After data recovery not seeing data in Search

I am working on recovery scenario in case our Graylog server would fail. I am doing snapshots of data and configuration every day. I made a test:

  1. created new Graylog server as appliance
  2. mounted remote directory with snapshots and configuration
  3. copy key (password_secret) from /etc/graylog/server/server.conf
  4. restored configuration with mongorestore
  5. restored snapshot of the data from last day - for backup/restore I use my own scripts, but they are basically the same like
  6. reload server
  7. can’t see any data in Search

Any advices, what I am doing wrong?

I should have backup of data for last two months so I am not very happy about idea, that I would need to do the same 60-times (meaning two monts). Advice, how to do better are welcome.

Best Regards

If you have the restored elasticsearch and Graylog connected to that - did you run “recalculate index range”? Because Graylog will check with that command what data is inside of Elasticsearch available.

Thanks for advice, I’ve just did that, but all the same, no data in Search.

did you checked if Elasticsearch is able to see the data? So you need to look step-by-step where the problem is.

I would first check if the Elasticsearch cluster is having the data. If yes check if Graylog can speak to elasticsearch and see the data (because the index set configuration is pointing to the right indices) … and so on.