Elasticsearch Dangling index after retention (archive enterprise)

Hi all,
Since last week, it’s the second time that i find my elasticsearch cluster in RED state. When i look at it, i find that the archive plugin (i have enterprise version) was running and for a strange reason the indice was not deleted after archiving (and i donc know if the archive was good)

On ELS cluster it show me (with curl -XGET localhost:9200/_cat/shards?h=index,shard,prirep,state,unassigned.reason| grep UNASSIGNED )

graylog2_244 4 p UNASSIGNED DANGLING_INDEX_IMPORTED
graylog2_244 4 r UNASSIGNED DANGLING_INDEX_IMPORTED
graylog2_244 1 p UNASSIGNED DANGLING_INDEX_IMPORTED
graylog2_244 1 r UNASSIGNED DANGLING_INDEX_IMPORTED
graylog2_244 2 p UNASSIGNED DANGLING_INDEX_IMPORTED
graylog2_244 2 r UNASSIGNED DANGLING_INDEX_IMPORTED

The graylog2_244 should have been deleted after archiving
Do you have any ideas ?
Same problem last week and i have to manually delete the indice…

I’m using elasticsearch 2.4 (5 nodes) ang Graylog 2.2.3 (4 nodes)

Thanks in advance
Johan

Please contact Graylog support if you have problems with Graylog Enterprise.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.