I usually have many unprocessed message in my disk journal but i used to delete the complete journal folder to fix the problem. But when i delete the journal, all my cached logs are deleted.
I would like to know if there is any other way to fix the “Unprocessed Messages” problem without deleting the journal
That’s (unfortunately) no possible at this moment.
Please create a feature request for a journal repair tool at Issues · Graylog2/graylog2-server · GitHub
Hi. You could check that the message_journal_max_size is set to a value that certainly fits on your disk. I have had quite a lot of messages (even tens of millions) in the journal, and it has always started to read them automatically, when ES catches up.
thanks for your answer. here is my new issue:
https://github.com/Graylog2/graylog2-server/issues/4314
i set the message_journal_max_size value to 5Gb but that is not the problem. the problem occurs when ES is down and then set up with a lot of logs to process.
Ah, I see. But in that case I think the proper thing to fix would be to allow Graylog to work when ES is down, and recover automatically when ES gets up again.
That would be a useful fix, as the major version updates of ES would require a complete cluster restart, and shutting down Graylog nodes for that means losing messages that could be actually stored after the ES is back up again.
This is how it currently works.
If it doesn’t work for @habibmbacfou, it’s a bug that has to be fixed.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.