Messages getting updated in graylog_deflector


(Srumith) #1

Hi Team

My messages are getting updated in graylog_deflector. I have created another index called graylog_0, but that is not getting updated. Please help.

Thanks
Srumith.


(Jochen) #2

graylog_deflector should be an index alias, not a real index.

If it is an index instead of an index alias (also check the logs of your Graylog nodes for that), perform the following steps to rectify the situation:

  1. Stop all Graylog nodes
  2. (OPTIONAL) If you want to keep the already ingested messages, reindex them into the graylog_0 index via the Elasticsearch Reindex API:
    https://www.elastic.co/guide/en/elasticsearch/reference/5.6/docs-reindex.html
  3. Delete the graylog_deflector index:
    https://www.elastic.co/guide/en/elasticsearch/reference/5.6/indices-delete-index.html
  4. Add action.auto_create_index: false to all Elasticsearch configuration files in your cluster and restart all Elasticsearch nodes:
    https://www.elastic.co/guide/en/elasticsearch/reference/5.6/docs-index_.html#index-creation
    https://www.elastic.co/guide/en/elasticsearch/guide/2.x/_creating_an_index.html
  5. Start the master Graylog node

(system) #3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.