Messages getting updated in graylog_deflector

[Srumith]

Hi Team

My messages are getting updated in graylog_deflector. I have created another index called graylog_0, but that is not getting updated. Please help.

Thanks
Srumith.

[jochen]

graylog_deflector should be an index alias, not a real index.

If it is an index instead of an index alias (also check the logs of your Graylog nodes for that), perform the following steps to rectify the situation:

1. Stop all Graylog nodes
2. (OPTIONAL) If you want to keep the already ingested messages, reindex them into the graylog_0 index via the Elasticsearch Reindex API:
   https://www.elastic.co/guide/en/elasticsearch/reference/5.6/docs-reindex.html
3. Delete the graylog_deflector index:
   https://www.elastic.co/guide/en/elasticsearch/reference/5.6/indices-delete-index.html
4. Add action.auto_create_index: false to all Elasticsearch configuration files in your cluster and restart all Elasticsearch nodes:
   https://www.elastic.co/guide/en/elasticsearch/reference/5.6/docs-index_.html#index-creation
   https://www.elastic.co/guide/en/elasticsearch/guide/2.x/_creating_an_index.html
5. Start the master Graylog node