I’m migrating from Graylog 3.2.x to 4.x and I have made an elastic backup from 3.x. [image] HOW TO CREATE SNAPSHOT And RESTORE OF ELASTICSEARCH CLUSTER DATA It is a very simple method if you want to migrate your current elasticsearch cluster to a new version or To backup and restoratio…

@mntbighker I’ve not forgotten about this–it’s just taken longer than I expect because my normal day-to-day duties have kept me pretty busy. I want to ensure I understand what you’re expecting to see. My read is that you’re expecting to see the renamed Graylog indices (both those prefixed w/ graylog…

Bump, I’m still hoping for validation I’m not about to destroy my existing logs.

Hello, Just to touch base with you. I personally have not migrating from Graylog 3.2.x to 4.x. I’ve always upgraded my server/s. Since our server/s are virtual machine’s we can create a checkpoint incase things go wrong. I am in the process of migrating my graylog server to a different OS but not…

Not exactly what I was hoping to hear :roll_eyes:

Hmmmm…I’ve not done a restore from a snapshot before, but I think you may be able to avoid overwriting existing data by renaming the indices on restore (see Restore a snapshot | Elasticsearch Reference [7.10] | Elastic ). They’d be under a different index, but should still be present and available se…

My thinking was renaming would not be required because of the GUID. But since the default index seems to have a prefix of “graylog” I may be wrong. I guess renaming is the best option since I don’t know. I suppose I’ll do something like a “7” suffix (RHEL7). “rename_pattern”: “graylog_(.+)”, “rena…

There is also a “Restored Archives” index on the new one that says “read only” and it’s empty??

My first attempt at a restore was an unmitigated disaster. Had to restore to a 10 hour old backup. It could be I simply had a missing comma in the JSON. The rename commands were totally ignored, and everything went to hell in a Fed-Ex truck very quickly. curl -XPOST “ http://localhost:9200/ snapshot…

I’ll be making another attempt today. Not only was a comma missing, but more importantly I was missing the -d switch in curl. #eyeroll

I have managed a successful data restore into Elastic on the new server. And finally managed to get the indices to be renamed. So at this point the restored indices “old_graylog_x” do NOT appear in Graylog at all. The question is how do I go about adding them in Graylog? It has a wizard to create a …

BTW, in Googling getting at other indices in Elastic (without the graylog_ prefix), other Graylog staff have said this is impossible. So now I’m really intrigued what the hell I do. @aaronsachs said they should be available under a different index. But I found other staff members saying you can only…

Elastic Restore Help Please

Graylog Central (peer support)

mntbighker (Mark M) April 9, 2021, 5:08am 15

As you can see, we have another thread started on this same topic.

Topic		Replies	Views
Snapshot and Restore index Graylog Central (peer support)	9	2201	September 30, 2021
Snapshot of graylog indices not seen Graylog Central (peer support)	7	759	May 5, 2021
Restore Elasticsearch Cluster data to new Graylog server Graylog Central (peer support) elastic	4	824	December 13, 2022
Cant see restored indices in graylog (v2.4.6) Graylog Central (peer support)	7	696	April 15, 2021
Restore data on different cluster - no data in search Graylog Central (peer support)	8	1529	July 15, 2020

Elastic Restore Help Please

Related topics