# Need to clear elastic search after upgrade to version 4
**URL:** https://community.graylog.org/t/need-to-clear-elastic-search-after-upgrade-to-version-4/20994
**Category:** Graylog Central (peer support)
**Created:** [August 25, 2021, 11:55pm UTC](https://community.graylog.org/t/need-to-clear-elastic-search-after-upgrade-to-version-4/20994 "2021-08-25T23:55:19Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@tgarons](https://community.graylog.org/u/tgarons)
#### Post date: [August 25, 2021, 11:55pm UTC](https://community.graylog.org/t/need-to-clear-elastic-search-after-upgrade-to-version-4/20994/1 "2021-08-25T23:55:19Z")
## Description of your problem
During the upgrade of elasticsearch from 5.6-\>6.8-\>7.14 I managed to wipe out all data. We can live with that. At this point I want to start fresh. I cleared everything from elasticsearch and started it running on all ES nodes and then went ahead with the upgrade from 3.x to 4.1. At this point version 4 is running, but is spewing errors trying to get to the old index:
Index not found for query: graylog\_298. Try recalculating your index ranges.
Recalculating the index range from either the GUI or curl gives this result:
2021-08-25T23:34:29.950Z INFO [RebuildIndexRangesJob] Recalculating index ranges.
2021-08-25T23:34:29.950Z INFO [SystemJobManager] Submitted SystemJob [org.graylog2.indexer.ranges.RebuildIndexRangesJob]
2021-08-25T23:34:29.952Z INFO [RebuildIndexRangesJob] No indices, nothing to calculate.
2021-08-25T23:34:29.952Z INFO [SystemJobManager] SystemJob [org.graylog2.indexer.ranges.RebuildIndexRangesJob] finished in 2ms.
I’ve tried creating a new index set and setting it as the default, but something is still trying to go to graylog\_298.
I want to be able to run graylog with all the configurations I’ve developed for streams, alerts, etc., but with new data. I’m willing to start from scratch with elasticsearch again if needed. How can I do this.
---
### Author:  [@gsmith](https://community.graylog.org/u/gsmith)
#### Post date: [August 26, 2021, 4:05am UTC](https://community.graylog.org/t/need-to-clear-elastic-search-after-upgrade-to-version-4/20994/2 "2021-08-26T04:05:19Z")
Hello,
I need to ask a couple questions.
How did you manage to wipe all your data from upgrading Elasticsearch? I’m just curious.
What documentation are you using for Graylog Upgrade process?
> [@tgarons](#):
>
> upgrade of elasticsearch from 5.6-\>6.8-\>7.14
Are you aware of this?
> [@tgarons](#):
>
> Index not found for query: graylog\_298. Try recalculating your index ranges.
That would be this section.
Next option would be **rotate** you indices, same section. This would be the preferred way.
You can try to execute these at your own risk.
**Check Elasticsearch health.**
`curl -XGET http://localhost:9200/_cluster/health?pretty=true`
**Check Shards see what going on.**
`curl -XGET http://localhost:9200/_cat/shards`
**List you indices**
`curl -s http://localhost:9200/_cat/indices`
**How to delete Index**
`curl -X DELETE "localhost:9200/my-index-000001?pretty"`
Hope that helps
---
### Author:  [@tgarons](https://community.graylog.org/u/tgarons)
#### Post date: [August 26, 2021, 5:10am UTC](https://community.graylog.org/t/need-to-clear-elastic-search-after-upgrade-to-version-4/20994/3 "2021-08-26T05:10:17Z")
> >  | [gsmith](https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.graylog.org%2Fu%2Fgsmith&data=04%7C01%7Ctoma%40aaisonline.com%7C71bd94e3e3164ac065e608d9684830ad%7C11a183b0e7574f328f598d8dd716cade%7C0%7C0%7C637655481550765189%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=XBZxwrY%2FpDj2rYE30LA%2FBeQnpGSw7zas7lFx18zaqtA%3D&reserved=0) Regular
> > August 26 |
> >
> > - | - |
>
> Hello,
>
> I need to ask a couple questions.
> How did you manage to wipe all your data from upgrading Elasticsearch? I’m just curious.
I did something stupid. After adding a third ES node I somehow wound up with an entire set of unassigned shards. In researching how to resolve unallocated shards I came across a suggested command that I didn’t read fully: it looked for unallocated shards and then deleted the index that contained them. Since we had one unallocated shard from each index it deleted everything.
> What documentation are you using for Graylog Upgrade process?
Since elastic search was already hosed I was following the documentation for a fresh install:
[https://docs.graylog.org/en/4.1/pages/installation/os/ubuntu.html](https://docs.graylog.org/en/4.1/pages/installation/os/ubuntu.html)
> > tgarons:
> >
> > upgrade of elasticsearch from 5.6-\>6.8-\>7.14
>
> Are you aware of this?
I was not aware of this. That isn’t mentioned in the link I referenced above. Do I need to downgrade?
The only thing I want to preserve now are the streams and alerts and plug-in configuration that I have previously set up. I can start all over again with elasticsearch if necessary.
---
### Author:  [@gsmith](https://community.graylog.org/u/gsmith)
#### Post date: [August 26, 2021, 5:26am UTC](https://community.graylog.org/t/need-to-clear-elastic-search-after-upgrade-to-version-4/20994/4 "2021-08-26T05:26:16Z")
> [@tgarons](#):
>
> I was not aware of this. That isn’t mentioned in the link I referenced above. Do I need to downgrade?
That’s a tough question. It’s not good idea from my experience to down grade elasticsearch. If you have to do that I might even considering starting over. You could just leave it alone because I seen some community members using 7.14 without problems. This would be up to you. I person would try to make it work but just beware.
> [@tgarons](#):
>
> The only thing I want to preserve now are the streams and alerts and plug-in configuration that I have previously set up. I can start all over again with elasticsearch if necessary.
You could create a content pack like so.
The select what you want
Click NEXT
The Create & Download
Keep that in a good spot then upload when you all done.
I personally would see if I can get the Index correct before doing all that.
All you metadata from stream configurations, etc… is in you MongoDb.
Hope that help
---
### Author:  [@nisow95612](https://community.graylog.org/u/nisow95612)
#### Post date: [August 26, 2021, 8:25am UTC](https://community.graylog.org/t/need-to-clear-elastic-search-after-upgrade-to-version-4/20994/5 "2021-08-26T08:25:36Z")
Well, I am a newbie…
but if you deleted your index set on Elastic side, but Graylog still thinks it exists…
… isn’t the solution simply to delete and re-create the index set on Graylog’s side?
* * *
PS: I am also on EL 7.14. So far the only problem is occasionally wrong information about index ranges. But it seems to be only a visual problem. Indexing and searching works fine.
---
### Author:  [@tgarons](https://community.graylog.org/u/tgarons)
#### Post date: [August 26, 2021, 8:50am UTC](https://community.graylog.org/t/need-to-clear-elastic-search-after-upgrade-to-version-4/20994/6 "2021-08-26T08:50:25Z")
> >  | [nisow95612](https://nam12.safelinks.protection.outlook.com/?url=https%3A%2F%2Fcommunity.graylog.org%2Fu%2Fnisow95612&data=04%7C01%7Ctoma%40aaisonline.com%7C8150279416f3449987b008d9686c7e8e%7C11a183b0e7574f328f598d8dd716cade%7C0%7C0%7C637655637469057656%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=%2FoD8ZTj0TM9%2BwJ7pC4KkzT7vDPZlwcROnPKkn2pvcFU%3D&reserved=0)
> > August 26 |
> >
> > - | - |
>
> Well, I am a newbie…
>
> but if you deleted your index set on Elastic side, but Graylog still thinks it exists…
> … isn’t the solution simply to delete and re-create the index set on Graylog’s side?
I am looking for a solution like that. As you say, the problem is on the graylog side. It still thinks graylog\_298 exists. The problem with deleting the index set is that is is the default index set. I can’t delete it unless I create another index set and if do that—create another set and make it the default—when I try to delete it I get a warning that my couple of dozen streams are tied to it.
---
### Author:  [@nisow95612](https://community.graylog.org/u/nisow95612)
#### Post date: [August 26, 2021, 1:00pm UTC](https://community.graylog.org/t/need-to-clear-elastic-search-after-upgrade-to-version-4/20994/7 "2021-08-26T13:00:35Z")
> [@tgarons](#):
>
> I get a warning that my couple of dozen streams are tied to it.
Ah, right, each stream has its index set configured explicitly. I forgot about that.
You change assigned index set in More Actions → Edit stream, but there is no mass-update option in GUI.
---
### Author:  [@tgarons](https://community.graylog.org/u/tgarons)
#### Post date: [August 26, 2021, 3:23pm UTC](https://community.graylog.org/t/need-to-clear-elastic-search-after-upgrade-to-version-4/20994/8 "2021-08-26T15:23:03Z")
The solution turned out to be pretty simple: Go in to System-\>Indices-\>Default index set and then Maintenance-\>Rotate active write index
Everything seems to be working now
---
### Author:  [@gsmith](https://community.graylog.org/u/gsmith)
#### Post date: [August 26, 2021, 9:47pm UTC](https://community.graylog.org/t/need-to-clear-elastic-search-after-upgrade-to-version-4/20994/9 "2021-08-26T21:47:44Z")
I was assuming that might be the case. One of my servers had this problem I just rotated also.
> [@gsmith](#):
>
> Next option would be **rotate** you indices, same section. This would be the preferred way.
---
### Author:  [@gsmith](https://community.graylog.org/u/gsmith)
#### Post date: [August 26, 2021, 9:48pm UTC](https://community.graylog.org/t/need-to-clear-elastic-search-after-upgrade-to-version-4/20994/10 "2021-08-26T21:48:42Z")
> [@nisow95612](#):
>
> You change assigned index set in More Actions → Edit stream, but there is no mass-update option in GUI.
Yeah, you might have to go to each stream/index.
---
### Author:  [@tmacgbay](https://community.graylog.org/u/tmacgbay)
#### Post date: [August 27, 2021, 1:04pm UTC](https://community.graylog.org/t/need-to-clear-elastic-search-after-upgrade-to-version-4/20994/11 "2021-08-27T13:04:58Z")
if you want a good look at your indices on the Elasticsearch side:
`curl -X GET --netrc "MyESserverName:9200/_cat/indices/*?v&s=index&pretty"`
- `--netrc` refers to the `~/.netrc` file security info for accessing Elastic
- The operative piece in here is the `*` for all indices, you could put `gl*` for all indicies starting with `gl`
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [September 10, 2021, 1:05pm UTC](https://community.graylog.org/t/need-to-clear-elastic-search-after-upgrade-to-version-4/20994/12 "2021-09-10T13:05:26Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.