# Graylog restart always ends up with corrupted elasticsearch

**URL:** <https://community.graylog.org/t/graylog-restart-always-ends-up-with-corrupted-elasticsearch/3600>\
**Category:** Graylog Central (peer support)\
**Created:** [December 21, 2017, 5:22pm UTC](https://community.graylog.org/t/graylog-restart-always-ends-up-with-corrupted-elasticsearch/3600 "2017-12-21T17:22:54Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![mikgray](https://avatars.discourse-cdn.com/v4/letter/m/6de8d8/32.png) [@mikgray](https://community.graylog.org/u/mikgray)\
**Post date:** [December 21, 2017, 5:22pm UTC](https://community.graylog.org/t/graylog-restart-always-ends-up-with-corrupted-elasticsearch/3600/1 "2017-12-21T17:22:55Z")

</div>

Hi,  
if there is power shortage or anything bad happens to graylog box, there is 90% chance that you will spend hours figting corrupted elasticsearch shards.

I don’t care about previous data, I just need to be able to restore easily and put graylog back to work.

I suggest either offer option using something else (more simple!) than elasticsearch or implement some easy reset solution (for those who don’t matter data loss).

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [December 22, 2017, 9:04am UTC](https://community.graylog.org/t/graylog-restart-always-ends-up-with-corrupted-elasticsearch/3600/2 "2017-12-22T09:04:39Z")

</div>

Hej @mikgray

how did you install Graylog? What flavour of Graylog are you using? What Version of Graylog did you use?

If you are a little more verbose we might help you.

Jan

---

<div class="post-metadata">

**Author:** ![mikgray](https://avatars.discourse-cdn.com/v4/letter/m/6de8d8/32.png) [@mikgray](https://community.graylog.org/u/mikgray)\
**Post date:** [December 22, 2017, 1:29pm UTC](https://community.graylog.org/t/graylog-restart-always-ends-up-with-corrupted-elasticsearch/3600/3 "2017-12-22T13:29:43Z")

</div>

Hi Jan,  
it’s virtual appliance (OVA), version 2.2.2.

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [December 22, 2017, 3:26pm UTC](https://community.graylog.org/t/graylog-restart-always-ends-up-with-corrupted-elasticsearch/3600/4 "2017-12-22T15:26:36Z")

</div>

Hej @mikgray

you should upgrade to at least version 2.3 ( [http://docs.graylog.org/en/2.2/pages/configuration/graylog\_ctl.html#upgrade-graylog](http://docs.graylog.org/en/2.2/pages/configuration/graylog_ctl.html#upgrade-graylog) ) and after that you have the command  
`sudo graylog-ctl cleanse` available.

That does exactly what you want, it let you start from the scratch.

---

<div class="post-metadata">

**Author:** ![mikgray](https://avatars.discourse-cdn.com/v4/letter/m/6de8d8/32.png) [@mikgray](https://community.graylog.org/u/mikgray)\
**Post date:** [December 26, 2017, 7:34pm UTC](https://community.graylog.org/t/graylog-restart-always-ends-up-with-corrupted-elasticsearch/3600/5 "2017-12-26T19:34:29Z")

</div>

That is cool indeed, saved me hours. Would be amazing, if it didn’t delete all configurations but just get resolved those elasticsearch shards issues.  
Thank you, really appreciate that.

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [December 27, 2017, 10:09am UTC](https://community.graylog.org/t/graylog-restart-always-ends-up-with-corrupted-elasticsearch/3600/6 "2017-12-27T10:09:18Z")

</div>

@mikgray you ask for something to clean all mess and not something to resolve elasticsearch issues.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [January 10, 2018, 10:09am UTC](https://community.graylog.org/t/graylog-restart-always-ends-up-with-corrupted-elasticsearch/3600/7 "2018-01-10T10:09:38Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
