I’m migrating from Graylog 3.2.x to 4.x and I have made an elastic backup from 3.x. [image] HOW TO CREATE SNAPSHOT And RESTORE OF ELASTICSEARCH CLUSTER DATA It is a very simple method if you want to migrate your current elasticsearch cluster to a new version or To backup and restoratio…

@mntbighker I’ve not forgotten about this–it’s just taken longer than I expect because my normal day-to-day duties have kept me pretty busy. I want to ensure I understand what you’re expecting to see. My read is that you’re expecting to see the renamed Graylog indices (both those prefixed w/ graylog…

Bump, I’m still hoping for validation I’m not about to destroy my existing logs.

Hello, Just to touch base with you. I personally have not migrating from Graylog 3.2.x to 4.x. I’ve always upgraded my server/s. Since our server/s are virtual machine’s we can create a checkpoint incase things go wrong. I am in the process of migrating my graylog server to a different OS but not…

Not exactly what I was hoping to hear :roll_eyes:

Hmmmm…I’ve not done a restore from a snapshot before, but I think you may be able to avoid overwriting existing data by renaming the indices on restore (see Restore a snapshot | Elasticsearch Reference [7.10] | Elastic ). They’d be under a different index, but should still be present and available se…

My thinking was renaming would not be required because of the GUID. But since the default index seems to have a prefix of “graylog” I may be wrong. I guess renaming is the best option since I don’t know. I suppose I’ll do something like a “7” suffix (RHEL7). “rename_pattern”: “graylog_(.+)”, “rena…

There is also a “Restored Archives” index on the new one that says “read only” and it’s empty??

My first attempt at a restore was an unmitigated disaster. Had to restore to a 10 hour old backup. It could be I simply had a missing comma in the JSON. The rename commands were totally ignored, and everything went to hell in a Fed-Ex truck very quickly. curl -XPOST “ http://localhost:9200/ snapshot…

I’ll be making another attempt today. Not only was a comma missing, but more importantly I was missing the -d switch in curl. #eyeroll

I have managed a successful data restore into Elastic on the new server. And finally managed to get the indices to be renamed. So at this point the restored indices “old_graylog_x” do NOT appear in Graylog at all. The question is how do I go about adding them in Graylog? It has a wizard to create a …

BTW, in Googling getting at other indices in Elastic (without the graylog_ prefix), other Graylog staff have said this is impossible. So now I’m really intrigued what the hell I do. @aaronsachs said they should be available under a different index. But I found other staff members saying you can only…

Elastic Restore Help Please

Graylog Central (peer support)

mntbighker (Mark M) April 9, 2021, 5:08am 15

As you can see, we have another thread started on this same topic.

Topic		Replies	Views
Snapshot and Restore index Graylog Central (peer support)	10	2181	October 14, 2021
Snapshot of graylog indices not seen Graylog Central (peer support)	8	756	May 19, 2021
Restore Elasticsearch Cluster data to new Graylog server Graylog Central (peer support) elastic	5	820	December 27, 2022
Cant see restored indices in graylog (v2.4.6) Graylog Central (peer support)	8	695	April 29, 2021
Restore data on different cluster - no data in search Graylog Central (peer support)	9	1526	July 29, 2020

Elastic Restore Help Please

Related topics