Hello community, I’ve created a stream in Graylog and assigned a own index to it. Then I deleted the Stream and created a new one and assigned the same index to it but older messages are gone. Is that behaviour expected?
I searched in the index directly for older data but couldn’t find anything.
Graylog version is a single instance on the latest release 3.3.2
The messages are not in the default stream because I had set the option “Remove matches from ‘All messages stream” also I don’t have the stream id of the deleted stream.
I’ve also tried to reproduce it and created a new index and stream and routed some messages in it and deleted the stream after some minutes. I could get the message via Permalink but didn’t found it in search. The only way was to find the message over the API with the Message + Index ID
So any ideas how to get the Message ID from the messages with a deleted stream?
Yes, i read it.
And I never mentioned you should know the old stream id. I told, how can you use it for search.
Eg. exclude your current stream ids.
Or do a search for the time when you had massages in your old stream, and export it, do some magic, sort all of the stream ids, and excluder your current ones.
But also, you can’t change your new stream’s id, so it can just help to find the messages what you can’t find any other way.