I had a host begin sending large amounts of syslog data, that managed to fill up the partition where the Graylog journal resides. After restarting Graylog it would not ingest any of the logs so I deleted the contents of the journal folder. Now I am seeing messages inbound, but none are being writte…

Aggregation Value Context Error After Full Disk

aviationatom (Adam) November 2, 2018, 9:47pm 2

Ugh. I feel dumb. I failed to delete the committed read offset and recovery point offset files from the journal folder. It’s working just fine now.

More details here:

Topic		Replies	Views
Graylog not processing messages after crash (ran out of space) Graylog Central (peer support)	5	3573	April 20, 2020
Unable to get any data on streams Graylog Central (peer support)	11	926	March 11, 2019
Journal Filling but Graylog not Processing Graylog Central (peer support)	8	4357	July 14, 2020
Journal utilization is too high - elasticsearch running Graylog Central (peer support)	7	3087	October 23, 2018
Graylog error in webportal Graylog Central (peer support)	6	965	July 17, 2018