# Graylog not functioning **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [May 15, 2018, 12:38am UTC](https://community.graylog.org/t/graylog-not-functioning/5236 "2018-05-15T00:38:55Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![djekels](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/djekels/32/2297_2.png) [@djekels](https://community.graylog.org/u/djekels)\ **Post date:** [May 15, 2018, 12:38am UTC](https://community.graylog.org/t/graylog-not-functioning/5236/1 "2018-05-15T00:38:55Z")
I inherited this setup and with graylog running on Ubuntu 16.04.4 LTS graylog-server version is 2.3.2-1 elasticsearch is version 5.6.7 mongodb is version` 3.6.3~rc1 here is a synopsis of the current situation. In the Default Index Set, we have 1 indices but it’s not attached or something. here: 1 indices with a total of 0 messages under management, current write-active index is . the ES cluster shows up green. the inputs are gelf udp and syslog udp. i can see lots of messages coming in but under search. it shows Nothing found Any help in this matter would be greatly appreciated. Thank you ---
**Author:** ![djekels](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/djekels/32/2297_2.png) [@djekels](https://community.graylog.org/u/djekels)\ **Post date:** [May 15, 2018, 1:08am UTC](https://community.graylog.org/t/graylog-not-functioning/5236/2 "2018-05-15T01:08:35Z")
the search produces zero results. so took the json from the output hyperlink that reads “show the jason output” and ran it against the ES server got this: { “error” : { “root\_cause” : [ { “type” : “action\_request\_validation\_exception”, “reason” : “Validation Failed: 1: no settings to update;” } ], “type” : “action\_request\_validation\_exception”, “reason” : “Validation Failed: 1: no settings to update;” }, “status” : 400 } ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [May 15, 2018, 6:41am UTC](https://community.graylog.org/t/graylog-not-functioning/5236/3 "2018-05-15T06:41:23Z")
Check the logs of your Graylog and Elasticsearch nodes. ➡ [http://docs.graylog.org/en/2.4/pages/configuration/file\_location.html](http://docs.graylog.org/en/2.4/pages/configuration/file_location.html) ---
**Author:** ![djekels](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/djekels/32/2297_2.png) [@djekels](https://community.graylog.org/u/djekels)\ **Post date:** [May 15, 2018, 1:25pm UTC](https://community.graylog.org/t/graylog-not-functioning/5236/4 "2018-05-15T13:25:57Z")
I don’t see anything in the logs that is clear, should I be looking for anything in particular. Also this keeps popping up in the graylog console. Deflector exists as an index and is not an alias. (triggered 12 hours ago) The deflector is meant to be an alias but exists as an index. Multiple failures of infrastructure can lead to this. Your messages are still indexed but searches and all maintenance tasks will fail or produce incorrect results. It is strongly recommend that you act as soon as possible. I tried deleting it without luck. ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [May 15, 2018, 1:35pm UTC](https://community.graylog.org/t/graylog-not-functioning/5236/5 "2018-05-15T13:35:40Z")
> [@djekels](#): > > Deflector exists as an index and is not an alias. (triggered 12 hours ago) [http://docs.graylog.org/en/2.4/pages/faq.html#how-do-i-fix-the-deflector-exists-as-an-index-and-is-not-an-alias-error-message](http://docs.graylog.org/en/2.4/pages/faq.html#how-do-i-fix-the-deflector-exists-as-an-index-and-is-not-an-alias-error-message) ---
**Author:** ![djekels](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/djekels/32/2297_2.png) [@djekels](https://community.graylog.org/u/djekels)\ **Post date:** [May 15, 2018, 1:38pm UTC](https://community.graylog.org/t/graylog-not-functioning/5236/6 "2018-05-15T13:38:50Z")
alright, I do not understand what they mean by Stop all Graylog nodes ??? is this done via the linux command line “systemctl stop graylog-server” because if i do this then the webconsole goes away ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [May 15, 2018, 1:52pm UTC](https://community.graylog.org/t/graylog-not-functioning/5236/7 "2018-05-15T13:52:34Z")
> [@djekels](#): > > is this done via the linux command line “systemctl stop graylog-server” On Ubuntu Linux with official DEB package, that would work. ---
**Author:** ![djekels](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/djekels/32/2297_2.png) [@djekels](https://community.graylog.org/u/djekels)\ **Post date:** [May 15, 2018, 2:15pm UTC](https://community.graylog.org/t/graylog-not-functioning/5236/8 "2018-05-15T14:15:18Z")
> [@jochen](#): > > and line “systemctl stop graylog-server” OK, If I do that then my webconsole no longer works. ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [May 15, 2018, 2:19pm UTC](https://community.graylog.org/t/graylog-not-functioning/5236/9 "2018-05-15T14:19:15Z")
> [@djekels](#): > > OK, If I do that then my webconsole no longer works. Yes, because you’ve stopped Graylog. 🤔 ---
**Author:** ![djekels](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/djekels/32/2297_2.png) [@djekels](https://community.graylog.org/u/djekels)\ **Post date:** [May 15, 2018, 2:22pm UTC](https://community.graylog.org/t/graylog-not-functioning/5236/10 "2018-05-15T14:22:19Z")
1. Stop all Graylog nodes 2. 3. Delete the graylog\_deflector index via Elasticsearch Delete Index API (i don’t know how to do this) ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [May 15, 2018, 2:24pm UTC](https://community.graylog.org/t/graylog-not-functioning/5236/11 "2018-05-15T14:24:58Z")
> [@djekels](#): > > - Delete the graylog\_deflector index via Elasticsearch Delete Index API > (i don’t know how to do this) That’s why there is a link to [Delete Index | Elasticsearch Reference [5.6] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/5.6/indices-delete-index.html) in the documentation you’ve quoted. ```plaintext # curl -X DELETE 'http://127.0.0.1:9200/graylog_deflector' ``` ---
**Author:** ![djekels](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/djekels/32/2297_2.png) [@djekels](https://community.graylog.org/u/djekels)\ **Post date:** [May 15, 2018, 2:29pm UTC](https://community.graylog.org/t/graylog-not-functioning/5236/12 "2018-05-15T14:29:01Z")
ok great, i ran this on the elasticsearch machine after I stopped the graylog-server root@ip-10-200-18-77:~# curl -X DELETE ‘[http://127.0.0.1:9200/graylog\_deflector](http://127.0.0.1:9200/graylog_deflector)’ {“acknowledged”:true} root@ip-10-200-18-77:~# so it looks like the Default Index Set uses 1 indices with a total of 8,304 messages under management, current write-active index is graylog\_0. and we have logs in the search field; thank you very much Juston ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [May 29, 2018, 2:29pm UTC](https://community.graylog.org/t/graylog-not-functioning/5236/13 "2018-05-29T14:29:02Z")
Closed on May 29, 2018, 2:29pm UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.