# Messages In but Search is empty

**URL:** <https://community.graylog.org/t/messages-in-but-search-is-empty/7207>\
**Category:** Graylog Central (peer support)\
**Created:** [October 10, 2018, 3:48pm UTC](https://community.graylog.org/t/messages-in-but-search-is-empty/7207 "2018-10-10T15:48:16Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![yoyohand](https://avatars.discourse-cdn.com/v4/letter/y/5e9695/32.png) [@yoyohand](https://community.graylog.org/u/yoyohand)\
**Post date:** [October 10, 2018, 3:48pm UTC](https://community.graylog.org/t/messages-in-but-search-is-empty/7207/1 "2018-10-10T15:48:16Z")

</div>

Hello,  
For several days I see my logs arrive on Graylog but they do not appear in the search menu  
I have only one source that seems to work, the messages of my other servers arrive on Graylog but do not add in the elastisearch  
My cluster is green

If I look graylog.log in /var/log/graylog/elasticsearch I have this error message

> [2018-10-10T17:43:53,148][INFO][o.e.c.m.MetaDataMappingService] [1ZvZhnI] [graylog\_23/LoLBQPj2QwOWqoUXt7oJtw] update\_mapping [message]  
> [2018-10-10T17:43:53,178][WARN][o.e.g.DanglingIndicesState] [1ZvZhnI] [[graylog\_0/cnL8m-dsRGWK2QXR25ql1w]] can not be imported as a dangling index, as index with same name already exists in cluster metadata

Can you help me?  
Thank’s you,

---

<div class="post-metadata">

**Author:** ![yoyohand](https://avatars.discourse-cdn.com/v4/letter/y/5e9695/32.png) [@yoyohand](https://community.graylog.org/u/yoyohand)\
**Post date:** [October 10, 2018, 4:11pm UTC](https://community.graylog.org/t/messages-in-but-search-is-empty/7207/2 "2018-10-10T16:11:34Z")

</div>

After run a recalculator of the index ranges and some messages will appear again (about 5min of logs) but new messages do not appear.

the error message continues to log in the logs

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [October 11, 2018, 5:34am UTC](https://community.graylog.org/t/messages-in-but-search-is-empty/7207/3 "2018-10-11T05:34:57Z")

</div>

did you rotate the index already?

---

<div class="post-metadata">

**Author:** ![yoyohand](https://avatars.discourse-cdn.com/v4/letter/y/5e9695/32.png) [@yoyohand](https://community.graylog.org/u/yoyohand)\
**Post date:** [October 11, 2018, 6:52am UTC](https://community.graylog.org/t/messages-in-but-search-is-empty/7207/4 "2018-10-11T06:52:32Z")

</div>

Hi,  
I have one index set, I have configured for rotate period P1D and max indices:365.  
I have 25 indices this morning.  
This morning I do not have the problem anymore.  
What could have happened? I monitor to see if in the coming days the problem reappears. thank you,

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [October 11, 2018, 6:58am UTC](https://community.graylog.org/t/messages-in-but-search-is-empty/7207/5 "2018-10-11T06:58:01Z")

</div>

Just a wild guess - you had a previous installation before with elasticsearch and did not delete the data before you reuse the server for a new Graylog.

---

<div class="post-metadata">

**Author:** ![yoyohand](https://avatars.discourse-cdn.com/v4/letter/y/5e9695/32.png) [@yoyohand](https://community.graylog.org/u/yoyohand)\
**Post date:** [October 11, 2018, 7:36am UTC](https://community.graylog.org/t/messages-in-but-search-is-empty/7207/6 "2018-10-11T07:36:29Z")

</div>

The guess is not completely crazy, it’s true that I had an earlier installation, before start a new graylog installation I have run `graylog-ctl cleanse` followed by `graylog-ctl reconfigure`.  
I had no problem since this reset.  
But last week I tried to configure pipelines, could the problem have a link? To be on yesterday I deleted my configuration of pipelines to resume the basics and redre appear my messages.

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [October 11, 2018, 8:10am UTC](https://community.graylog.org/t/messages-in-but-search-is-empty/7207/7 "2018-10-11T08:10:10Z")

</div>

He @yoyohand  
pipelines is only for messages processing and has nearly no connection to the indices. The only connection is because you can route messages with pipeline into different streams that can have different indices for saving the data.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [October 25, 2018, 8:10am UTC](https://community.graylog.org/t/messages-in-but-search-is-empty/7207/8 "2018-10-25T08:10:15Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
