# Graylog\_deflector exists as an indexer and is not an alias **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [October 26, 2018, 5:43pm UTC](https://community.graylog.org/t/graylog-deflector-exists-as-an-indexer-and-is-not-an-alias/7413 "2018-10-26T17:43:48Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![jerami1981](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jerami1981/32/3202_2.png) [@jerami1981](https://community.graylog.org/u/jerami1981)\ **Post date:** [October 26, 2018, 5:43pm UTC](https://community.graylog.org/t/graylog-deflector-exists-as-an-indexer-and-is-not-an-alias/7413/1 "2018-10-26T17:43:48Z")
I have read through numerous posts on this issue, but between the fixes being somewhat vague, and my lack of knowledge in the graylog, and ubuntu world, have been unable to resolve the issue. I have tried (possibly incorrectly) to add the action.auto\_create\_index: false to the elasticsearch.yml file. I have removed the deflector indice, but it repopulates within a minute or so. I am sure others will need some more info to help me diagnose the issue, and if you are willing to point me in the direction of what is needed, and how to get it, I will gladly acquire such info. What I do know is I am running this on a VM with Ubuntu 16.04.5 LTS. I followed the instructions on [docs.graylog.org/en/2.4/pages/installation/os/ubuntu.html](http://docs.graylog.org/en/2.4/pages/installation/os/ubuntu.html) I should be running some vesion of 2.4 for GL, and 5.X for elastic search. Mongo DB should be up to date. ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [October 26, 2018, 7:50pm UTC](https://community.graylog.org/t/graylog-deflector-exists-as-an-indexer-and-is-not-an-alias/7413/2 "2018-10-26T19:50:44Z")
in the documentation is a step-by-step guide to resolve this: [http://docs.graylog.org/en/2.4/pages/faq.html#how-do-i-fix-the-deflector-exists-as-an-index-and-is-not-an-alias-error-message](http://docs.graylog.org/en/2.4/pages/faq.html#how-do-i-fix-the-deflector-exists-as-an-index-and-is-not-an-alias-error-message) > - Stop all Graylog nodes > - (OPTIONAL) If you want to keep the already ingested messages, reindex them into the Elasticsearch index with the greatest number, e. g. graylog\_23 if you want to fix the deflector graylog\_deflector, via the Elasticsearch Reindex API. > - Delete the graylog\_deflector index via the Elasticsearch Delete Index API. > - Add action.auto\_create\_index: false to the configuration files of all Elasticsearch nodes in your cluster and restart these Elasticsearch nodes > - Start the Graylog master node. > - Manually rotate the active write index of the index set on the System / Indices / Index Set page in the Maintenance dropdown menu. > - (OPTIONAL) Start all remaining Graylog slave nodes. ---
**Author:** ![jerami1981](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jerami1981/32/3202_2.png) [@jerami1981](https://community.graylog.org/u/jerami1981)\ **Post date:** [October 26, 2018, 9:16pm UTC](https://community.graylog.org/t/graylog-deflector-exists-as-an-indexer-and-is-not-an-alias/7413/3 "2018-10-26T21:16:11Z")
Steps I took when attempting this, in case someone sees an issue. I only have one node. When logged into my server directly. #1 sudo systemctl stop graylog-server.service #2 curl -XDELETE [http://localhost:9200/graylog\_deflector](http://localhost:9200/graylog_deflector) #3 curl [http://localhost:9200/\_cat/indices](http://localhost:9200/_cat/indices) to verify deletion #4 sudo nano /etc/elasticsearch/elasticsearch.yml #5 add “action.auto\_create\_index: false”, save file, and exit file. as seen in image below #6 sudo systemctl restart graylog-server.service #7 From browser-System/Indices/GraylogDeflector/Maintenance/Rotate Active Write Index No other nodes to start, so done. After a reboot this appears to be holding. I now however, have Index failures stacking up for graylog\_deflector. Are these something i can ignore, or do I need to address this? ![graylog](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/4/4d84827744a4232d8777cf7b23fb4618fe0a6397.jpeg) ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [October 29, 2018, 9:02am UTC](https://community.graylog.org/t/graylog-deflector-exists-as-an-indexer-and-is-not-an-alias/7413/4 "2018-10-29T09:02:01Z")
> After a reboot this appears to be holding. I now however, have Index failures stacking up for graylog\_deflector. Are these something i can ignore, or do I need to address this? without a verification that this is not something new - maybe. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [November 12, 2018, 9:02am UTC](https://community.graylog.org/t/graylog-deflector-exists-as-an-indexer-and-is-not-an-alias/7413/5 "2018-11-12T09:02:02Z")
Closed on November 12, 2018, 9:02am UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.