This is a similar problem to what I saw in my older question - FortiADC SYSLOG Struggles The time zone settings all match up and are correct. Everything is in UTC. Syslog/UDP input. It shows messages coming in. I created an Index set using mostly the default settings (just changed the rotation to…

[image] jfmeyer00: ElasticsearchException[Elasticsearch exception [type=validation_exception, reason=Validation Failed: 1: this action would add [2] total shards, but this cluster currently has [1000]/[1000] maximum shards open;]] That was the issue. Too many shards. The new index would have …

Hey @jfmeyer00 [image] jfmeyer00: Elasticsearch exception [type=index_not_found_exception, reason=no such index ] I seen that a while back here. [image] Type=index_not_found_exception Graylog Central (peer support) Hello. I’ve been installed Graylog server + Ope…

Thanks for that one. I did see that. My is_leader is set to true. We’re using Elastic Search, and the paths all look correct.

Another update. This is in the System/Overview, indexing error section. [indexname_deflector] ElasticsearchException[Elasticsearch exception [type=index_not_found_exception, reason=no such index [indexname_deflector]]]

Hey, [image] jfmeyer00: If I run curl -X GET “localhost:9200/_cat/indices/my-index-*?v=true&s=index&pretty” the new index name does not appear. How did you make that index set? And can you show you index set configuration?

I created it in the Graylog Web UI. Just like my other index sets. [image] Example of a working index set [image] Edit: I just noticed the Yellow status. Everything appears to be okay. The “deflector” entry on the top (“broken”) index set is new. I’m presuming that’s the cause of the Yellow st…

Hey, [image] jfmeyer00: Edit: I just noticed the Yellow status. I seen that also and you have unassigned shard. At first I though it was a replica set but you don’t have replica’s configured. In order to diagnose the unassigned shards you can execute this. curl -X GET http://opensearc…

Neither recalculating nor rotating had any positive effect. This is the relevant bit of the CURL saasdrfw_deflector 0 p STARTED 68554 11.3mb 127.0.0.1 saasdrfw_deflector 0 r UNASSIGNED

curl -X GET localhost:9200/_cat/shards?h=index,shard,prirep,state,unassigned.reason| grep UNASSIGNED Returned saasdrfw_deflector 0 p STARTED 68554 11.3mb 127.0.0.1 IdentifiGL saasdrfw_deflector 0 r UNASSIGNED Then I saw these messages in the Graylog UI: Error sta…

Hey, Yeah any old or unused custom index set that can be removed, then apply an upgrade and start again. If this doesn’t take care of your issue can you post you configurations you did, I maybe able to replicate it on my lab.

Messages Not Going Into Index

Graylog Central (peer support)

gsmith (GSmith) April 24, 2024, 4:40am 2

Hey @jfmeyer00

I seen that a while back here.

Topic		Replies	Views
Indexes don't show messages Graylog Central (peer support)	3	2472	October 15, 2018
Type=index_not_found_exception Graylog Central (peer support) elastic	18	11164	February 8, 2023
No such index in Dashboard Graylog Central (peer support) dashboards , gelf	3	622	April 2, 2024
Input received, won't display/search Graylog Central (peer support)	7	2127	May 18, 2021
Graylog trying to find non-existent index Graylog Central (peer support)	7	3302	November 12, 2018

Messages Not Going Into Index

Related topics