Upgrade - ElasticSearch and OpenSearch

In most cases, an upgrade is just a new Collectord image - but if you want the new features that ship with a release, you’ll also need to update your configuration. Track what’s new on our blog and in the Release history. The manifests are rendered from the Helm charts in outcoldsolutions/collectord-helm-charts, which has a commit for each chart version: compare the collectord-elasticsearch or collectord-opensearch chart’s values.yaml between two of them to see what changed in the configuration.

If you get stuck, or want a hand planning an upgrade, contact support - we’ll help and guide you through it.

Upgrade from version 26.04 to 26.10

Version 26.10 brings together work we started in 2019 that kept waiting on other changes. For ElasticSearch and OpenSearch, it brings one DaemonSet instead of the Helm charts’ two, which reads the API server’s audit logs by default, Collectord pods the kubelet doesn’t evict when a node runs short of disk, and three opt-in ways to index less: repeated lines sent as one event that counts them, storms of alike lines folded into one summary, and a report of the log patterns that cost the most. We held each new input to what it adds to your indices, and an upgrade keeps sending your data to the same cluster.

Upgrade the collectorforkubernetes image to version 26.10.X with the steps for your deployment method.

What the upgrade changes in your data

Host logs stop arriving twice. Collectord no longer reads /var/log/syslog and /var/log/messages, which rsyslog writes from the journal; other *.log files under /var/log are still read. Queries of your own on those two sources find nothing new after the upgrade. A node without systemd has no journal, so turn [input.files::syslog] on there: see Host logs.

With Helm

helm upgrade removes the -master DaemonSet. Until its pod on a control-plane node stops, the new DaemonSet pod there may restart a few times with the data path ./data/ is locked by another collectord instance; it then continues from the same state, so file positions carry over.
Values under collectord.daemonsetMaster and collectord.configMap.daemonsetMasterAdditionalFiles are no longer read: move them under collectord.daemonset and collectord.configMap.daemonsetAdditionalFiles.
The DaemonSet now runs under the built-in system-node-critical priority class and the addon under system-cluster-critical, and the chart deletes the <release>-critical PriorityClass (collectorforkubernetes-elasticsearch-critical, collectorforkubernetes-opensearch-critical). To keep the old class, set collectord.priorityClass.name to its name.

With the manifest

Download the 26.10 manifest, collectorforkubernetes-elasticsearch.yaml or collectorforkubernetes-opensearch.yaml, set your values in it again as Installation shows, carry over what you changed in the old one, and apply it.
If Collectord for Splunk runs on the same cluster from its manifest, upgrade both together and apply the Collectord for Splunk manifest last: the two manifests share the collectorforkubernetes service account and cluster role, and the one you apply last sets what both can read.
kubectl apply doesn’t delete what the manifest no longer contains. The workloads now run under the built-in priority classes; delete the class they ran under before once no Collectord on the cluster uses it (Collectord for Splunk’s manifest before 26.10 runs under the same class):
bash
```
1kubectl delete priorityclass collectorforkubernetes-critical
```
The OpenSearch manifest now reads opensearch.collectord.io/ annotations instead of elasticsearch.collectord.io/. Rename the annotations on your namespaces, workloads, pods and Configuration resources when you apply it. Annotations under collectord.collectord.io/ keep working as they are.

Upgrade from version 25.10 to 26.04

Upgrade the collectorforkubernetes image to version 26.04.X. Review the Configuration reference for any new fields you want to pick up.

Upgrade from version 5.24 to 25.10

Upgrade the collectorforkubernetes image to version 25.10.X. The version scheme switches from semver (5.X) to YY.MM in this release.

Upgrade from version 5.23 to 5.24

Upgrade the collectorforkubernetes image to version 5.24. The new release adds support for forwarding Prometheus-format metrics to a metrics datastream - see the Configuration reference if you want to enable it.

Upgrade from version 5.22 to 5.23

Upgrade the collectorforkubernetes image to version 5.23. If you’re running clusters with thousands of pods, set watchImplementation = 2 under [general.kubernetes] for better watch performance.

Older versions

For Collectord versions from 5.20 to 5.22, see the Monitoring Kubernetes upgrade guide - the same Collectord binary powers both products and the per-version upgrade notes apply equally.

If you run a version before 5.20, contact support - we’ll help you plan the upgrade and guide you through it.