Recent upgrade: Default indices set incorrectly

[altsysrq (Richard Anderson)]

Is there a way to switch the “All messages” default indices? The option to do so is greyed out.

I just did an upgrade from 3.1 to 4.1 (one version at a time and testing in between - 3.1->3.2->3.3 …). One of the options that was overlooked was explicitly setting the default prefix (elasticsearch_index_prefix). Now I have the stream “All messages” going to a new indices, “Default index set” (with the prefix ‘graylog’), with all other streams going to “Default index set” (with the prefix ‘graylog2’).

Are there other solutions to this? Move or merge the old indices into the new one?

Let me know if you have any questions.

[altsysrq (Richard Anderson)]

Here is the solution I came to terms with:

1. Add “elasticsearch_index_prefix = <correct_prefix>” to graylog/server.conf
2. Restart graylog
3. Connect to MongoDB and switch the index_set_id for the correct one - it should be able to be determined by looking at other streams
4. Restart mongoDB

To make things a little easier I used the MongoDB extension for VSCode. Here is the json code:

{
  "_id": {
    "$oid": "000000000000000000000002"
  },
  "creator_user_id": "admin",
  "is_default_stream": false,
  "index_set_id": "<new_index_ID>",
  "matching_type": "AND",
  "remove_matches_from_default_stream": true,
  "description": "Stream containing all events created by Graylog",
  "created_at": {
    "$date": "2021-07-13T16:27:35.666Z"
  },
  "disabled": false,
  "title": "All events"
}