A few weeks back i updated our single node setup with the following, and keeping all config files.
Graylog 3.3 → 4.0.5
Elasticsearch 6.8.14 → 7.10.2
After this, if i stop or restart elasticsearch the messages from when it is stopped do not get written to elasticsearch when it is up and running again, and are subsequently lost.
I made another post that contains a lot of info regarding my problem:
Earlier post
As i describe in that post, i have found that the this problem is reproducable using the ova installation files. and that the problem starts when you go from graylog 3.3.11 to 4.0.0
I know it is bad manners to make two posts about the same topic, but i feel that this is an important issue to get looked into, as i assume that this also happens to other people.