I’m running graylog(v2.4.6). I’m restoring an indice in elasticsearch but i cant see it on index set area. When i check is indice open, i see it is open in elasticsearch. But still can’t see in graylog ui.
You might want to watch my thread… " Elastic Restore Help Please". As far as I know, prior to Graylog 4.x there was no way to see any index that didn’t match the prefix specified in the config file. And so far I have seen no evidence you can see them in 4.x either. I really want to be proven wrong, because I have a restored index I can’t use.
My theory on this is the gl_ prefix Elastic indices contain companion metadata. And without that Graylog has no idea what to do with the index. What indices did you restore/rename? Just the primary data (like Graylog_01), or also the ones with a gl_ prefix? Get the naming wrong and you bork the existing Graylog instance.
The documentation on this seems to be all but non-existent.
After finally getting my restored indices functional, my opinion hasn’t changed that it’s only in version 4 this even works. I hope I’m proved wrong, but I suspect your older version may never expose those other indices as you are hoping. Good luck to you. I hope someone with better knowledge can help.