Problems with search

(Stephan Krinetzki) #1


Today I deleted some old indices in our external Elasticsearch cluster, to gain some space. But now Graylog doesn’t show any results. I already tried to rebuild the ranges

curl -XPOST

But without luck. The data is written to the current Graylog index. Any ideas?

Graylog Version 2.4.5
Elasticsearch 5.x

(Jan Doberstein) #2

did you see any information in your Graylog server log? Did you restart Graylog?

If you had deleted the indices inside Graylog, this might not had happened.

(Stephan Krinetzki) #3

Hi Jan,

after the rotation of the index (we rotate daily), the error disappeared. I couldn’t find a helpful message in the log. The deletion of the indices was directly on the elasticsearch cluster, nothing from the Graylog GUI. Even a reboot didn’t fixed it. For the futur: What are the steps, if i need to delete an index manually?

(Jan Doberstein) #4

You should do the index manipulation inside of Graylog. This is done on the SYSTEM > INDICES page.

If you delete the indices outsite of Graylog the rebuild is what should have solve the issue. But it is highly recommend not to manipulate the indices outside of Graylog.

(system) closed #5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.