# Deflector exists as an index and is not an alias. GL 3.3 **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [June 15, 2020, 11:12pm UTC](https://community.graylog.org/t/deflector-exists-as-an-index-and-is-not-an-alias-gl-3-3/15956 "2020-06-15T23:12:57Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![commandline-be](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/commandline-be/32/7235_2.png) [@commandline-be](https://community.graylog.org/u/commandline-be)\ **Post date:** [June 15, 2020, 11:12pm UTC](https://community.graylog.org/t/deflector-exists-as-an-index-and-is-not-an-alias-gl-3-3/15956/1 "2020-06-15T23:12:58Z")
Hey, Despite trying out a number of appraoches i remain stuck with " Deflector exists as an index and is not an alias. (triggered 8 hours ago)" After deleting all indices i see this, no fix. curl -XGET localhost:9200/\_cat/shards?h=index,shard,prirep,state,unassigned.reason graylog\_1 3 p UNASSIGNED INDEX\_CREATED graylog\_1 1 p UNASSIGNED INDEX\_CREATED graylog\_1 2 p UNASSIGNED INDEX\_CREATED graylog\_1 0 p UNASSIGNED INDEX\_CREATED graylog\_0 3 p UNASSIGNED INDEX\_CREATED graylog\_0 1 p UNASSIGNED INDEX\_CREATED graylog\_0 2 p UNASSIGNED INDEX\_CREATED graylog\_0 0 p UNASSIGNED INDEX\_CREATED gl-events\_0 3 p UNASSIGNED INDEX\_CREATED gl-events\_0 1 p UNASSIGNED INDEX\_CREATED gl-events\_0 2 p UNASSIGNED INDEX\_CREATED gl-events\_0 0 p UNASSIGNED INDEX\_CREATED ----------------------------------------- **indicator for configuration flaw, but all seems to be well** WARN [BufferSynchronizerService] Elasticsearch is unavailable. Not waiting to clear buffers and caches, as we have no healthy cluster. ----------------------------------------- updated **Which ever index set i look into i get:** ``` We could not get the indices overview information. This usually means there was a problem connecting to Elasticsearch, and **you should ensure Elasticsearch is up and reachable from Graylog**. Graylog will continue storing your messages in its journal, but you will not be able to search on them until Elasticsearch is reachable again. ``` **Despite** the indication at least the state can be read from the cluster ``` Elasticsearch cluster The possible Elasticsearch cluster states and more related information is available in the [Graylog documentation](https://docs.graylog.org/en/3.3/pages/configuration/elasticsearch.html).** Elasticsearch cluster is yellow. Shards: 0 active, 0 initializing, 0 relocating, 16 unassigned, [What does this mean?](https://docs.graylog.org/en/3.3/pages/configuration/elasticsearch.html#cluster-status-explained) ``` ----------------------- After fresh install (apt remove for elasticsearch and graylog, mongo) ● graylog-server.service - Graylog server Loaded: loaded (/lib/systemd/system/graylog-server.service; enabled; vendor preset: enabled) Active: active (running) since Tue 2020-06-16 09:46:53 CEST; 25s ago Docs: [http://docs.graylog.org/](http://docs.graylog.org/) Main PID: 3891 (graylog-server) Tasks: 110 (limit: 4654) Memory: 694.2M CGroup: /system.slice/graylog-server.service ├─3891 /bin/sh /usr/share/graylog-server/bin/graylog-server └─3910 /usr/bin/java -Xms1g -Xmx1g -XX:NewRatio=1 -server -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:-OmitStackTraceInFastThr Jun 16 09:46:53 machine systemd[1]: Started Graylog server. Jun 16 09:46:54 machine graylog-server[3891]: OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version 9.0 and will likely be removed in a future release. Jun 16 09:46:54 machine graylog-server[3891]: WARNING: sun.reflect.Reflection.getCallerClass is not supported. This will impact performance. Jun 16 09:46:55 machine graylog-server[3891]: WARNING: An illegal reflective access operation has occurred Jun 16 09:46:55 machine graylog-server[3891]: WARNING: Illegal reflective access by com.google.inject.assistedinject.FactoryProvider2$MethodHandleWrapper (file:/usr/share/graylog-server/graylog.ja Jun 16 09:46:55 machine graylog-server[3891]: WARNING: Please consider reporting this to the maintainers of com.google.inject.assistedinject.FactoryProvider2$MethodHandleWrapper Jun 16 09:46:55 machine graylog-server[3891]: WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations Jun 16 09:46:55 machine graylog-server[3891]: WARNING: All illegal access operations will be denied in a future release ---
**Author:** ![commandline-be](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/commandline-be/32/7235_2.png) [@commandline-be](https://community.graylog.org/u/commandline-be)\ **Post date:** [June 16, 2020, 9:39am UTC](https://community.graylog.org/t/deflector-exists-as-an-index-and-is-not-an-alias-gl-3-3/15956/3 "2020-06-16T09:39:07Z")
For **Elasticsearch cluster is yellow.** Shards: 0 active, 0 initializing, 0 relocating, 12 unassigned The number of unassigned was reduced from 20 to 12 by checking output for curl [http://localhost:9200/\_aliases?pretty](http://localhost:9200/_aliases?pretty) by stopping graylog and deleting any \_deflector index now the list is clean but no luck resolving the **unreachable or unhealty** status for ES from GL ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [June 16, 2020, 9:40am UTC](https://community.graylog.org/t/deflector-exists-as-an-index-and-is-not-an-alias-gl-3-3/15956/4 "2020-06-16T09:40:51Z")
fix the unassigned shards and the cluster will be green > **[How to resolve unassigned shards in Elasticsearch](https://www.datadoghq.com/blog/elasticsearch-unassigned-shards/)** > > Explore six ways to investigate and resolve issues with unassigned Elasticsearch shards. ---
**Author:** ![commandline-be](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/commandline-be/32/7235_2.png) [@commandline-be](https://community.graylog.org/u/commandline-be)\ **Post date:** [June 16, 2020, 9:42am UTC](https://community.graylog.org/t/deflector-exists-as-an-index-and-is-not-an-alias-gl-3-3/15956/5 "2020-06-16T09:42:35Z")
i have stop graylog again and remove any index i saw in the output for curl [http://localhost:9200/\_aliases?pretty](http://localhost:9200/_aliases?pretty) the status for **ES is now green** but the deflector issue persists ---
**Author:** ![commandline-be](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/commandline-be/32/7235_2.png) [@commandline-be](https://community.graylog.org/u/commandline-be)\ **Post date:** [June 16, 2020, 9:47am UTC](https://community.graylog.org/t/deflector-exists-as-an-index-and-is-not-an-alias-gl-3-3/15956/6 "2020-06-16T09:47:11Z")
**now at** : cannot allocate because allocation is not permitted to any of the nodes **may be** because i run ES and GL on a single node setup ? ---
**Author:** ![commandline-be](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/commandline-be/32/7235_2.png) [@commandline-be](https://community.graylog.org/u/commandline-be)\ **Post date:** [June 16, 2020, 10:10am UTC](https://community.graylog.org/t/deflector-exists-as-an-index-and-is-not-an-alias-gl-3-3/15956/7 "2020-06-16T10:10:38Z")
Thanks but this is where i was at just before, i do not find a fix for the allocation notification ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [June 16, 2020, 2:39pm UTC](https://community.graylog.org/t/deflector-exists-as-an-index-and-is-not-an-alias-gl-3-3/15956/8 "2020-06-16T14:39:09Z")
you need to find the reason why elasticsearch can’t allocate the indices. The log should tell you what the problem is. I mean the elasticsearch log. ---
**Author:** ![commandline-be](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/commandline-be/32/7235_2.png) [@commandline-be](https://community.graylog.org/u/commandline-be)\ **Post date:** [June 17, 2020, 7:06am UTC](https://community.graylog.org/t/deflector-exists-as-an-index-and-is-not-an-alias-gl-3-3/15956/9 "2020-06-17T07:06:56Z")
Just checked, nothing sensible. This reminds me of why i left graylog the last time, it is not just graylog one has to learn, it are also the fragilitie and interoperations. I feel there is still a lot of improvement possible with how graylog handles elasticsearch.For less experienced users it would save a lot of time, and pressure on the forum. ---
**Author:** ![commandline-be](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/commandline-be/32/7235_2.png) [@commandline-be](https://community.graylog.org/u/commandline-be)\ **Post date:** [June 17, 2020, 7:46am UTC](https://community.graylog.org/t/deflector-exists-as-an-index-and-is-not-an-alias-gl-3-3/15956/10 "2020-06-17T07:46:36Z")
**ERROR** [Messages] Failed to index [4] messages. Please check the index error log in your web interface for the reason. Error: One or more of the items in the Bulk request failed, check BulkResult.getItems() for more information. “error log in your web interface” in Graylog says many many many times, while graylog\_deflector is typically an alias |2 hours ago|graylog\_deflector|6923e540-b06f-11ea-9ed3-7e053dcd3d04|{“type”:“index\_not\_found\_exception”,“reason”:“no such index”,“resource.type”:“index\_expression”,“resource.id”:“graylog\_deflector”,“index\_uuid”:“_na_”,“index”:“graylog\_deflector”}| ---
**Author:** ![commandline-be](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/commandline-be/32/7235_2.png) [@commandline-be](https://community.graylog.org/u/commandline-be)\ **Post date:** [June 17, 2020, 7:56am UTC](https://community.graylog.org/t/deflector-exists-as-an-index-and-is-not-an-alias-gl-3-3/15956/11 "2020-06-17T07:56:25Z")
Currently Graylog remains without error (in the green), **until** i enter system-indices click on an index What stumps me is it lists 4 indices but states: **Total:** 0 indices, 0 documents, 0B After reboot, the server now boots into a “green” state with no change in effective usability DEBUG … All shards failed for phase: [dfs] Checking both /var/lib/elasticsearch and /var/lib/graylog/ i notice there indices may be not even there, total size is 48KB and 1.9MB respectively of which 1.6 for the journal alone. With no data in place i did rm -Rf for both /var/lib/elasticsearch/\* and /var/lib/graylog/\* to no avail the service is now in the green but **still not one index is created** despite having created an index using the Graylog web interface. This newly created index also results in an error stating the index could not be found when accessing it over system indices. ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [June 17, 2020, 8:56am UTC](https://community.graylog.org/t/deflector-exists-as-an-index-and-is-not-an-alias-gl-3-3/15956/12 "2020-06-17T08:56:26Z")
the elasticsearch logfile should tell you why the indices are not created at all. But what Elasticsearch Version did you try to use with Graylog? ---
**Author:** ![commandline-be](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/commandline-be/32/7235_2.png) [@commandline-be](https://community.graylog.org/u/commandline-be)\ **Post date:** [June 17, 2020, 8:57am UTC](https://community.graylog.org/t/deflector-exists-as-an-index-and-is-not-an-alias-gl-3-3/15956/13 "2020-06-17T08:57:50Z")
using ES 6.8.10 Those logs are a mess if you are not accustomed to them. curl -X PUT “localhost:9200/someindex?pretty” { “acknowledged” : true, “shards\_acknowledged” : **false** , “index” : “logs\_and\_events” } tried every connectivity test possible, i do not see why graylog insists on being unable to reach ES while they both run on localhost and on the same system Found: [IndexFieldTypePollerPeriodical] Active write index for index set “Default index set” (5edd25147c826c2f5211a7fe) **doesn’t exist yet** ---
**Author:** ![commandline-be](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/commandline-be/32/7235_2.png) [@commandline-be](https://community.graylog.org/u/commandline-be)\ **Post date:** [June 17, 2020, 9:30am UTC](https://community.graylog.org/t/deflector-exists-as-an-index-and-is-not-an-alias-gl-3-3/15956/14 "2020-06-17T09:30:32Z")
Even after a **completely fresh install** using the pre existing configuration i get this INFO when starting graylog INFO [IndexRangesCleanupPeriodical] Skipping index range cleanup because the Elasticsearch cluster is unreachable or unhealthy Bizarrely enough, graylog seems to ‘remember’ the entire previous configuration and failed indexing attempts, i do not understand this at all since i erased what i could find for both ES and GL reinstalling again, this time also clearing out anything mongod-org ---
**Author:** ![commandline-be](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/commandline-be/32/7235_2.png) [@commandline-be](https://community.graylog.org/u/commandline-be)\ **Post date:** [June 17, 2020, 10:27am UTC](https://community.graylog.org/t/deflector-exists-as-an-index-and-is-not-an-alias-gl-3-3/15956/15 "2020-06-17T10:27:29Z")
Started over by hunting for artefacts left from mongod, elasticsearch-oss and graylog-server The setup is now clean again (finally) and there is ONE apparent error which is likely the root cause > Could not retrieve global index stats. > > Fetching global index stats failed: cannot GET [http://127.0.0.1:9000/api/system/indices/index\_sets/stats](http://127.0.0.1:9000/api/system/indices/index_sets/stats) (500) ---
**Author:** ![commandline-be](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/commandline-be/32/7235_2.png) [@commandline-be](https://community.graylog.org/u/commandline-be)\ **Post date:** [June 17, 2020, 12:38pm UTC](https://community.graylog.org/t/deflector-exists-as-an-index-and-is-not-an-alias-gl-3-3/15956/18 "2020-06-17T12:38:33Z")
**status = fixed** this result only after repeat reinstallations, no way to salvage the data was found but appears to be available, for this test setup not important **context** : running a single-node setup hosting both graylog and elastic and mongod configuration changes leading to fix **elasticsearch** node.data: true **graylog** commented both #elasticsearch\_shards = 4 #elasticsearch\_replicas = 0 ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [July 1, 2020, 12:38pm UTC](https://community.graylog.org/t/deflector-exists-as-an-index-and-is-not-an-alias-gl-3-3/15956/19 "2020-07-01T12:38:35Z")
Closed on July 1, 2020, 12:38pm UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.