Hello,
I’m not sure all what’s going on. Your post shows two different version of Graylog. Are these the same server? To help you further I need some more information here
.
It obvious that this is a Elasticsearch/shard issue and there are some changes in the two major version.
Below are a couple commands you can use to find out what is going on with your ES shards/indices.
Check the health of ES
curl -XGET http://localhost:9200/_cluster/health?pretty=true
Check your Shards
curl -XGET http://localhost:9200/_cat/shards
For a better explanation why there are errors you can execute the following.
ES Info
curl -XGET http://localhost:9200/_cluster/allocation/explain?pretty
Hope that helps