I am running Graylog 2.2.3 and ES version 5.5.6 on Ubuntu 16.04LTS. Everything was working fine until I tried to make a copy of an index, then waited for the retention strategy to remove the old index and tried to re add it (I was doing this as we do demos on our Graylog platform, so I created a load of interesting events within the index and want to be able to just push it back in whenever we need to do a demo).
I did the previous by stopping ES and GL, then going into the /var/lib/elasticsearch/graylog/nodes/0/indices folder, copying and then zipping the index graylog_151, moving it to the home directory and the restarting everything. Once the index had been deleted from GL by the retention strategy I then stopped ES and GL then moved the index back into the indices folder, unzipped it and then set the permissions accordingly (this was done recursively so all files will have had the correct permissions I believe)
I am now getting the ES errors:
[2018-01-11T11:31:24,690][WARN ][o.e.t.n.Netty4Transport ] [APRMsnU] exception caught on transport layer [[id: 0xe812bbf1, L:/127.0.0.1:9300 - R:/127.0.0.1:44358]], closing connection
java.lang.IllegalStateException: Received message from unsupported version: [2.0.0] minimal compatible version is: [5.0.0]
I am getting the GL error:
2018-01-11T11:33:08.598Z ERROR [AlertScanner] Skipping alert check that threw an exception.
org.elasticsearch.cluster.block.ClusterBlockException: blocked by: [SERVICE_UNAVAILABLE/1/state not recovered / initialized];
And this error within the search portion of the web interface:
blocked by: [SERVICE_UNAVAILABLE/1/state not recovered / initialized];: cannot GET http://x.x.x.x:9000/api/search/universal/relative?query=*&range=300&limit=150&sort=timestamp%3Adesc (500)
Search status code:
Any ideas guys?