Deleted Messages Indices

Graylog Central (peer support)
1

Hi,
I have the samequestion as in this post: Deleted Messages - Indices

I do not have an explication why this number is varying around ~8000
I do not have a script that is deleting messages or somthing like that.

image
image.png865×103 18.3 KB
.
This is the defaul index set.
I have another index set that is on 0 deleted messages:
image
image.png893×79 15.7 KB

Is somehow graylog is indexing documents and than is updating them again, maybe to remove image .
I am just saying,
When I put “Pause messaging Processing” on every node, it does not show deleting messages anymore, so, the graylog nodes must doing something.

Graylog 2.4 with ES 2.4 .

2

The answer I gave in the other thread is also valid for your question:

FWIW, Graylog is never deleting messages from indices. It can delete complete indices, though, depending on your configured retention policy.

3

Hi,
I want to add some info.
I have just made some security updates on the machines that runs elasticsearch and graylog processes then restart them and there are not showing anymore deleted messages. Anyway the messages weren’t deleted before, but just showed in graylog interface as deleted, and also on elasticsearch stats.
That was strange, how a restart “fixed” that.

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.