Skip to content

Data Node: Cluster Health raises a Warning for the shipped compatibility OpenSearch version on an up-to-date Data Node #27743

Open

Description

@siBerLawin

Expected Behavior

When every Data Node is on the current release, Cluster Health shows no warning. An optional OpenSearch
generation upgrade that Data Node makes available is presented as an available upgrade (information), not as a
problem that needs attention.

An administrator never upgrades OpenSearch directly when using Data Node; Data Node manages it. Running the
OpenSearch version that Data Node ships as its compatibility default is a supported state.

Current Behavior

After upgrading Graylog and Data Node to 7.2.0, the Data Node is current but Cluster Health reports:

  • Cluster Health > Search Cluster > Datanode > Os > Version:
    "Warning. Experiencing a problem that needs attention. (1 of 1 affected)"
  • Latest message: A data node is running OpenSearch 2.19.6, while 3.7.0 is available to it.

The Data Node Upgrade page then shows two statements next to each other that read as contradictory:

  • "All your Data Nodes are up to date."
  • "Data Nodes' embedded OpenSearch is not up to date."

The health text itself says the data is fully usable on the compatibility version and that the newer generation
changes index formats and cannot be undone. So the state is supported, and the recommended action is optional
and irreversible, yet it is reported at warning level.

Possible Solution

  • Report the available OpenSearch generation upgrade at info level (or as an "upgrade available" notice) rather
    than as a Warning in Cluster Health.
  • On the Data Node Upgrade page, word the status so it does not contradict itself, for example "Data Nodes are up
    to date. An optional OpenSearch 3.x upgrade is available (one way, cannot be undone)."
  • Optionally allow the notice to be acknowledged so it does not stay in a warning state indefinitely for
    administrators who decide to stay on the compatibility version for now.

Steps to Reproduce

  1. Upgrade an existing Graylog + Data Node deployment (embedded OpenSearch 2.x) to 7.2.0 following the normal
    upgrade path.
  2. Open System > Cluster Health (or the health notification): the Datanode Version check is at Warning.
  3. Open System > Data Nodes > Data Node Upgrade: it shows "All your Data Nodes are up to date" and
    "Data Nodes' embedded OpenSearch is not up to date" together.

Context

A warning in Cluster Health signals that something is wrong and needs action. Here the only action offered is an
irreversible index-format upgrade, so administrators are nudged toward a one-way change to clear a warning, or
learn to ignore a permanent warning, which hides real problems. Teams with change control will see this on every
cluster immediately after a routine upgrade.

Your Environment

  • Graylog Version: 7.2.0
  • Data Node: 7.2.0 (embedded OpenSearch 2.19.6, 3.7.0 available)
  • Operating System: Linux, Docker deployment
  • Screenshots: attached in a comment

Activity

  1. siBerLawin commented on Oct 13, 2026

    @siBerLawin
    Author
    Image Image [](url)
  2. tellistone commented on Oct 13, 2026

    @tellistone

    Hello, thanks for raising this. We will remove this health warning in the next minor release. Work tracked under https://github.com/Graylog2/graylog-plugin-enterprise/issues/15395

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions