Bulk Re-open Closed Indexes

Graylog Central (peer support)
1

I accidentally made a retention strategy config change that resulted in a large number of indexes being closed. Is there a way to bulk re-open indexes and make them searchable again?

2

Hey there. You can use the ES API to do this: Open index API | Elasticsearch Guide [7.13] | Elastic. Any of the endpoints that accept a <target> will accept a comma-delimited list or a wild card.

2 Likes
3

Thanks for the advice. As you have recommended I can open the index via the ES API.

I have found one issue though. Once the Index has been opened I also need to recalculate the index to make the messages searchable.

This works fine if I use the “recalculate index ranges” option from the Graylog GUI, however, if I try and use the ES API option called _refresh the operation is successful, but then the Graylog Indices page view is no longer able to display the index sets and the view never gets beyond the Loading…. State.

If I then close the index via the ES API the problem is rectified and I am once again able to view the indexes for the default index set.

I’d be interested to hear anyone’s thoughts on this?

4

Hey there. You should be able initiate a recalculation of index ranges through Graylog’s API using the /system/indices/ranges/rebuild endpoint (see Problem with recalculate index by curl)

I’ll note that there seems to be a difference between the /api/system/indices/ranges/rebuild API in Graylog and the /_refresh API in Elasticsearch. To quote the API browser:

This triggers a systemjob that scans every index and stores meta information about what indices contain messages in what timeranges. It atomically overwrites already existing meta information.

With regard to the refresh API:

A refresh makes all operations performed on an index since the last refresh available for search.

There’s also a word of caution that performing a forced refresh in Elasticsearch is resource-intensive, which may be what’s causing Graylog to show a loading state.

If you need to recalculate the index ranges (not update index operations), I’d recommend using the rebuild endpoint, which should do a much more useful job of getting the data readable by Graylog.

1 Like
5

Thankyou the using the Graylog API rebuild option has worked.

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.