At present, if you change the apt-repository setting to point at the 7.x repo, ES 7.0 gets installed but its hooks fail because it fails newly-added bootstrap checks.
To get around this properly, this involves extra config in elasticsearch.yaml when using ES 7.0 or above.
* First, it's necessary to set cluster.initial_master_nodes with a list of nodes as identified by their node.name values. (Maybe just the leader node is adequate to start since it's supposed to just be a bootstrap setting?)
* Second, either discovery.seed-hosts needs to be set to a list of host addresses to include in the cluster, or discovery.seed-providers should be set to "file" which then allows specifying those settings in $ES_PATH_CONF/unicast_hosts.txt, which allows for changes to the set of hosts without requiring ES restarts. The latter sounds more ideal in my opinion since it may reduce how often we need to restart ES upon changes.
References:
* https://discuss.elastic.co/t/problems-with-access-to-elasticsearch-form-outside-machine/172450
* https://www.elastic.co/guide/en/elasticsearch/reference/7.0/breaking-changes-7.0.html#breaking_70_discovery_changes
* https://www.elastic.co/guide/en/elasticsearch/reference/7.0/discovery-settings.html
* https://www.elastic.co/guide/en/elasticsearch/reference/7.0/bootstrap-checks.html
* https://www.elastic.co/guide/en/elasticsearch/reference/7.0/modules-discovery-bootstrap-cluster.html
* https://www.elastic.co/guide/en/elasticsearch/reference/7.0/modules-discovery-hosts-providers.html
We are awaiting graylog support of ES 7 which is intended to be released in 2020 under version 4.x.
Here is the upstream discussion:
https:/ /github. com/Graylog2/ graylog2- server/ issues/ 5933