Hello, Previously my index was set to store logs for about 4 years. That was my first, initial, and not quite a wise setting. But it was, and it worked. Unfortunatelly partition where folder /var is mounted (where I think logs from Graylog are stored) is occupied in 55%. I think this causes that index in Graylog won’t accept new logs - it shows " There were 204,800 failed indexing attempts in the last 24 hours." Few days ago I changed index roration period from 4 years to P1W (7d, 7 days) but It does not delete old logs. Previously index has 20.7GB and today also it have exact the same size. What should I change to delete old logs? Best Regards [graylog_index]

you have your elasticsearch on the same host? Did you checked the elasticsearch logfiles? Maybe that is read-only. But without the log that is guessing only.

Yes, elasticsearch is on the same host, and it is in read only state. I know that and I thought this is due to the decreasing amount of free space. I tried to fix this by reducing time for index rotation. Am I wrong? Below are last entries from server.log WARN [Messages] Failed to index message: index= id= error= ERROR [Messages] Failed to index [19] messages. Please check the index error log in your web interface for the reason. Error: One or more of the items in the Bulk request failed, check BulkResult.getItems() for more information.

you need to make elasticsearch writable again that Graylog is able to do any index manipulation.

Yes Jan - I know that cause of this problem is elasticsearch in read only state. But I don’t know how can I change that state … :confused: Any suggestions how to solve this problem?

[image] Restart collecting messages Graylog Central (peer support) The command below solved my problem: $ curl -X PUT “http://127.0.0.1:9200/settings?pretty” -H ‘Content-Type: application/json’ -d ‘{“index”: {“blocks”: {“read_only_allow_delete”: “false”}}}’ { “acknowledged” : true, “shards_acknowledged” : true, “index” : “settings” } Thanks to everyone who helped me

@Karlis thank you for reply. After use that command I got: { "error" : { "root_cause" : [ { "type" : "resource_already_exists_exception", "reason" : "index [settings/5GJ9lZHLTuGvqBfZjW6PLw] already exists", "index_uuid" : "5GJ9lZHLTuGvqBfZjW6PLw", "index" : "settings" } ], "type" : "resource_already_exists_exception", "reason" : "index [settings/5GJ9lZHLTuGvqBfZjW6PLw] already exists", "index_uuid" : "5GJ9lZHLTuGvqBfZjW6PLw", "index" : "settings" }, "status" : 400 } Hm. I think this is job for elasticsearch developer, not for user who want to log simple data do GrayLog.

[Kristofer] How to undo setting Elasticsearch Index to readonly? elasticsearch answered by Kristofer on 05:37PM - 20 Jun 18 UTC

Graylog index rotation not working

Graylog Central (peer support)

Karlis July 31, 2019, 10:20am 6

Topic		Replies	Views
Graylog does not search! Graylog Central (peer support)	14	3672	June 20, 2019
Index rotation failure Graylog Central (peer support)	4	10645	September 9, 2019
Indexer failures - Elastis search how to delete old indices Graylog Central (peer support)	2	1135	February 13, 2020
Indexer Failures NEW Graylog Central (peer support)	4	9387	May 21, 2019
Elasticsearch becomes readonly everyday for unknown reason Graylog Central (peer support)	2	862	August 11, 2020

Graylog index rotation not working

Related topics