Elasticsearch Dangling index after retention (archive enterprise)


(Johan THOMAS) #1

Hi all,
Since last week, it’s the second time that i find my elasticsearch cluster in RED state. When i look at it, i find that the archive plugin (i have enterprise version) was running and for a strange reason the indice was not deleted after archiving (and i donc know if the archive was good)

On ELS cluster it show me (with curl -XGET localhost:9200/_cat/shards?h=index,shard,prirep,state,unassigned.reason| grep UNASSIGNED )

graylog2_244 4 p UNASSIGNED DANGLING_INDEX_IMPORTED
graylog2_244 4 r UNASSIGNED DANGLING_INDEX_IMPORTED
graylog2_244 1 p UNASSIGNED DANGLING_INDEX_IMPORTED
graylog2_244 1 r UNASSIGNED DANGLING_INDEX_IMPORTED
graylog2_244 2 p UNASSIGNED DANGLING_INDEX_IMPORTED
graylog2_244 2 r UNASSIGNED DANGLING_INDEX_IMPORTED

The graylog2_244 should have been deleted after archiving
Do you have any ideas ?
Same problem last week and i have to manually delete the indice…

I’m using elasticsearch 2.4 (5 nodes) ang Graylog 2.2.3 (4 nodes)

Thanks in advance
Johan


(Jochen) #2

Please contact Graylog support if you have problems with Graylog Enterprise.


(system) #3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.