Looking for help with input not starting, custom input and GROK patterns missing after cleanse and forced restart. Here’s the story…
Still just getting my feet wet, but after getting the hang of things, I decided to clear my index to test load some old apache log files.
To clear the index, I logged into the box, issued:
sudo graylog-ctl cleanse
The progress messages indicate that the services were “down, normally up” and then “disabled, not stopping.” Status shows they are all disabled. So I tried
sudo graylog-ctl start (no message) followed by `sudo graylog-ctl status’ reveals all services (elasticsearch, etcd, graylog-server, mongodb, nginx) are still disabled.
Ok. So I go the presumed easy route and reboot the machine with
sudo reboot. All seems to come online just fine, my index looks clean which is what I was after, but my custom Input and two custom GROK patterns were gone. Also, both existing inputs were disabled and will not start: the out of box provided syslog (:514) I had disabled prior to creating my custom on on the same port, but when I go to start the provided one on 514, it reports Address in Use.
I am using a provided Graylog vm with Graylog 2.3.1+9f2c6ef.