# How to delete graylog\_deflector? **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [November 10, 2017, 1:17pm UTC](https://community.graylog.org/t/how-to-delete-graylog-deflector/3126 "2017-11-10T13:17:45Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![husetech](https://avatars.discourse-cdn.com/v4/letter/h/f19dbf/32.png) [@husetech](https://community.graylog.org/u/husetech)\ **Post date:** [November 10, 2017, 1:17pm UTC](https://community.graylog.org/t/how-to-delete-graylog-deflector/3126/1 "2017-11-10T13:17:45Z")
I get the Error Message "Deflector exists as an index and is not an alias. " which results in an empty search. I have seen Threads about this and the way to go is to stop GRAYLOG and delete the index “graylog\_deflector”. I am not sure on how to delete the index graylog\_deflector once the GRAYLOG Services are stopped. ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [November 10, 2017, 2:33pm UTC](https://community.graylog.org/t/how-to-delete-graylog-deflector/3126/2 "2017-11-10T14:33:06Z")
> [@husetech](#): > > I am not sure on how to delete the index graylog\_deflector once the GRAYLOG Services are stopped. You can delete an index named “graylog\_deflector” with the following command (replace 127.0.0.1 with the actual IP address or hostname of the Elasticsearch node): ```auto curl -X DELETE 'http://127.0.0.1:9200/graylog_deflector' ``` See [Delete Index | Elasticsearch Reference [5.6] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/5.6/indices-delete-index.html) for details. ---
**Author:** ![husetech](https://avatars.discourse-cdn.com/v4/letter/h/f19dbf/32.png) [@husetech](https://community.graylog.org/u/husetech)\ **Post date:** [November 14, 2017, 7:27am UTC](https://community.graylog.org/t/how-to-delete-graylog-deflector/3126/3 "2017-11-14T07:27:47Z")
I am confused, entering this command gives me the following Error: "Failed to connect to IP-ADDRESS port 9200: Connection refused" I put in the IP of the GRAYLOG Server (on which I access the web-interface). On [elastic.co](http://elastic.co) I see a download option for Elasticsearch. I think I never downloaded / installed Elasticsearch regarding GRAYLOG. If I don’t have to install Elasticsearch seperately how do I find out the IP-ADRESS? ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [November 14, 2017, 7:41am UTC](https://community.graylog.org/t/how-to-delete-graylog-deflector/3126/4 "2017-11-14T07:41:44Z")
How did you installed Graylog Justin? If you use the OVA/Virtual Appliance that includes all needed software. You would need to push that command on the command line of that server as Elasticsearch is not listening on the public interface. ---
**Author:** ![husetech](https://avatars.discourse-cdn.com/v4/letter/h/f19dbf/32.png) [@husetech](https://community.graylog.org/u/husetech)\ **Post date:** [November 14, 2017, 8:17am UTC](https://community.graylog.org/t/how-to-delete-graylog-deflector/3126/5 "2017-11-14T08:17:14Z")
Hey Jan, Yes I used the OVA/Virtuel Appliance. I am on the COmmand Line Interface of the Machine trying to enter the line mentioned above. No luck so far. Also tried curl -X DELETE 127.0.0.1:9200/graylog\_deflector ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [November 14, 2017, 9:10am UTC](https://community.graylog.org/t/how-to-delete-graylog-deflector/3126/6 "2017-11-14T09:10:50Z")
> [@husetech](#): > > I put in the IP of the GRAYLOG Server (on which I access the web-interface). The cURL command has to be run against the Elasticsearch HTTP API, not against the Graylog REST API. You can get a list of processes listening to some (TCP) port with one of the following commands: ```auto # lsof -i # netstat -tplen ``` Elasticsearch is usually listening on port 9200/tcp. > [@husetech](#): > > Also tried curl -X DELETE 127.0.0.1:9200/graylog\_deflector And what was the result? ---
**Author:** ![husetech](https://avatars.discourse-cdn.com/v4/letter/h/f19dbf/32.png) [@husetech](https://community.graylog.org/u/husetech)\ **Post date:** [November 14, 2017, 9:55am UTC](https://community.graylog.org/t/how-to-delete-graylog-deflector/3126/7 "2017-11-14T09:55:06Z")
I got it working now and want to sum up the way to success for ppl like me who are new to GRAYLOG and usually don’t work with LINUX Systems: 1. Stop all services but Elasticsearch ([http://docs.graylog.org/en/2.3/pages/configuration/graylog\_ctl.html#migrate-manually-from-1-x-to-2-x](http://docs.graylog.org/en/2.3/pages/configuration/graylog_ctl.html#migrate-manually-from-1-x-to-2-x)) $ sudo -s $ graylog-ctl stop graylog-web $ graylog-ctl stop graylog-server $ graylog-ctl stop mongodb $ graylog-ctl stop nginx $ graylog-ctl stop etcd 1. If used OVA Image Eleasticsearchs default Port is 9200 to receive tasks. (Also see: [http://docs.graylog.org/en/2.3/pages/configuration/graylog\_ctl.html#migrate-manually-from-1-x-to-2-x](http://docs.graylog.org/en/2.3/pages/configuration/graylog_ctl.html#migrate-manually-from-1-x-to-2-x)) Syntax: $ curl -X DELETE \:9200/\_template/graylog-internal Example: $ curl -X DELETE ‘127.0.0.1:9200/graylog\_deflector’ 1. Start all Services again ([http://docs.graylog.org/en/2.3/pages/configuration/graylog\_ctl.html?highlight=delete%20index#configuration-commands](http://docs.graylog.org/en/2.3/pages/configuration/graylog_ctl.html?highlight=delete%20index#configuration-commands)) sudo graylog-ctl start **Thank you for all your help!** ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [November 28, 2017, 9:55am UTC](https://community.graylog.org/t/how-to-delete-graylog-deflector/3126/8 "2017-11-28T09:55:19Z")
Closed on November 28, 2017, 9:55am UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.