Currently running graylog using the AWS ami’s.
1 host configured as server and 2 hosts as ElasticSearch data nodes. This was working find for around a month, but as of today, it appears like it completely wiped itself out. I see the data is still on the Elastic Search nodes, but when logging into the website, it’s basically like the first time I’ve ever logged in to it. All inputs and users have been wiped.
Logged into mongo, at I see 3 DB’s (warning, graylog, local), but I am not seeing any tables or collections in any of these. I’ve looking at the logs in /var/log/graylog/ but everything in there is current and this could have happened during the last 3-4 days.
Is there any way I can restore all the configuration changes I have made? If not, how do I stop this from occurring in the future?