Following up on this.
Is it possible to temporarily disable Graylog Deflector automatically Re-pointing to the newest index (at least until it is fully re-created)
Seeing this in the logs.
2017-10-16_16:02:58.62104 WARN [IndexRotationThread] Deflector is pointing to [graylog_495], not the newest one: [graylog_496]. Re-pointing.
We had assumed that new messages continue being written to the current deflector pointing index
However we’re not sure anymore.
After Indexing is completed.
If we query Graylog for data in the index
_index:graylog_496
We noticed messages stopped arriving until the index writing was completed.
As seen the re-pointing occurred at 16:02:58
The first new message seen is stamped 16:42:36 (excluding the older data).
An interesting observation is that The original index was 7.7GB, with 3,853.939 messages
After indexing was completed, the new index is 14.7 GB with 4,052,139 messages
The increase in messages had made us assume that the messages kept on arriving.
Though almost double of the disk usage appears excessive and the gap of messages along with some custom alerts raised due to messages not arriving.
Update:
It looks like the messages were arriving but were queued and not processed.
Waited a while and the messages starting 16:02:51 started showing up.
So the original concern is valid.
Is it possible to temporarily disable Graylog Deflector automatically Re-pointing to the newest index.
Thanks