# How to change the "All Messages" Stream to use different Index? **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [June 15, 2022, 3:30pm UTC](https://community.graylog.org/t/how-to-change-the-all-messages-stream-to-use-different-index/24326 "2022-06-15T15:30:46Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![UoGuelph](https://avatars.discourse-cdn.com/v4/letter/u/c2a13f/32.png) [@UoGuelph](https://community.graylog.org/u/UoGuelph)\ **Post date:** [June 15, 2022, 3:30pm UTC](https://community.graylog.org/t/how-to-change-the-all-messages-stream-to-use-different-index/24326/1 "2022-06-15T15:30:46Z")
**1. Describe your incident:** I was trying to change the “All Messages” stream to use different Index, instead of the Default Index set with API, but got error: http://graylog\_host\_ip/api/api-browser/global/index.html#!/Streams/update\_put\_5 { “title”: “All messages”, “content\_pack”: null, “remove\_matches\_from\_default\_stream”: false, “index\_set\_id”: “62a9e73001ff4366937a0855”, “is\_default”: true, “is\_editable”: true } #### Request URL /api/streams/000000000000000000000001 #### Response Body { “type”: “ApiError”, “message”: “The stream cannot be edited.” } **2. Describe your environment:** - OS Information: Red Hat Enterprise Linux 8 - Package Version:4.2.20 **4. How can the community help?** Is this possible? and if so, how? Thanks. **Helpful Posting Tips:** [Tips for Posting Questions that Get Answers](https://community.graylog.org/t/tips-for-posting-questions-that-get-answers/21828) [Hold down CTRL and link on link to open tips documents in a separate tab] ---
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [June 15, 2022, 6:08pm UTC](https://community.graylog.org/t/how-to-change-the-all-messages-stream-to-use-different-index/24326/2 "2022-06-15T18:08:10Z")
I know you can set the default index via the web interface… perhaps if you used the API to change the default index rather than the default stream? I haven’t used the API in that way so I have no quick suggestions… ---
**Author:** ![UoGuelph](https://avatars.discourse-cdn.com/v4/letter/u/c2a13f/32.png) [@UoGuelph](https://community.graylog.org/u/UoGuelph)\ **Post date:** [June 15, 2022, 6:36pm UTC](https://community.graylog.org/t/how-to-change-the-all-messages-stream-to-use-different-index/24326/3 "2022-06-15T18:36:07Z")
Yes, I changed the Default Index through the web interface, but that did not change the All message stream. It still uses the old Default index. Some users here suggested to use API in the past posts, maybe things have changed? I am trying to figure out. ---
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [June 15, 2022, 6:55pm UTC](https://community.graylog.org/t/how-to-change-the-all-messages-stream-to-use-different-index/24326/4 "2022-06-15T18:55:33Z")
Did some more research - looks like it might be a design issue where it sets on first startup and _might_ be able to be changed in the Mongo DB. [Posted to Github here](https://github.com/Graylog2/graylog2-server/issues/4387) Though it is initially for version 2.3.2, it was still an issue in 2020 with version 4.x ---
**Author:** ![UoGuelph](https://avatars.discourse-cdn.com/v4/letter/u/c2a13f/32.png) [@UoGuelph](https://community.graylog.org/u/UoGuelph)\ **Post date:** [June 15, 2022, 7:01pm UTC](https://community.graylog.org/t/how-to-change-the-all-messages-stream-to-use-different-index/24326/5 "2022-06-15T19:01:06Z")
Got it, thank you for the quick response. The original default index got messed up by the SNMP plugin I grabbed from the marketplace, which keeps adding more and more fields (over 3000 now). So I decided to switch to new default Index. ---
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [June 15, 2022, 7:06pm UTC](https://community.graylog.org/t/how-to-change-the-all-messages-stream-to-use-different-index/24326/6 "2022-06-15T19:06:24Z")
I think fields are recreated with each new index as the data comes in … if so, you can rotate your index and only the fixed data will come in the new one. Thats a much easier solution… ---
**Author:** ![UoGuelph](https://avatars.discourse-cdn.com/v4/letter/u/c2a13f/32.png) [@UoGuelph](https://community.graylog.org/u/UoGuelph)\ **Post date:** [June 15, 2022, 7:11pm UTC](https://community.graylog.org/t/how-to-change-the-all-messages-stream-to-use-different-index/24326/7 "2022-06-15T19:11:46Z")
Yes, trying to do that by defining different streams and indexes. ---
**Author:** ![tmacgbay](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/tmacgbay/32/3878_2.png) [@tmacgbay](https://community.graylog.org/u/tmacgbay)\ **Post date:** [June 15, 2022, 7:18pm UTC](https://community.graylog.org/t/how-to-change-the-all-messages-stream-to-use-different-index/24326/8 "2022-06-15T19:18:48Z")
this is what I mean below. If you don’t want the older data, you can delete them from this page as well… ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/3/37b9567f046f4769fbe4b91facf66dd65d8dd159.png) ---
**Author:** ![UoGuelph](https://avatars.discourse-cdn.com/v4/letter/u/c2a13f/32.png) [@UoGuelph](https://community.graylog.org/u/UoGuelph)\ **Post date:** [June 15, 2022, 7:23pm UTC](https://community.graylog.org/t/how-to-change-the-all-messages-stream-to-use-different-index/24326/9 "2022-06-15T19:23:48Z")
Let me try that. thanks. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [June 29, 2022, 7:23pm UTC](https://community.graylog.org/t/how-to-change-the-all-messages-stream-to-use-different-index/24326/10 "2022-06-29T19:23:59Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.