Centos 7/Deflector exists as an index and is not an alias


(David Anderson) #1

I’m running Graylog 2.4.4+4659dbe and have done the recommended steps:

  1. Stop Graylog
  2. Delete the graylog_delector using: curl -X DELETE ‘127.0.0.1:9200/graylog_deflector’

The index is removed but as soon as I start Graylog, the graylog_deflector is recreated:

health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
yellow open graylog_deflector 5wrUelgMRXWB0N2dBEoaNA 5 1 1274 0 1.7mb 1.7mb

I have the elasticsearch_discovery_enabled set to false in the server.conf

As soon as I start Graylog, the “Deflector exists as an index and is not an alias” error is shown immediately.

I am receiving messages but obviously can’t see them in the stream and can’t search on them.

Any help would be appreciated.

Thanks.


(Jochen) #2

http://docs.graylog.org/en/2.4/pages/faq.html#how-do-i-fix-the-deflector-exists-as-an-index-and-is-not-an-alias-error-message


(David Anderson) #3

I added per the instructions outlined but now I can’t find any indexes. Added action.auto_create_index: false
to the server.conf

Now the index is gone but I can’t see any via:

curl ‘localhost:9200/_cat/indices?v’

When I go to maintenance an manual rotate the default index, it just keeps saying “Loading” on the screen.

Now the system is reporting the following errors:

Timestamp Index Letter ID Error message
25 minutes ago graylog_deflector 6726a4f0-61b9-11e8-a671-525400fc8d86 {“type”:“index_not_found_exception”,“reason”:“no such index”,“resource.type”:“index_expression”,“resource.id”:“graylog_deflector”,“index_uuid”:“na”,“index”:“graylog_deflector”}
25 minutes ago graylog_deflector 670f4c60-61b9-11e8-a671-525400fc8d86 {“type”:“index_not_found_exception”,“reason”:“no such index”,“resource.type”:“index_expression”,“resource.id”:“graylog_deflector”,“index_uuid”:“na”,“index”:“graylog_deflector”}
25 minutes ago graylog_deflector 66f7ccc0-61b9-11e8-a671-525400fc8d86 {“type”:“index_not_found_exception”,“reason”:“no such index”,“resource.type”:“index_expression”,“resource.id”:“graylog_deflector”,“index_uuid”:“na”,“index”:“graylog_deflector”}
25 minutes ago graylog_deflector 66d66210-61b9-11e8-a671-525400fc8d86 {“type”:“index_not_found_exception”,“reason”:“no such index”,“resource.type”:“index_expression”,“resource.id”:“graylog_deflector”,“index_uuid”:“na”,“index”:“graylog_deflector”}
25 minutes ago graylog_deflector 66bebb60-61b9-11e8-a671-525400fc8d86 {“type”:“index_not_found_exception”,“reason”:“no such index”,“resource.type”:“index_expression”,“resource.id”:“graylog_deflector”,“index_uuid”:“na”,“index”:“graylog_deflector”}
25 minutes ago graylog_deflector 66a714b0-61b9-11e8-a671-525400fc8d86 {“type”:“index_not_found_exception”,“reason”:“no such index”,“resource.type”:“index_expression”,“resource.id”:“graylog_deflector”,“index_uuid”:“na”,“index”:“graylog_deflector”}
25 minutes ago graylog_deflector 668fbc20-61b9-11e8-a671-525400fc8d86 {“type”:“index_not_found_exception”,“reason”:“no such index”,“resource.type”:“index_expression”,“resource.id”:“graylog_deflector”,“index_uuid”:“na”,“index”:“graylog_deflector”}

(Jochen) #4

Try rotating the write-active index in the Graylog web interface at System/Indices/Index Set/Maintenance.


(David Anderson) #5

That doesn’t work since the index that I created just gives a “Loading” message"


(Jochen) #6

Try restarting the Graylog master node. If there’s no index alias, Graylog will try to create it.


(David Anderson) #7

sudo systemctl restart graylog-server didn’t resolve the issue. Any other suggestions?


(Jochen) #8

You can try rotating the write-active index via the Graylog REST API by sending an HTTP POST request to /system/deflector/cycle (for the default index set) or /system/deflector/{indexSetId}/cycle (for any other index set).

Example:

# curl -u admin:password -X POST 'http://graylog.example.com:9000/api/system/deflector/cycle'

(David Anderson) #9

I did the rotate but when I click on the default index, it just hangs still with “Loading”

When I do a curl ‘localhost:9200/_cat/indices?v’ I don’t see any indexes created even after a Graylog restart.

health status index uuid pri rep docs.count docs.deleted store.size pri.store.size

Do you know why the indexes wouldn’t be created? Is there a configuration flag that needs to be set?


(Alfredo) #10

Hi all.

I had the same issue and I fixed the deflector problem with

  • graylog-server stop

  • mongodb stop

  • remove the deflactor index

  • mongodb start

  • graylog-server start


(David Anderson) #11

I’ve done the same, the problem is the index doesn’t get created. When I restart graylog.


(David Anderson) #12

When I start sending messages in, the graylog_deflector is recreated. Is this a bug? No matter what steps I try, I can’t seem to get rid of it:

health status index             uuid                   pri rep docs.count docs.deleted store.size pri.store.size
yellow open   graylog_deflector ztBlW3AfRbiPTPN6COtPBQ   5   1         42            0     15.3kb         15.3kb

(Jochen) #13

Which version of Elasticsearch are you using?


(David Anderson) #14

(prod) server] $ curl -XGET ‘localhost:9200’
{
“name” : “03_wUzI”,
“cluster_name” : “graylog”,
“cluster_uuid” : “VsIC8wo3TR-0fpn-PVPXWA”,
“version” : {
“number” : “6.2.4”,
“build_hash” : “ccec39f”,
“build_date” : “2018-04-12T20:37:28.497551Z”,
“build_snapshot” : false,
“lucene_version” : “7.2.1”,
“minimum_wire_compatibility_version” : “5.6.0”,
“minimum_index_compatibility_version” : “5.0.0”
},
“tagline” : “You Know, for Search”
}


(Jochen) #15

Graylog 2.x doesn’t support Elasticsearch 6.x.

http://docs.graylog.org/en/2.4/pages/installation.html#system-requirements


(David Anderson) #16

What version of Elasticsearch do you recommend?


(Jochen) #17

Elasticsearch 5.6.9 works fine.

In general, please refer to the system requirements and the Elasticsearch chapters in the documentation.


(system) #18

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.