Error: "Event processor failed to execute" after upgrade graylog to 4.2.1

Highsmith. Thank you for detailed response.
I’ve tried to do what you said. I’ve checked status of Elasticsearch as you said (everything was fine).

If you navigate to System/Overview and scroll down to “Show Errors” button. Click on it, what do you see?

Yes. There was some kind of error similar to the error from the logs

"The Graylog server encountered an error while trying to send an email. This is the detailed error message: IndexNotFoundException{message=Unable to scroll indices. Index not found for query: critical_213. Try recalculating your index ranges., errorDetails=[Index not found for query: critical_213. Try recalculating your index ranges.]}"

critical_213 Index set so I assume your index prefix would be critical ? So you don’t see that prefix in any of your indices?

Yes, I do not have this index. But now, I think the administrator before me deleted this index manually, and GrayLog decided that this index still exists. Everything had worked fine until we rebooted the server (did upgrade to 4.2.1).
I found this (Could not execute search(Index not found for query)) thread and it helped me. I removed unneeded (critical_*) entries from MongoDB and after that Graylog works fine.

Thanks again. =)

1 Like