MIstakely I deleted graylog_*

Graylog Central (peer support)
1

Hi,

Mistakely one of my team member has run curl API command and deleted the graylog_* and now I am getting below error. I later have created the index by different name but still no luck.

Can someone please help?

rror Message:
Unable to perform search query Index not found for query: graylog_1. Try recalculating your index ranges.
Details:
Index not found for query: graylog_1. Try recalculating your index ranges.
Search status code:
500
Search response:
cannot GET http://xxx.xx.xx.xx:9000/api/search/universal/relative?query=%2A&range=300&filter=streams%3A000000000000000000000001&limit=150&sort=timestamp%3Adesc (500)

Instead I see the data is getting accumulated in

yellow open   filebeat-2020.05.18 WworOmSmQmunMu1o9DL-Fw   5   1       3246            0    939.2kb        939.2kb
yellow open   filebeat-2020.05.21 psLw1BfCQeWpzhd0V8Yd1A   5   1        618            0    337.6kb        337.6kb
yellow open   filebeat-2020.05.22 MAau7KQ8QleSPOB_V1fnsw   5   1       1441            0    522.2kb        522.2kb
yellow open   **graylog_deflector**   DyGQrLdZSDqhc__aCQBIOA   5   1    5153968            0      4.7gb          4.7gb
yellow open   filebeat-2020.05.25 oePGNWU_QjGQNyreJl_7SQ   5   1        812            0    341.8kb        341.8kb
yellow open   filebeat-2020.05.16 BzhFTiW_RZaKsJKyiR9Mww   5   1        285            0    292.1kb        292.1kb
yellow open   filebeat-2020.05.19 ovGo7PzaQ5e87H2kGt7pdg   5   1       1350            0    448.8kb        448.8kb
2

Have you tried the System - indices - IS name - rotate active index option?

//Or takes out the disaster recovery plan, and restore the indices.

3

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.