Hello there!
I’ve migrate from Graylog 5 + elastic search to Graylog 6.2.2-1 + Openserach 2.13.0 on Ubuntu 22.04 server.
All data from elastic was wiped and I’ve run Graylog 6.2.2 on fresh installed Openserach cluster.
Versions:
Ubuntu Server 22.04
Graylog: 6.2.2
Openserach: 2.13.0
MongoDB: 6.0.12
Topology:
2 x Graylog servers (1 leader + 1 non-leader)
3 x MongoDB instances (2 data, 1 arbiter for voting)
3 x Opensearch instances (2 x node.roles: master, data and 1 voting only)
Problem:
I’ve create a test indices through graylog admin interface. After some time I’ve delete them.
Indices was removed from graylog interface, but it was recreated in opensearch and it was triggered by graylog.
Index retention is Legacy type
Log:
2025-06-23T11:26:44.135Z INFO [IndexSetCleanupJob] Deleting index template <21da33573e-production-test-iptables0001-template> from Elasticsearch
2025-06-23T11:26:44.219Z INFO [Indices] Successfully deleted index template 21da33573e-production-test-iptables0001-template
2025-06-23T11:26:44.220Z INFO [IndexSetCleanupJob] Removing index range information for index: 21da33573e-production-test-iptables0001_0
2025-06-23T11:26:44.221Z INFO [IndexSetCleanupJob] Deleting index <21da33573e-production-test-iptables0001_0> in index set <68592512f8e9f8a69ff11010> (production/test-iptables0001)
2025-06-23T11:26:44.350Z INFO [SystemJobManager] SystemJob [org.graylog2.indexer.indices.jobs.IndexSetCleanupJob] finished in 220ms.
2025-06-23T11:26:46.991Z INFO [MongoIndexSet] Did not find a deflector alias. Setting one up now.
2025-06-23T11:26:47.015Z INFO [MongoIndexSet] There is no index target to point to. Creating one now.
2025-06-23T11:26:47.025Z INFO [MongoIndexSet] Cycling from to <21da33573e-production-test-iptables0001_0>.
2025-06-23T11:26:47.025Z INFO [MongoIndexSet] Creating target index <21da33573e-production-test-iptables0001_0>.
2025-06-23T11:26:47.119Z INFO [Indices] Successfully ensured index template 21da33573e-production-test-iptables0001-template
2025-06-23T11:26:47.346Z INFO [MongoIndexSet] Waiting for allocation of index <21da33573e-production-test-iptables0001_0>.
2025-06-23T11:26:47.528Z INFO [MongoIndexSet] Index <21da33573e-production-test-iptables0001_0> has been successfully allocated.
2025-06-23T11:26:47.528Z INFO [MongoIndexSet] Pointing index alias <21da33573e-production-test-iptables0001_deflector> to new index <21da33573e-production-test-iptables0001_0>.
2025-06-23T11:26:47.583Z INFO [MongoIndexSet] Successfully pointed index alias <21da33573e-production-test-iptables0001_deflector> to index <21da33573e-production-test-iptables0001_0>.
Total:
Index not managed by gralyog, because no more metadata stored in mongodb, but index was delete in opensearch and after few second recreated by graylog.
Recreated index + alias + templates
What I do wrong? Is this an issue? I can’t reproduce it on test(docker) install.