Could not create new target index <gl-failures_0>

Graylog Central (peer support)
1

after upgrade graylog to version 7

in system/overview there is this notification:

Error rotating index set

(triggered an hour ago)

Could not create new target index <gl-failures_0>.

also in server.log

2025-11-11T15:46:11.946+01:00 INFO [Message] (suppressed 67 logs similar to ‘Ignoring invalid or reserved key {} for message {}’ in PT59.999S)
2025-11-11T15:46:12.708+01:00 INFO [MongoIndexSet] Did not find a deflector alias. Setting one up now.
2025-11-11T15:46:12.710+01:00 INFO [MongoIndexSet] There is no index target to point to. Creating one now.
2025-11-11T15:46:12.719+01:00 INFO [MongoIndexSet] Cycling from to <gl-failures_0>.
2025-11-11T15:46:12.720+01:00 INFO [MongoIndexSet] Creating target index <gl-failures_0>.
2025-11-11T15:46:12.721+01:00 WARN [Indices] Couldn’t create index gl-failures_0. Error: No index template provider found for type ‘failures’
java.lang.IllegalStateException: No index template provider found for type ‘failures’

  • OS ubuntu 22.04 LTS (Jammy Jellyfish)

  • graylog-server 7.0.0-10 amd64
    mongodb-org-server 7.0.25 amd64
    opensearch 2.19.4 amd64

no unallocated shards found

curl -XGET localhost:9200/_cat/shards?h=index,shard,prirep,state,unassigned.reason| grep UNASSIGNED

% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 3404 100 3404 0 0 383k 0 --:–:-- --:–:-- --:–:-- 415k

2

Failures are an Enterprise feature. This might be the result of down-grading from Enterprise to Open.

3

Hi Patrick,

image

there is no enterprise version installed, as you can see in the screenshot.

regards

4

I was thinking the index might be left-over in OpenSearch from some prior install. Do you use OpenSearch for anything else? Are there any other symptoms? Is this blocking anything, or just an unexpected error message?

Check your installed template types: GET _index_template

There could be a left-over legacy template that is not compatible.

5

yes I’m using opensearch.

it seems there are no functional problems only a lot of logs are generated.

reporting “There is no index target to point. Creating one now”

# GET http://localhost:9200/_index_template
{“index_templates”:[{“name”:“query_insights_top_queries_template”,“index_template”:{“index_patterns”:[“top_queries-*”],“template”:{“settings”:{“index”:{“number_of_shards”:“1”,“auto_expand_replicas”:“0-2”}},“mappings”:{“_meta”:{“schema_version”:1,“query_insights_feature_space”:“top_n_queries”},“dynamic”:true,“properties”:{“total_shards”:{“type”:“long”},“phase_latency_map”:{“properties”:{“expand”:{“type”:“long”},“fetch”:{“type”:“long”},“query”:{“type”:“long”}}},“group_by”:{“type”:“text”,“fields”:{“keyword”:{“ignore_above”:256,“type”:“keyword”}}},“id”:{“type”:“text”,“fields”:{“keyword”:{“ignore_above”:256,“type”:“keyword”}}},“search_type”:{“type”:“text”,“fields”:{“keyword”:{“ignore_above”:256,“type”:“keyword”}}},“task_resource_usages”:{“properties”:{“parentTaskId”:{“type”:“long”},“taskResourceUsage”:{“properties”:{“cpu_time_in_nanos”:{“type”:“long”},“memory_in_bytes”:{“type”:“long”}}},“action”:{“type”:“text”,“fields”:{“keyword”:{“ignore_above”:256,“type”:“keyword”}}},“nodeId”:{“type”:“text”,“fields”:{“keyword”:{“ignore_above”:256,“type”:“keyword”}}},“taskId”:{“type”:“long”}}},“node_id”:{“type”:“text”,“fields”:{“keyword”:{“ignore_above”:256,“type”:“keyword”}}},“timestamp”:{“type”:“long”},“measurements”:{“properties”:{“memory”:{“properties”:{“number”:{“type”:“double”}}},“latency”:{“properties”:{“number”:{“type”:“double”}}},“cpu”:{“properties”:{“number”:{“type”:“double”}}}}},“top_n_query”:{“properties”:{“memory”:{“type”:“boolean”},“latency”:{“type”:“boolean”},“cpu”:{“type”:“boolean”}}}}}},“composed_of”:,"prio

thanks in advance for your support.

6

Hi,

i have a similar problem.

Update 6.1 to 6.2, after that i get the follow notification:
Error rotating index set, Could not create new target index <gl-failures_0>.
In the logs:
ERROR [IndexRotationThread] Couldn’t point deflector to a new index
java.lang.RuntimeException: Could not create new target index <gl-failures_0>.

Our installation:

  • OS Ubuntu 22.04
  • Graylog 6.3 (the problem is since 6.2)
  • mongodb: 6.0.17
  • Elastic: 7

Thank you for your help!

Best regards,
Wolfgang

7

What does it actually say in the log? The “from” part got lost due to angled brackets and HTML

I’m still trying to understand why Graylog Open would even know about gl-failures, since this is an Enterprise feature. What version did you upgrade from?

A quick and dirty fix would be to delete the corresponding entry from the index_sets collection:
db.index_sets.deleteOne({ index_prefix: “gl-failures” });

1 Like
8

Hi Patrick

it worked for me!

thank you very much!!

regards

1 Like
9

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.