Graylog Error Indict

Dear All,

I got issue when i changed value in indict from message count to time.
Now i didn’t get latest message in my search.

Please help to share your experience.

could you please rephrase your question - I did not get what your problem is.

I try to change indict setting, after that i got issue on Indexer failures.

hmmm… I see your logs, and I see all of the answers are in your logs.
Please read it.

I didn’t get your point

Read your logs under index failures.
There will be all of the answers why this is happened.

I already solved it bro.

sharing is careing … what was the problem and how did you solve it?

I run to some comment to delete indict.

I run to some comment to delete indict.

https://media1.tenor.com/images/e795d3bfaa35b8843bf27b83e65a111d/tenor.gif?itemid=5191901

I’m sorry, but I’m lost here. I don’t even know what an “indict” is.

… Wait… I think I’m starting to understand…

I got issue when i changed value in indict from message count to time.
Now i didn’t get latest message in my search.

So you changed the retention policy of your indexes, from “rotate based on amount of messages” to “rotate based on amount of time”? Is that what you’re saying? And aside from not seeing new messages you also say you have indexer failures (which could be unrelated and a different issue).

So to echo Jan and Macko: could you please share screenshots and the actual error messages that you were seeing? And then also please share your actual solution to the problem? As in: show us the commands that you ran.

I would like to highlight, the writer didn’t check the indexer error message. It contains the exact error, and if you spend 1 minute with understanding it, it contains the solution also…

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.