Hello everyone I have done a bad thing: pushed all the logs from windows and linux to the same index and hit the 1000 fields limit in ES. So I made separate indices for windows, linux and metricbeat and set up routing. The original index remains for windows. New messages work fine and I tried rein…

okay, so I have solved the “mystery” Graylog uses stream id in the search query and since the old index had different id, the messages from it were not returned by ES. So I updated all messages in the index to have the new stream id and graylog shows them. POST /sgt-linux_0/_update_by_query { "…

Messages not shown after reindex

Graylog Tech Challenges

gsmith (GSmith) July 9, 2021, 12:54am 10

Nice,
When executing a Elasticsearch dump and restore I had to follow @aaronsachs advice here.

Glad you worked it out

1 Like

Topic		Replies	Views
Messages In but Search is empty Graylog Central (peer support)	7	2266	October 25, 2018
Messages are in indices but not able to show up on search query Graylog Central (peer support)	4	627	November 1, 2019
Missing messages after restart Graylog Central (peer support)	3	1765	March 17, 2018
Messages are not appearing in searches and dashboards after index cycled Graylog Central (peer support)	6	1457	October 4, 2021
Messages from old indexes are not appearing on search Graylog Central (peer support)	9	364	June 21, 2023

Messages not shown after reindex

Related topics