5 "2025-10-07T10:28:24Z")

</div>

Thanks @Leeroy , I tried the same and it worked.  
Thanks for the assitance

---

<div class="post-metadata">

**Author:** ![ved144kumar](https://avatars.discourse-cdn.com/v4/letter/v/ccd318/32.png) [@ved144kumar](https://forum.opensearch.org/u/ved144kumar)\
**Post date:** [October 8, 2025, 8:51am UTC](https://forum.opensearch.org/t/unable-to-upgrade-os-from-1-x-to-3-x/27162/6 "2025-10-08T08:51:44Z")

</div>

Hi @Leeroy ,  
Is there a documentation regarding this, since this seems like an auto migration step which can happen from 1 to 2, and 2 to 3.  
Do we really require to reindex the security settings.  
If it is , can you share documentation where this is mentioned.

Thanks