Thanks for the info. That was my hunch, but I wanted to make sure. Upgrading from 3 to 4 and ELK from 6.8 to 7.10 is what caused this whole mess…
I literally only use Graylog and ELK for syslog centralization and easy searching, and the upgrade completely screwed up everything. I think at this point you’re right… I’m going to remove everything and start over.
I didn’t think that a simple remove would purge the data though… I was pretty sure that simply removing mongodb will leave the database behind. I am nervous, but maybe a purge is the right thing to do…