Deflector exists as an index and is not an alias Error

Hi all, i would consider myself still much of a novice with GL and had a few issues over the last week where my GL cluster was not working well. MEssages received but not processes and the GL cluster was permanently Red. I have since removed the offending indexes , upgraded GL and all components i dare do excluding Elastic. Since getting my environment back to some normality i now have

The deflector is meant to be an alias but exists as an index. Multiple failures of infrastructure can lead to this. Your messages are still indexed but searches and all maintenance tasks will fail or produce incorrect results. It is strongly recommend that you act as soon as possible.

My environment is a 3 node cluster “Ubuntu” with a further Ubuntu install for reverse proxy and streaming.
Running latest version of GL and Elastic V7.17.3

admin@gray-03:~$ curl -X GET “1xx.xxx.xxx.xxx:9200/_cat/aliases?v”
alias index filter routing.index routing.search is_write_index
sva_switches_deflector sva_switches_0 - - - -
ngs_aps_deflector ngs_aps_0 - - - -
10x99x85x0_deflector 10x99x85x0_0 - - - -
sha_switches_deflector sha_switches_0 - - - -
swe_switches_deflector swe_switches_0 - - - -
sus_switches_deflector sus_switches_0 - - - -
eca_switches_deflector eca_switches_0 - - - -
sja_switches_deflector sja_switches_0 - - - -
gpu_switches_deflector gpu_switches_0 - - - -
swa_aps_deflector swa_aps_0 - - - -
tpps_aps_deflector tpps_aps_0 - - - -
svc_aps_deflector svc_aps_0 - - - -
hipp_switches_deflector hipp_switches_0 - - - -
al-ap_deflector al-ap_0 - - - -
nsc_aps_deflector nsc_aps_0 - - - -
wva_switches_deflector wva_switches_0 - - - -
npa_aps_deflector npa_aps_0 - - - -
wtp_switches_deflector wtp_switches_0 - - - -
eca_aps_deflector eca_aps_1 - - - -
wva_aps_deflector wva_aps_0 - - - -
gl-system-events_deflector gl-system-events_0 - - - -
sus_aps_deflector sus_aps_27 - - - -
hpa_aps_deflector hpa_aps_0 - - - -
hpa_switches_deflector hpa_switches_0 - - - -
hpps_switches_deflector hpps_switches_0 - - - -
gop_switches_deflector gop_switches_0 - - - -
sva_aps_deflector sva_aps_0 - - - -
mba_aps_deflector mba_aps_0 - - - -
bps_aps_deflector bps_aps_0 - - - -
bhp_switches_deflector bhp_switches_0 - - - -
gl-events_deflector gl-events_0 - - - -
mba_switches_deflector mba_switches_0 - - - -
hibp_switches_deflector hibp_switches_0 - - - -
gpu_aps_deflector gpu_aps_0 - - - -
sps_switches_deflector sps_switches_0 - - - -
tpps_switches_deflector tpps_switches_0 - - - -
ngs_switches_deflector ngs_switches_0 - - - -
gop_aps_deflector gop_aps_0 - - - -
hipp_aps_deflector hipp_aps_0 - - - -
sps_aps_deflector sps_aps_0 - - - -
sha_aps_deflector sha_aps_0 - - - -
nca_switches_deflector nca_switches_0 - - - -
wtp_aps_deflector wtp_aps_0 - - - -
nsc_switches_deflector nsc_switches_0 - - - -
mthq-ap_deflector mthq-ap_0 - - - -
svc_switches_deflector svc_switches_0 - - - -
npa_switches_deflector npa_switches_0 - - - -
sja_aps_deflector sja_aps_0 - - - -
hibp_aps_deflector hibp_aps_0 - - - -
tfs_aps_deflector tfs_aps_0 - - - -
nca_aps_deflector nca_aps_0 - - - -
tfs_switches_deflector tfs_switches_0 - - - -
bps_switches_deflector bps_switches_0 - - - -

admin@gray-03:~$ curl -X GET “1x.xxx.xxx.xxx:9200/_cat/indices?v”
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
green open hipp_switches_0 W4KEV3DQQkqGIHvq11UPvQ 3 1 0 0 1.2kb 624b
green open sus_aps_11 bFHeNfSLQ_i2o8-5-Gw8zw 3 1 20000621 0 4.9gb 2.4gb
green open sus_aps_10 4TAqKS5KRyK17yxJT2QvMw 3 1 20000547 0 4.9gb 2.4gb
green open sus_aps_13 SGMYVv6zSiStG7vC36Y_Gg 3 1 20000930 0 4.9gb 2.4gb
green open sus_aps_12 2XioRBD8T3yR8TBdNwz0qA 3 1 20000806 0 4.9gb 2.4gb
green open sus_aps_15 riRFXqitSFOFbD92OVw3bw 3 1 20000618 0 5gb 2.5gb
green open sus_aps_14 s7XfVJNWQ-SFDQvyxyQIiA 3 1 20000256 0 5gb 2.5gb
green open sus_aps_17 E8rtmQqLR9e6AK_C3iorfg 3 1 20001066 0 5gb 2.5gb
green open sus_aps_16 GmG7ub1bT7KMuePjfmqwow 3 1 20000805 0 5gb 2.5gb
green open svc_aps_0 u8I5juDrS1iujlfkZZc90A 3 1 4810406 9 1.8gb 953.7mb
green open wva_switches_0 ZXeszDpdQjiV8VZi2dV6yw 3 1 0 0 1.2kb 624b
green open sus_aps_19 G6MVw-foQhqcA5AZpQ9iLA 3 1 20001054 0 5gb 2.5gb
green open sus_aps_18 u5F7LE-0RNW33Mdu6yc_ZQ 3 1 20000617 0 5gb 2.5gb
green open tpps_switches_0 Y_oKUT6TQreQUbZrwud1fw 3 1 0 0 1.2kb 624b
green open hipp_aps_0 HCdnHhPwTuGmdAApKvCVgw 3 1 244026 0 121.6mb 60.7mb
green open api G_O5s3BPRR2D9BQeCrboIw 1 1 3 0 27.8kb 13.9kb
green open sva_switches_0 CLfk0okASx2HeuKZx5PmXg 3 1 0 0 1.2kb 624b
green open bhp_aps_deflector v-Je7HV0QgqocBwmE7yu_A 1 1 3590 0 52.4mb 17.5mb
green open ngs_aps_0 nwrr-WpmR0yncoUs2nqZwg 3 1 84949 0 37.7mb 18.8mb
green open sus_aps_20 eE6YpXT3R6GyfV95rVWnRA 3 1 20000818 0 5gb 2.5gb
green open sus_aps_22 W_w3K42ZQOmfEOazq3Zv1w 3 1 20000639 0 5gb 2.5gb
green open sus_aps_21 FaX_uqL5Tni_o0FkBfRnUA 3 1 20001004 0 5gb 2.5gb
green open sus_aps_24 5nUq7iX0R66MhJ-6LEkU9w 3 1 20000773 0 5gb 2.5gb
green open sus_aps_23 eX-pYjrMQ3Sm3iVcIdyxVA 3 1 20000939 0 5gb 2.5gb
green open sus_aps_25 iHilCAV6SiGQVyjnuyiEWg 3 1 20003189 0 5gb 2.5gb
green open sus_aps_27 uiMGOfMbRomDXTSgIjllTQ 3 1 16537617 30 4.5gb 2.2gb
green open bps_aps_0 rzFKyeJJSgicsGPxGoLYuQ 3 1 131322 0 65.4mb 35mb
green open hpps_aps_deflector ZZjqxK1KQ4qksWhRFxL_UQ 1 1 209388 0 104.9mb 53.9mb
green open actual_index skZytO82Twu-AEkIFr-1TQ 1 1 0 0 452b 226b
green open 10x99x85x0_0 yJr8BaiTleVfHPOqlFg4g 3 1 0 0 1.2kb 624b
green open nca_aps_0 UXaHd0fFSOacxaOFgoP93A 3 1 132903 0 59.1mb 29.5mb
green open sus_switches_0 3hsE20g7Qfi90oPy8uKlyw 3 1 0 0 1.2kb 624b
green open swe_switches_0 rRhw0WaUQ8SIx47O4V0jUA 3 1 0 0 1.2kb 624b
green open .geoip_databases gTBaqkycTRCRKVt91YWNAg 1 1 33 0 62.3mb 31.1mb
green open npa_switches_0 0VHwKtnvQ
-w-kg9ooYUcQ 3 1 0 0 1.2kb 624b
green open hpa_switches_0 n3qRWqytSmqto3aOgEzT6Q 3 1 0 0 1.2kb 624b
green open hpa_aps_0 _zkQO9JtT-2olhO-MvB-MQ 3 1 0 0 1.2kb 624b
green open gl-system-events_0 fWBnwTYtQzauX8vhF-3m6w 3 1 556 0 767.3kb 387.2kb
green open sps_aps_0 zN4wVCttTaepYOu92QGIog 3 1 0 0 1.2kb 624b
green open tfs_switches_0 cJQMy6OyQ-2eSPyMlU1QIw 3 1 0 0 1.2kb 624b
green open hibp_switches_0 RZngFCEyTaKst5zpgLX2bA 3 1 0 0 1.2kb 624b
green open gpu_aps_0 NuZjoATiQw-jyyt9tqNLuA 3 1 0 0 1.2kb 624b
green open gpu_switches_0 yOQOE7JWTJi4EZkcTE4THg 3 1 0 0 1.2kb 624b
green open mba_aps_0 HBCnkoIkSBCRROkXmox5FQ 3 1 423677 0 238.2mb 119.1mb
green open bhp_switches_0 wTVxCAFDSnGAQSSlbQcGbg 3 1 0 0 1.2kb 624b
green open bhp_aps_30 rOz7l1TtRyKeNAXX5rlZeA 3 1 20001035 0 5.5gb 2.7gb
green open bhp_aps_31 7PBxwd8HSqa-s3zpqa6lMg 3 1 20001444 0 5.4gb 2.7gb
green open bhp_aps_32 pS6Ds0p5QHCqp4IdWuu2iA 3 1 20000575 0 5.5gb 2.7gb
green open bhp_aps_37 qvjaz4edRHSDbhOF_r9LUQ 3 1 20000711 0 5.6gb 2.8gb
green open bhp_aps_38 T76nZH7zSciw8erXzkibig 3 1 20001183 0 5.7gb 2.8gb
green open bhp_aps_39 LeKupSwGS3ak7TwZ9mKdKA 3 1 20000886 0 5.7gb 2.8gb
green open bhp_aps_33 _PoJGsxFSTe4_XQnoJZ42Q 3 1 20001215 0 5.6gb 2.8gb
green open bhp_aps_34 gQXN4UJHSyao49mPB1JCzw 3 1 20000956 0 5.5gb 2.7gb
green open bhp_aps_35 T-N1RsPFS1O5o4qGfL64eA 3 1 20001189 0 5.5gb 2.7gb
green open bhp_aps_36 9ZgJyB3vRDG0MOWECCNC5A 3 1 20001259 0 5.5gb 2.7gb
green open bps_switches_0 2V9Q2LtJQkiGyL7wDEP7bg 3 1 0 0 1.2kb 624b
green open tfs_aps_0 vjyT1FR4Rkuq0uwlLDDVNw 3 1 6817962 20 2.5gb 1.2gb
green open ngs_switches_0 z7x2oD9LTiu3iWVt8dpzFA 3 1 0 0 1.2kb 624b
green open nca_switches_0 g3yxotfySjaMk2qRY5Nk9g 3 1 0 0 1.2kb 624b
green open sha_aps_0 RBf0VTQgTtafxbB7ceDtmg 3 1 0 0 1.2kb 624b
green open sja_aps_0 -b9cqVwlReS3JUTFOxztsg 3 1 0 0 1.2kb 624b
green open bhp_aps_40 1fcqEXVERpOzohuKwjUmCg 3 1 20000887 0 5.6gb 2.8gb
green open bhp_aps_41 lQGCNCKMRN21rC_JEjLBaQ 3 1 20000845 0 5.6gb 2.8gb
green open bhp_aps_42 u-6SuMGWQk2DLQmfcxP4mw 3 1 20006519 0 5.7gb 2.8gb
green open bhp_aps_43 H1FhOaMnQialiQicmW52tg 3 1 0 0 1.3kb 678b
green open nsc_aps_0 5lmpz97pSiuS4NwwfMBykQ 3 1 0 0 1.2kb 624b
green open al-ap_0 uzS2_BITQFiClVAfPNSA3w 3 1 1717 0 1.1mb 610.4kb
green open hpps_switches_0 dtVQbakNRPGRmnNlLwj5sw 3 1 0 0 1.2kb 624b
green open npa_aps_0 cqwcytCUTxGOqAaTglPyJQ 3 1 5897313 37 2.4gb 1.2gb
green open graylog_deflector 0ELkMvCCSMSMECWmggyj3w 1 1 91 0 1008.9kb 499.2kb
green open nsc_switches_0 hnqvsQMOQOu6uqSDZZbe2w 3 1 0 0 1.2kb 624b
green open svc_switches_0 x18q0FJbTnaou5Wn_z6GhQ 3 1 0 0 1.2kb 624b
green open tpps_aps_0 F1GsfmQRTFqadvfosPNSaQ 3 1 376807 0 182.4mb 89.6mb
green open wva_aps_0 EJq5NH0pSxq7Sd_huP_5-g 3 1 0 0 1.2kb 624b
green open sps_switches_0 eiPap8LlRQuNvbz_Zf7mkQ 3 1 0 0 1.2kb 624b
green open sus_aps_9 T5hzf8GRQECb1qg3Y_BjJQ 3 1 20000984 0 4.8gb 2.4gb
green open hpps_aps_80 _XEpH-1IQ2ehgWh1jzrY4g 3 1 20003850 0 5.6gb 2.8gb
green open graylog_7 T1cWnzKmTbqSUKSleEQG1Q 3 1 209 0 346.2kb 167.2kb
green open gop_aps_0 4e6nztpHRnajbMWV8DlBjw 3 1 650629 0 242.4mb 121.2mb
green open graylog_6 9CM1NxQcRb2S3hhm7DEsRw 3 1 13202061 0 4.9gb 2.4gb
green open sus_aps_8 RG8_9ylyQEKpyS3UGWdTfQ 3 1 20001181 0 4.9gb 2.4gb
green open sva_aps_0 XmvhO1D3R3Svcf-ddruO1A 3 1 0 0 1.2kb 624b
green open sha_switches_0 nOOLLRQMRGOHdMwzCFqY2A 3 1 0 0 1.2kb 624b
green open graylog_1 7ySwResLTNyQojzbWtYBbg 3 1 20007000 0 6.5gb 3.2gb
green open hpps_aps_88 jxC26zFYTgmWSAbyp8_uZg 3 1 0 0 1.3kb 678b
green open hpps_aps_87 TSPdv3tTTveEPZkzBwu-8A 3 1 20075854 0 5.6gb 2.8gb
green open graylog_0 0tsphAvISvSiv-zvH89TEA 3 1 20005151 0 6.5gb 3.2gb
green open hibp_aps_0 eujFQFFCS-ipCZtREUT9cg 3 1 367900 0 180.3mb 90.1mb
green open graylog_5 WQhAk09RQ2ycR288kwdz5A 3 1 20000012 0 6.2gb 3.1gb
green open graylog_4 pCTeIJVrR02vJIMnd0ZxOw 3 1 20005768 0 5.8gb 2.9gb
green open gop_switches_0 TjBRJD0USryky2uwc7XsiA 3 1 0 0 1.2kb 624b
green open swa_aps_0 Y2bNfvolRQmgguFxyzsMaQ 3 1 2855340 0 1.2gb 622.4mb
green open graylog_3 i4t0DmRmTkSlZguUVm1q1g 3 1 20002705 0 7.7gb 3.8gb
green open hpps_aps_82 88edj6sKRY-4jklbajoEKw 3 1 20012559 0 5.6gb 2.8gb
green open mba_switches_0 DeF652_ATHSCCKamLJiuUQ 3 1 0 0 1.2kb 624b
green open hpps_aps_81 O-a6a_ehRVmf8Q3oMM3qDg 3 1 20002882 0 5.6gb 2.8gb
green open graylog_2 NUqjbAhCQciUg4Nn9T88Lg 3 1 20004407 0 8gb 4gb
green open eca_switches_0 sfE3W0znQd2yyJdmx3tz6w 3 1 8117879 0 2.2gb 1.1gb
green open eca_aps_0 67Iehk4RQfmftFWGuiYrUQ 3 1 20000554 0 6.6gb 3.3gb
green open eca_aps_1 ALJsU6oRQ9a2yqWVvyb8uQ 3 1 3361872 45 1.4gb 743.9mb
green open hpps_aps_79 UyAvCPsySjaGXHiBH2vkXg 3 1 20003566 0 5.6gb 2.8gb
green open hpps_aps_78 chj2yp10R1Oql3eRlEEihg 3 1 20003029 0 5.6gb 2.8gb
green open gl-events_0 NAKMqGolRweswWId0SiR1g 3 1 0 0 1.2kb 624b
green open sja_switches_0 T57AKNzNR2uxeb8RB_HLZQ 3 1 0 0 1.2kb 624b
green open wtp_aps_0 g9n_U6bmS6aEx-YPlBkONA 3 1 0 0 1.2kb 624b
green open bhp_aps_27 5BUbtBrMT3CSasIKG0IsiQ 3 1 20001875 0 5.5gb 2.7gb
green open mthq-ap_0 3ECIJKdPRp2fQwy7jYoDvA 3 1 13257079 0 4.1gb 2gb
green open bhp_aps_28 4L9P5qZTR-Cuc7DBWRoztg 3 1 20001721 0 5.6gb 2.8gb
green open bhp_aps_29 Hb3z9qIcSraGPXvaNhyAzQ 3 1 20000547 0 5.5gb 2.7gb
green open hpps_aps_77 qr8swjv-S1-NrWKuo6Kxvw 3 1 20002199 0 5.6gb 2.8gb
green open hpps_aps_76 I-SFF_7iQC68EO1F61NhEg 3 1 20003003 0 5.6gb 2.8gb
green open hpps_aps_75 Sy4y242pSpCCt5vsf3Bj4A 3 1 20002739 0 5.6gb 2.8gb
green open hpps_aps_74 tCg1yXFTRTi0YN-E0dgNfg 3 1 20001836 0 5.6gb 2.8gb
green open hpps_aps_73 4kOYiE6cRXqhm2Z7oBCbkA 3 1 20003091 0 5.6gb 2.8gb
green open hpps_aps_72 AoK5JlgHTMCI2kKhC9MliA 3 1 20001626 0 5.6gb 2.8gb
green open wtp_switches_0 H6dviJNGTeqdjuD9gR3GFw 3 1 0 0 1.2kb 624b
green open hpps_aps_71 feQS5G-FQ9CWE60Zkx-q7Q 3 1 20002303 0 5.6gb 2.8gb
green open hpps_aps_70 aDF_gJtXR52nFFcJPyT3lA 3 1 20001202 0 5.5gb 2.7gb

I have tried searching for information on this and havent got very far. Problem is i dont actually know what i am looking for in the first place.

Please can someone point me in the right direction. Thank you.

The deflector is an alias pointing to the Index_set indice that is is writing to.

Could it be you have created an index set with the same name and have a hard pointer instead of a link?

Did you run maintenance > Cleanup & recalculate all index ranges so Graylog lines up correctly with your backend again?

2 Likes

Hi Arie, i ran the clean up as you suggested. Stopped and restarted the databases and all seems ok now. Typical that i have spent many days try to fix this and was after i posted that it all started working again.

Thank you for you help and support Arie !!!

Paul

1 Like