Deflector exists as an index and is not an alias - getting this error on 3.0 version

(Satishdotpatel) #1

I have install graylog on my server with following components version on CentOS 7 64bit

graylog-server 3.0 (2.3 & 2.4 was throwing strange rpm error)
elasticsearch 5.x
mongo-db 3.4

I have configured input syslog 5514 port and its running.

But i am getting error “Deflector exists as an index and is not an alias”, i can see my test syslog messages going in index" but i can’t search any logs or do anything.

I have google everywhere and found many many post with same error message and i have tried every single steps but none of them help me.

I have tried this article also but no luck:

I have upgrade elasticsearch to 6.x also but they didn’t help me too, at this point i am just frustrated and no idea what and where stuff is broken…

Please help me to debug this issue because that error doesn’t explaining anything.

(Jan Doberstein) #2

simple follow the steps in:

That is the solution.

You know that 3.0 is pre-release and not created for production - right? The stable release is 2.4.6 (at the time of writing this)

(Satishdotpatel) #3

3.0 was under stable branch so I thought its good to have latest software and I pick that up.

I tried to downgrade and end up tons of error but anyway I will rekick box.

Do you have any preference on elasticsearch version? Or mongodb?

(Jan Doberstein) #4

Where was 3.0 listed as stable? Could you please give me the point.

We have covered everything in the documentation:

Just follow the step-by-step guides and you will have a stable running system.

(Satishdotpatel) #5

Here you go! what is wrong here, it’s just installing 3.0, even i don’t have repo configured for 3.0, i did yum clean too

also this URL is broken, page not found:$basearch/

[root@graylog ~]# cat /etc/yum.repos.d/graylog.repo
[root@graylog ~]#
[root@graylog ~]#
[root@graylog ~]#
[root@graylog ~]# yum install graylog-server
Loaded plugins: fastestmirror, langpacks
base                                                                                                                                                          | 3.6 kB  00:00:00
elasticsearch-5.x                                                                                                                                             | 1.3 kB  00:00:00
epel/x86_64/metalink                                                                                                                                          |  16 kB  00:00:00
epel                                                                                                                                                          | 3.2 kB  00:00:00
extras                                                                                                                                                        | 3.4 kB  00:00:00
mongodb-org-3.4                                                                                                                                               | 2.5 kB  00:00:00
updates                                                                                                                                                       | 3.4 kB  00:00:00
(1/9): elasticsearch-5.x/primary                                                                                                                              | 148 kB  00:00:00
(2/9): base/7/x86_64/group_gz                                                                                                                                 | 166 kB  00:00:00
(3/9): epel/x86_64/group_gz                                                                                                                                   |  88 kB  00:00:00
(4/9): epel/x86_64/updateinfo                                                                                                                                 | 932 kB  00:00:00
(5/9): epel/x86_64/primary                                                                                                                                    | 3.6 MB  00:00:00
(6/9): mongodb-org-3.4/7/primary_db                                                                                                                           |  73 kB  00:00:00
(7/9): extras/7/x86_64/primary_db                                                                                                                             | 204 kB  00:00:00
(8/9): base/7/x86_64/primary_db                                                                                                                               | 5.9 MB  00:00:01
(9/9): updates/7/x86_64/primary_db                                                                                                                            | 6.0 MB  00:00:02
Determining fastest mirrors
 * base:
 * epel:
 * extras:
 * updates:
elasticsearch-5.x                                                                                                                                                            386/386
epel                                                                                                                                                                     12742/12742
Resolving Dependencies
--> Running transaction check
---> Package graylog-server.noarch 0:3.0.0-2.alpha.2 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

 Package                                        Arch                                   Version                                         Repository                               Size
 graylog-server                                 noarch                                 3.0.0-2.alpha.2                                 graylog                                  92 M

Transaction Summary
Install  1 Package

Total download size: 92 M
Installed size: 103 M
Is this ok [y/d/N]: n

(Satishdotpatel) #6

never mind, after modifying repo file to following it work, look like something was cached somewhere


Anyway now i am seeing no error and looks good and i sending some logs from Cisco switches but they are not showing up in search does graylog takes some time to process logs or its realtime?

after google i found you need to change timestamp because graylog use UTS and my all switches use EST so this is what i did in server.conf file

root_timezone = America/New_York

now in System/Overview i can see timestamp in EST but still not processing logs what else i should check?

(system) #7

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.