Graylog not writing logs after deleting indices to free up space

[sumit555 (Sumit Shakya)]

The graylog server’s storage was filled up, so i deleted one of th indices named graylog_0 to free up space. Now the graylog is not writing any logs.

Following error message in the logs

[147]: index [graylog_deflector], type [_doc], id [4e0340c0-c9e2-11eb-a468-005056bcc134], message [ElasticsearchException[Elasticsearch exception [type=illegal_argument_exception, reason=no write index is defined for alias [graylog_deflector]. The write index may be explicitly disabled using is_write_index=false or the alias points to multiple indices without one being designated as a write index]]]

2021-06-10T17:54:15.087+05:45 ERROR [IndexRotationThread] Couldn’t point deflector to a new index
java.lang.IllegalArgumentException: [alias] is unsupported for [REMOVE_INDEX]

[gsmith]

Hello ,
Maybe I can help, how did you delete your indices? Was it something like this?

root#curl -XDELETE 'http://localhost:9200/ graylog_0 /'

By chance after deleteing Index gl_0 did you recalculate or rotate you Indices?

Hope this helps

[sumit555 (Sumit Shakya)]

Thanks for the response, @gsmith

Yes, I did use the same command to delete the index graylog_0 and I also attempted to recalculate or rotate the indices but it didn’t work.

I looked more into some more community posts and did some hit-and-trial solutions. Then I got the idea to look into the alias assigned on all my indices. It seems the actual issue was that two of my indices were assigned the deflector alias. Indices graylog_1 and graylog_4 both had graylog_deflector alias set to them.

I deleted the alias on graylog_1 using the below command, it resolved the issues:

curl -X DELETE “localhost:9200/graylog_1/_alias/graylog_deflector?pretty”

Initially, when I deleted the indices I had not shut down the graylog_server, I’m still unaware of how two indices got assigned the deflector alias.

[gsmith]

Nice , Glad you figured it out.