Clean up graylog-datanode indices (_all)

Hello Graylog community,

In a LAB environment, I’m trying to cleanup the entire Graylog-Datanode database and start from scratch.
ElasticSearch command used to be:
curl -XDELETE http://localhost:9200/_all

Trying this command, that is adapted for Graylog-Datanode, but it is not working:
curl -X DELETE --key key_datanode.crt --cert cert_datanode.crt --cacert ca_datanode.crt https://<redacted>:9200/all --pass <redacted>

But I’m getting the following error:
{"error":{"root_cause":[{"type":"security_exception","reason":"no permissions for [] and User [name=datanode, backend_roles=[], requestedTenant=null]"}],"type":"security_exception","reason":"no permissions for [] and User [name=datanode, backend_roles=[], requestedTenant=null]"},"status":403}

If I use the same command, but replacing _all with an specific index, such as index_1, it works. It is just not working with _all.

  • OS Information: Raspberry PI 5 8GB running Raspbian OS 64 bits (Debian 12)

  • Package Version: graylog-server:arm64 (6.1.8-1), graylog-datanode:arm64 (6.1.8-1)

If someone can point me in the right direction, that would be great.

Thanks !

Managed to cleanup, didn’t use _all, instead used indexname* in the command.
Had to issue this command for all indices I have..

You can close this one, thanks.

2 Likes

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.