Remove the enterprise and restart : crash with error on gl_failures index

Graylog Central (peer support)
2

Hello

Can I ask what packages you removed? and as for the error/s

WARN  [Indices] Couldn't create index gl-failures_0. Error: No index template provider found for type 'failures'
ERROR [IndexRotationThread] Couldn't point deflector to a new index
java.lang.RuntimeException: Could not create new target index <gl-failures_0>.

Have you tried check the health, indices, etc… of elasticsearch using cURL?

check’s examples

Dangling indices

curl -X GET http://es_node:9200/_dangling?pretty

Check cluster with an explanation

curl -XGET http://es_node:9200/_cluster/allocation/explain?pretty

or

Check health

curl -XGET http://es_node:9200/_cluster/health?pretty=true

or

Elasticsearch’s cat shards API will tell you which shards are unassigned, and why:

curl -XGET http://es_node:9200/_cat/shards?h=index,shard,prirep,state,unassigned.reason| grep UNASSIGNED

From what I get in the logs Graylog is looking for the Index prefix: gl-failures