There is no easy answer. Since the HTTP protocoll is stateless, it has no concept of "logged in". Every authenticated user could possibly be logged in, until his session expires.
What you probably mean by "logged in user", is "every user who is currently using your service and might experience unwanted effects by the upgrade in the middle of his work". So you have to define logged in maybe like "somebody who accessed the site (or the admin pages) in the last 5 (or 10) minutes and has not explicitly logged out".
You could solve that by a middleware class like this (untested):
import datetime
class LastContactMiddleware:
def process_request(self, request):
if any_condition_you_like:
request.session['last_contact'] = datetime.datetime.now()
return request
Then you can query the session objects for the time limit you chose.