Messages getting updated in graylog_deflector

(Srumith) #1

Hi Team

My messages are getting updated in graylog_deflector. I have created another index called graylog_0, but that is not getting updated. Please help.


(Jochen) #2

graylog_deflector should be an index alias, not a real index.

If it is an index instead of an index alias (also check the logs of your Graylog nodes for that), perform the following steps to rectify the situation:

  1. Stop all Graylog nodes
  2. (OPTIONAL) If you want to keep the already ingested messages, reindex them into the graylog_0 index via the Elasticsearch Reindex API:
  3. Delete the graylog_deflector index:
  4. Add action.auto_create_index: false to all Elasticsearch configuration files in your cluster and restart all Elasticsearch nodes:
  5. Start the master Graylog node

(system) closed #3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.