deleting the incorrect deflector index, Graylog automatically recreates

New to Graylog Community? READ-ME FIRST Guides
1

I am facing a recurring issue in my Graylog setup where the deflector alias (e.g., graylog_deflector, gl-events_deflector) becomes an index instead of an alias. This causes logs to stop flowing, and queries fail with the error:

Elasticsearch exception [type=index_not_found_exception, reason=no such index ]
:mag: Observations:
Running curl -X GET “http://10.13.10.20:9200/_cat/aliases?v” shows:

alias index filter routing.index routing.search is_write_index
gl-events_deflector gl-events_0 - - - -
graylog_deflector gl-events_0 - - - -
gl-system-events_deflector gl-system-events_0 - - - -
The deflector should be an alias but sometimes turns into an index.

Running curl -X GET “http://10.13.10.20:9200/_cat/indices?v” shows only these indices:

pgsql
Copy
Edit
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
green open .geoip_databases Trcn78hNRquTZMd3zt–Og 1 1 37 9 77.9mb 38.9mb
green open read_me cSygCrtEQG2t68yNSuFodQ 1 1 1 0 8.8kb 4.4kb
green open gl-events_0 1IY_fxpSSAagbooCywP2cQ 4 0 0 0 904b 904b
green open gl-system-events_0 a4AH-3MoScO2PX8pjeTYZw 4 0 0 0 904b 904b
However, the issue arises when Graylog rotates the index.

:gear: Steps I Tried to Fix It:
Manually deleting and recreating the deflector alias

curl -X POST “http://10.13.10.20:9200/_aliases” -H ‘Content-Type: application/json’ -d ’
{
“actions”: [
{ “add”: { “index”: “gl-events_0”, “alias”: “graylog_deflector” } }
]
}’
This temporarily fixes the issue, but it happens again after 2-3 days.

Manually rotating the index in Graylog UI under:
System → Indices → Rotate Active Write Index
This also works temporarily.

Restarting Graylog (systemctl restart graylog-server) to refresh the index mapping.

:red_circle: Issue Persists:
Even after deleting the incorrect deflector index, Graylog automatically recreates it incorrectly after 2-3 days.

2

I notice that graylog_deflector is pointing to gl-events_0 index.
I would expect it to be pointing to graylog_0, which is the default message index. It looks like that is missing.

GL does some amount of self-healing. You can try to remove the graylog_deflector and restart the system. Or create a new index and designate that as default index. In any case, your log messages should not be going to the gl_events index.

3

Hey @omkark,

Within opensearch.yml do you have the below setting?

action.auto_create_index setting = false

4

It is already false, still getting same issue.