**1. Describe your incident: ** My setup: 1 graylog headnode + 1 datanode. shards: 1 replicas: 0. I’m trying to add another datanode and retire the old one. Is it possible to do with graylog web GUI without going into API stuff? If I add another datanode and remove the old one, would I loose data…

This operation will require you to interface with the Opensearch API, you can do this be pulling a client cert from the Graylog UI under cluster config. [Screenshot 2026-05-11 at 10.11.00] Assuming the second Graylog Data Node has been added to the cluster, you could disable routing to the older …

Last time I tried, API thing didn’t work. I’ll generate a new 3rd party cert and try again.

@Wine_Merchant what’s is your guess in regards to removing a datanode: Does graylog do it gracefully or else in my case, it would lead to a data loss? I guess my question is about what goes on under the hood, when I click ‘Remove’.

Managed to move all shards to new datanode via API by using a new client cert with all_access role. Thanks @Wine_Merchant . I’m still not able to retire the old node though. There are two complications: turns out Graylog has some internal shards that it uses which’re set to non-zero replicas. In a…

I"ve create a new issue for this: [image] Shrink 2-node graylog cluster to 1 (graylog@6.1) Graylog Central (peer support) **1. Describe your incident:** Trying to go from 2 datanodes to 1. Let’s label datanodes as dn1 & dn2. all shards are located to dn2 via…

Hey @Sinan , Glad you are one step further and nice work on creating another thread. I’ve commented there.

Now that I think about this again, shouldn’t Graylog web UI automatically handle routing when I click “Remove” and if it’s not possible prompt an error to the user.

The issue is removing a node from a two node cluster will always be an issue as quorum requires at least two voting nodes to elect a leader. [Screenshot 2026-05-14 at 11.27.32]

makes sense. So if quorum is not issue, i.e. if I have 3 datanodes, graylog will automatically handle allocation of shards if I click remove on a datanode?

Hey @Sinan I ran a quick test, spun up a 3 node cluster and created an index with 3 shards which were equally placed across all three nodes. Upon removal of node1, cluster remains green and node1’s shards are now on node3. It appears that adding the node1 back to the cluster, shards require a manu…

Datanode remove: what exactly happens?

Graylog Central (peer support)

Sinan May 12, 2026, 5:06am 6

I"ve create a new issue for this:

Topic		Replies	Views
Shrink 2-node graylog cluster to 1 (graylog@6.1) Graylog Central (peer support)	1	23	May 12, 2026
Unable to delete unassigned shards in Graylog cluster Graylog Central (peer support) html , alert , curl , data-node	0	117	September 23, 2025
Data Node migration with Docker Graylog Central (peer support) docker , data-node	1	446	October 29, 2024
Unable to run more than 1 datanode in a cluster, other datanodes are showing as unavailable Graylog Central (peer support) architecture , data-node	14	447	July 29, 2025
Datanode showing Unavailable Graylog Central (peer support) data-node	13	134	May 13, 2026

Datanode remove: what exactly happens?

Related topics