graylog_Index_error

Graylog Central (peer support)
1

Hi,

We recently had a power outage in our office and since the reboot, Graylog is throwing the below error
I tried recalculating the index manually and even rotated the active write index manually no luck can someone help me on this if they had any similar problem?

Index not found for query: graylog_0. Try recalculating your index ranges.
at org.graylog2.indexer.cluster.jest.JestUtils.buildIndexNotFoundException(JestUtils.java:134) ~[graylog.jar:?]
at org.graylog2.indexer.cluster.jest.JestUtils.specificException(JestUtils.java:96) ~[graylog.jar:?]
at org.graylog2.indexer.cluster.jest.JestUtils.execute(JestUtils.java:60) ~[graylog.jar:?]
at org.graylog2.indexer.cluster.jest.JestUtils.execute(JestUtils.java:65) ~[graylog.jar:?]
at org.graylog.events.search.MoreSearch.scrollQuery(MoreSearch.java:273) ~[graylog.jar:?]
at org.graylog.events.processor.aggregation.AggregationEventProcessor.filterSearch(AggregationEventProcessor.java:210) ~[graylog.jar:?]
at org.graylog.events.processor.aggregation.AggregationEventProcessor.createEvents(AggregationEventProcessor.java:121) ~[graylog.jar:?]
at org.graylog.events.processor.EventProcessorEngine.execute(EventProcessorEngine.java:92) ~[graylog.jar:?]

2

Hello,

@kvenkat971

Maybe I can help.

What do you get after executing these?

curl http://localhost:9200/_cat/indices

If there is a problem execute this and it should tell you whats wrong.

curl -XGET http://localhost:9200/_cluster/allocation/explain?pretty

Hope that helps

3

I got the output for the cat indices and I can’t see graylog_0 in their

This is the output for the second command
{
“index” : “filebeat-6.1.1-2018.06.28”,
“shard” : 2,
“primary” : false,
“current_state” : “unassigned”,
“unassigned_info” : {
“reason” : “CLUSTER_RECOVERED”,
“at” : “2021-06-17T07:19:34.913Z”,
“last_allocation_status” : “no_attempt”
},
“can_allocate” : “no”,
“allocate_explanation” : “cannot allocate because allocation is not permitted to any of the nodes”,
“node_allocation_decisions” : [
{
“node_id” : “AWg1Gxp1QraOR4CZrc3cNg”,
“node_name” : “AWg1Gxp”,
“transport_address” : “...:9300”,
“node_decision” : “no”,
“deciders” : [
{
“decider” : “same_shard”,
“decision” : “NO”,
“explanation” : “the shard cannot be allocated to the same node on which a copy of the shard already exists [[filebeat-6.1.1-2018.06.28][2], node[AWg1Gxp1QraOR4CZrc3cNg], [P], s[STARTED], a[id=ztWVQI-PSE25GIiwYZkE9A]]”
}
]
}
]
}

4

looks like the problem got fixed, I can see the logs on the dashboard now, not sure what happened though

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.