Hello community, I’ve created a stream in Graylog and assigned a own index to it. Then I deleted the Stream and created a new one and assigned the same index to it but older messages are gone. Is that behaviour expected?
I searched in the index directly for older data but couldn’t find anything.
Graylog version is a single instance on the latest release 3.3.2
the massages marked with the stream id, so you wont’t find the old streams’ messages in the new one.
Try to use the search menu to find your iten, not from the stream.
The stream name is the same as the old.
I tried to find the messages in the search but didn’t had success.
Is there a way to show messages which are not in a stream? And is there possibility to reassign this messages to a specific stream.
so
doesn’t matter
You can find a field called “streams” on the messeges. You can use it to filter.
streams:YOUR_STREAM_ID
All messages included at least one stream. If you don’t remove the messages from deafult, you will find the 000…001 ID as default stream, aka “All Messages”
The messages are not in the default stream because I had set the option “Remove matches from ‘All messages stream” also I don’t have the stream id of the deleted stream.
I’ve also tried to reproduce it and created a new index and stream and routed some messages in it and deleted the stream after some minutes. I could get the message via Permalink but didn’t found it in search. The only way was to find the message over the API with the Message + Index ID
So any ideas how to get the Message ID from the messages with a deleted stream?
@macko003 do you have any ideas maybe?
Yes, I have. But I wrote all of it, please check it again, because as I see, you missed some of it.
@mack003 Thanks, did you read my answer before? I checked it but I couldn’t find the old stream id.
Yes, i read it.
And I never mentioned you should know the old stream id. I told, how can you use it for search.
Eg. exclude your current stream ids.
Or do a search for the time when you had massages in your old stream, and export it, do some magic, sort all of the stream ids, and excluder your current ones.
But also, you can’t change your new stream’s id, so it can just help to find the messages what you can’t find any other way.
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
