Fix Unprocessed Messages without deleting the journal


#1

I usually have many unprocessed message in my disk journal but i used to delete the complete journal folder to fix the problem. But when i delete the journal, all my cached logs are deleted.
I would like to know if there is any other way to fix the “Unprocessed Messages” problem without deleting the journal


(Jochen) #2

That’s (unfortunately) no possible at this moment.

Please create a feature request for a journal repair tool at https://github.com/Graylog2/graylog2-server/issues


#3

Hi. You could check that the message_journal_max_size is set to a value that certainly fits on your disk. I have had quite a lot of messages (even tens of millions) in the journal, and it has always started to read them automatically, when ES catches up.


#4

thanks for your answer. here is my new issue:
https://github.com/Graylog2/graylog2-server/issues/4314


#5

i set the message_journal_max_size value to 5Gb but that is not the problem. the problem occurs when ES is down and then set up with a lot of logs to process.


#6

Ah, I see. But in that case I think the proper thing to fix would be to allow Graylog to work when ES is down, and recover automatically when ES gets up again.

That would be a useful fix, as the major version updates of ES would require a complete cluster restart, and shutting down Graylog nodes for that means losing messages that could be actually stored after the ES is back up again.


(Jochen) #7

This is how it currently works.

If it doesn’t work for @habibmbacfou, it’s a bug that has to be fixed.


(system) #8

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.