Errors report when rotate index set

I have create my own index set and add an custom index template. after i XPUT the custom index template, i rotate my index set, and i found the following error report in graylog server log:

2018-04-18T15:13:44.772+08:00 INFO  [DeflectorResource] Cycling deflector for index set <5ad6ed7b39445505569abc56>. Reason: REST request.
2018-04-18T15:13:44.780+08:00 INFO  [MongoIndexSet] Cycling from <test_0> to <test_1>.
2018-04-18T15:13:44.780+08:00 INFO  [MongoIndexSet] Creating target index <test_1>.
2018-04-18T15:13:44.822+08:00 INFO  [Indices] Successfully created index template test-template
2018-04-18T15:13:45.398+08:00 INFO  [MongoIndexSet] Waiting for allocation of index <test_1>.
2018-04-18T15:13:45.404+08:00 INFO  [MongoIndexSet] Index <test_1> has been successfully allocated.
2018-04-18T15:13:45.405+08:00 INFO  [MongoIndexSet] Pointing index alias <test_deflector> to new index <test_1>.
2018-04-18T15:13:45.579+08:00 INFO  [SystemJobManager] Submitted SystemJob <08616590-42d8-11e8-887f-525400ca1804> []
2018-04-18T15:13:45.579+08:00 INFO  [MongoIndexSet] Successfully pointed index alias <test_deflector> to index <test_1>.
2018-04-18T15:14:15.583+08:00 ERROR [SystemJobManager] Unhandled error while running SystemJob <08616590-42d8-11e8-887f-525400ca1804> []
java.lang.IllegalArgumentException: Cat response did not contain a JSON Array
	at io.searchbox.core.Cat.parseResponseBody( ~[graylog.jar:?]
	at io.searchbox.action.AbstractAction.createNewElasticSearchResult( ~[graylog.jar:?]
	at io.searchbox.core.Cat.createNewElasticSearchResult( ~[graylog.jar:?]
	at io.searchbox.core.Cat.createNewElasticSearchResult( ~[graylog.jar:?]
	at io.searchbox.client.http.JestHttpClient.deserializeResponse( ~[graylog.jar:?]
	at io.searchbox.client.http.JestHttpClient.execute( ~[graylog.jar:?]
	at org.graylog2.indexer.cluster.jest.JestUtils.execute( ~[graylog.jar:?]
	at org.graylog2.indexer.cluster.jest.JestUtils.execute( ~[graylog.jar:?]
	at org.graylog2.indexer.indices.Indices.catIndices( ~[graylog.jar:?]
	at org.graylog2.indexer.indices.Indices.getClosedIndices( ~[graylog.jar:?]
	at org.graylog2.indexer.indices.Indices.isClosed( ~[graylog.jar:?]
	at ~[graylog.jar:?]
	at$ [graylog.jar:?]
	at com.codahale.metrics.InstrumentedScheduledExecutorService$ [graylog.jar:?]
	at java.util.concurrent.Executors$ [?:1.8.0_162]
	at [?:1.8.0_162]
	at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201( [?:1.8.0_162]
	at java.util.concurrent.ScheduledThreadPoolExecutor$ [?:1.8.0_162]
	at java.util.concurrent.ThreadPoolExecutor.runWorker( [?:1.8.0_162]
	at java.util.concurrent.ThreadPoolExecutor$ [?:1.8.0_162]
	at [?:1.8.0_162]

also in the elasticsearch log, there are errors reported:

cat graylog_deprecation.log
[2018-04-18T15:11:35,288][WARN ][o.e.d.r.RestController   ] Content type detection for rest requests is deprecated. Specify the content type using the [Content-Type] header.
[2018-04-18T15:12:59,936][WARN ][o.e.d.r.RestController   ] Content type detection for rest requests is deprecated. Specify the content type using the [Content-Type] header.

cat graylog.log
[2018-04-18T13:19:32,839][WARN ][c.f.s.c.PrivilegesEvaluator] graylog_deflector does not exist in cluster metadata
[2018-04-18T13:19:33,131][WARN ][c.f.s.c.PrivilegesEvaluator] graylog_0 does not exist in cluster metadata
[2018-04-18T15:02:22,633][WARN ][c.f.s.c.PrivilegesEvaluator] test_deflector does not exist in cluster metadata
[2018-04-18T15:13:44,825][WARN ][c.f.s.c.PrivilegesEvaluator] test_1 does not exist in cluster metadata

i am using elasticsearch 5.6.8-1 with search guard 5.6.8-19.

Does it work without Search Guard?

Also, this looks like a duplicate of Can not search and does not display input and sources statistic with pipeline

Oh. yes. this also comes without search guard.

Try recalculating index ranges for the “Test” index set or delete that index set and recreate it.

1 Like

after do “Recalculating index ranges” operation, and manually re-rotate the index set again, this error doesn’t come again.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.