Deflector exists as an index and is not an alias / cannot remove index

Graylog Central (peer support)
1

Hi,
I got the above message from graylog and have some problems resolving it.
Fist point was to delete the index, which leads to having a lot of errors.

{"type":"index_not_found_exception","reason":"no such index [graylog_deflector] and [action.auto_create_index] ([.watches,.triggered_watches,.watcher-history-*]) doesn't match","index_uuid":"_na_","index":"graylog_deflector"}

I created a new index, set it to default, but cannot change the used index of the default all messages stream.

If I do not disable automatic creation of indexes I get that error message back again.

So, I am a bit lost here. Anyone have a good advice?

Greetings

2

he @maulwurf87

you might want to check the docs:

https://docs.graylog.org/en/3.1/pages/faq.html#how-do-i-fix-the-deflector-exists-as-an-index-and-is-not-an-alias-error-message

3

Hi,
I read through this earlier, but it does not resolve my problem.

  1. action.auto_create_index: false prevents elastic from starting at all. With the suggested option in the logs it starts, but not index gets created, so I have none to work with and streams are complaining about a missing index. And I get the above mentioned error messages.

  2. deleting the index and setting the option for no automatic creation results in having no index to use at all for default stream.

  3. Rotate active write index can be executed but I think it will not do anything without having an index.

4

he @maulwurf87

you might need to adjust the setting action.auto_create_index according to the documentation of elasticsearch. If you use the x-pack installed version you might need to adjust that.

The described way is 100% tested and working. You might miss a step if it does not work for you or something else is the problem.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.