Issues with elasticsearch after upgrading from 7 to 9

Technical assistance
1

Infos:

  • Used Zammad version: 7.01-1776088456.8a5307eb.bullseye
  • Used Zammad installation type: Package
  • Operating system: Debian 11
  • Browser + version: Chrome Browser

Expected behavior:

  • Start elasticsearch without error

Actual behavior:

  • systemctl status elasticsearch.service
    ● elasticsearch.service - Elasticsearch
    Loaded: loaded (/lib/systemd/system/elasticsearch.service; enabled; vendor preset: enabled)
    Active: failed (Result: exit-code) since Mon 2026-04-13 18:56:29 EDT; 1s ago
    Docs: https://www.elastic.co
    Process: 409 ExecStart=/usr/share/elasticsearch/bin/systemd-entrypoint -p ${PID_DIR}/elasticsearch.pid --quiet (code=exited, status=1/FAILURE)
    Main PID: 409 (code=exited, status=1/FAILURE)
    CPU: 15.584s

Apr 13 18:56:08 zammad-22.pbzinc.loc systemd[1]: Starting Elasticsearch…
Apr 13 18:56:28 zammad-22.pbzinc.loc systemd-entrypoint[409]: ERROR: Elasticsearch did not exit normally - check the logs at /var/log/elasticsearch/elasticsearch.log
Apr 13 18:56:29 zammad-22.pbzinc.loc systemd-entrypoint[409]: ERROR: Elasticsearch died while starting up, with exit code 1
Apr 13 18:56:29 zammad-22.pbzinc.loc systemd[1]: elasticsearch.service: Main process exited, code=exited, status=1/FAILURE
Apr 13 18:56:29 zammad-22.pbzinc.loc systemd[1]: elasticsearch.service: Failed with result ‘exit-code’.
Apr 13 18:56:29 zammad-22.pbzinc.loc systemd[1]: Failed to start Elasticsearch.
Apr 13 18:56:29 zammad-22.pbzinc.loc systemd[1]: elasticsearch.service: Consumed 15.584s CPU time.
zammad-22:/# cat /etc/elasticsearch/certs/http_ca.crt | zammad run rails r ‘SSLCertificate.create!(certificate: STDIN.read)’

Steps to reproduce the behavior:

  • I recently upgraded elasticsearch from 7 to 9. I ran zammad run rake zammad:searchindex:rebuild
  • rake aborted!
    Unable to process GET request to elasticsearch URL ‘https://localhost:9200’. Elasticsearch is not reachable. It’s possible that it’s not running. Please check whether it is installed.

Response:
#<UserAgent::Result:0x00007f5fb720aeb8 @success=false, @body=nil, @data=nil, @code=0, @content_type=nil, @error=“#<Errno::ECONNREFUSED: Failed to open TCP connection to localhost:9200 (Connection refused - connect(2) for "localhost" port 9200)>”, @header=nil>

Payload:
null

Payload size: 0M
/opt/zammad/lib/search_index_backend.rb:49:in ‘SearchIndexBackend.info’
/opt/zammad/lib/tasks/zammad/search_index_es.rake:64:in ‘block (3 levels) in ’
/opt/zammad/vendor/bundle/ruby/3.4.0/gems/rake-13.3.1/exe/rake:27:in ‘<top (required)>’
/opt/zammad/bin/bundle:121:in ‘Kernel#load’
/opt/zammad/bin/bundle:121:in ‘’
Tasks: TOP => zammad:searchindex:rebuild => zammad:searchindex:version_supported
(See full trace by running task with --trace)

Zammad 7 is accessible from the web URL, however, even though I have users, I can’t search for them when changing customer on a ticket.

I am also trying to reset the elasticsearch user password without success /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic

ERROR: Failed to determine the health of the cluster., with exit code 69

2

Your Elasticsearch isn’t even running (state: failure).
Check the logfile of ES ( /var/log/elasticsearch/elasticsearch.log), as the traceback suggests.

3 
[2026-04-13T18:32:52,503][ERROR][o.e.b.Elasticsearch      ] [zammad-22.pbzinc.loc] fatal exception while booting Elasticsearch
java.lang.IllegalArgumentException: Unknown properties for plugin [ingest-attachment] in plugin descriptor: [type]
        at org.elasticsearch.plugins.PluginDescriptor.readFromProperties(PluginDescriptor.java:203) ~[elasticsearch-9.3.3.jar:?]
        at org.elasticsearch.plugins.PluginsUtils.readPluginBundle(PluginsUtils.java:256) ~[elasticsearch-9.3.3.jar:?]
        at org.elasticsearch.plugins.PluginsUtils.findBundles(PluginsUtils.java:237) ~[elasticsearch-9.3.3.jar:?]
        at org.elasticsearch.plugins.PluginsUtils.getPluginBundles(PluginsUtils.java:219) ~[elasticsearch-9.3.3.jar:?]
        at org.elasticsearch.plugins.PluginsLoader.loadPluginsBundles(PluginsLoader.java:160) ~[elasticsearch-9.3.3.jar:?]
        at org.elasticsearch.bootstrap.Elasticsearch.initPhase2(Elasticsearch.java:227) ~[elasticsearch-9.3.3.jar:?]
        at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:99) ~[elasticsearch-9.3.3.jar:?]

I see this error

4

for now I restored the vm back to Zammad 6.5. Will review elasticsearch upgrade process a bit more closely,

5

These are my personal notes while planning to upgrade from 7 to 9, i tested it on my staging system

DISCLAIMER: NO WARRANTY

Overview

Upgrading from 7.17 to 9.3.1 requires two major upgrades. Each major upgrade must be prepared and executed independently, although the planning phase can be shared.

  1. 7.17.x → 8.19.xThis brings the cluster onto the latest supported 8.x release, which is the required intermediate version before upgrading to 9.3.1.Before running this upgrade, all ingest components and client libraries must be upgraded to 7.17.x.
  2. 8.19.x → 9.3.1This completes the upgrade to the latest 9.x release.Before running this upgrade, all ingest components and client libraries must be upgraded to 8.19.x.

1) Upgrade to 7.17.29 (from any 7.x)

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.17.29-amd64.deb

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-7.17.29-amd64.deb.sha512

shasum -a 512 -c elasticsearch-7.17.29-amd64.deb.sha512

sudo dpkg -i elasticsearch-7.17.29-amd64.deb

ensure ES is stopped before touching plugins

sudo systemctl stop elasticsearch

sudo systemctl daemon-reload

7.x: ingest-attachment IS a plugin → must match ES version

sudo /usr/share/elasticsearch/bin/elasticsearch-plugin remove ingest-attachment || true

sudo /usr/share/elasticsearch/bin/elasticsearch-plugin install ingest-attachment

sudo systemctl start elasticsearch

2) Upgrade to 8.19.12

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.19.12-amd64.deb

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-8.19.12-amd64.deb.sha512

shasum -a 512 -c elasticsearch-8.19.12-amd64.deb.sha512

sudo dpkg -i elasticsearch-8.19.12-amd64.deb

sudo systemctl stop elasticsearch

sudo systemctl daemon-reload

IMPORTANT: remove any old plugin leftovers (7.x plugin dir must not remain)

sudo rm -rf /usr/share/elasticsearch/plugins/ingest-attachment

sudo rm -rf /usr/share/elasticsearch/plugins/.installing-*

sudo systemctl start elasticsearch

3) Upgrade to 9.3.1

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-9.3.1-amd64.deb

wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-9.3.1-amd64.deb.sha512

shasum -a 512 -c elasticsearch-9.3.1-amd64.deb.sha512

sudo dpkg -i elasticsearch-9.3.1-amd64.deb

sudo systemctl stop elasticsearch

sudo systemctl daemon-reload

sudo mv /var/lib/elasticsearch /var/lib/elasticsearch.bak

sudo mkdir /var/lib/elasticsearch

sudo chown -R elasticsearch:elasticsearch /var/lib/elasticsearch

sudo systemctl start elasticsearch

4) Generate Password for Zammad

sudo /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic

5) Set Elastichsearch Password for Zammad on zammad-web

Now you need your password which was shown during the installation.

Set Elasticsearch user:

sudo zammad run rails r “Setting.set(‘es_user’, ‘elastic’)”

Set Elasticsearch password. Replace <password> with the one you got during the installation of Elasticsearch. In case you need to create a new password, run /usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic.

sudo zammad run rails r “Setting.set(‘es_password’, ‘’)”

sudo zammad run rake zammad:searchindex:rebuild[4]

sudo zammad run rails r "Setting.set(‘es_attachment_ignore’,\

[ ‘.png’, ‘.jpg’, ‘.jpeg’, ‘.mpeg’, ‘.mpg’, ‘.mov’, ‘.bin’, ‘.exe’, ‘.box’, ‘.mbox’ ] )"

sudo zammad run rails r “Setting.set(‘es_attachment_max_size_in_mb’, 50)”

6

Thanks for providing these steps. I’ll try them out over the next week or so. I appreciate it.

1 Like