Messages before upgrade not in Graylog GUI

Graylog Central (peer support)
1

I have upgraded graylog from 3.0.2 to 3.1.1 and then rolled back.
Now I can’t see messages before the roll back. I can see only messages of last few days.
Any leads would be helpful.

2

he @Sree

rollback is not a supported operation - as you did not describe the complete actions you did I guess that you have wracked your setup.

1 Like
3

@jan Thank You for the prompt response.

I was running Graylog 3.0.2 and upgraded to 3.1.1 and because of the issue in event and notification I rolled it back to 3.0.2.

Rollback was done using the snapshot taken before the upgrade.
Now my Graylog is running in 3.0.2

OS: RHEL 7.6

Does it have anything elastic search index?
If yes could you please explain or point me to any document.

Thank You

1 Like
4

Also I see the following error:

graylog_deflector	f2c81c80-12db-11ea-99b1-026d332808cc	{"type":"invalid_index_name_exception","reason":"Invalid index name [graylog_deflector], already exists as alias","index_uuid":"_na_","index":"graylog_deflector"}
1 Like
5

I can see only messages for last 4 days.

There are 10 indices and indices are set to delete when it reaches to 20 million messages

@jan Does that mean all the historic data would be lost?

1 Like
6

dear @Sree

to be honest - that is a question that could only be answered with a list of your elasticsearch indices and a look into the mongodb database. Means it might be solvable but it is nothing I’m able to describe here in short.

The deflector error is documented in the FAQ and you can see how that could be solved.

1 Like
7

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.