Graylog tries to archive an index which isnt present anymore

[coffee_is_life]

Hello Forum,

since end of November 2023 the Archive function fails to archive an index (graylog_49).

Since this Index is relativly old and does not contain messages we really need, i deleted the index in the graylog interface. Its not present anymore.

But every day the error apperas again and i can see a job running for it.
All following indeces are archived successfully but the error comes up every day.

How do i tell graylog to skip this index and not try to archive it anymore?

2. Describe your environment:

• OS Information:
  CentOS 7

• Package Version:
  graylog-server-4.3.15-1.noarch
  elasticsearch-6.8.23-1.noarch

• Service logs, configurations, and environment variables:

The following indices could not be archived yet (triggered 19 hours ago)

There was an error while archiving some indices. Graylog will continue trying to archive those indices and will retain all indices until they are successfully archived.
Please check the following error messages as your assistance may be necessary to resolve the issue:

• graylog_49 2023-11-30T16:03:31.477Z Error archiving index graylog_49: Archived only 20000141 out of 20000142 documents of index graylog_49, not deleting/closing index graylog_49

3. What steps have you already taken to try and solve the problem?
Redo archive manually via Graylog-Interface
Restarting services / server
Disable/enable archive function
change backend
delete the specific index in hope archive would skip it since its not present anymore

best regards,
Coffee_is_life

[Wine_Merchant]

@coffee_is_life

Try using the below to find the stale entry in Mongo

db.archive_outcomes.find({outcome:“FAILED”, active_error:true}

And the use this to chnage actice_error to false, you might want to make it more specific to the failing index.

db.archive_outcomes.update({outcome:“FAILED”,active_error:true}, {$set: {active_error: false}}, {multi:true})

[coffee_is_life]

@Wine_Merchant
Thanks for the advice, i did the change on DB and it seems graylog moves on now.
Will see the result tomorrow if the error wont show up again
I will mark the answer as solution if everything is fine tomorrow.

best regards,
coffee_is_life