# Restore index but can't write **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [January 23, 2018, 3:22pm UTC](https://community.graylog.org/t/restore-index-but-cant-write/3910 "2018-01-23T15:22:06Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Le-DOC](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@Le-DOC](https://community.graylog.org/u/Le-DOC)\ **Post date:** [January 23, 2018, 3:22pm UTC](https://community.graylog.org/t/restore-index-but-cant-write/3910/1 "2018-01-23T15:22:06Z")
Hi, my data disk was corrupt, and I need to restore index with elasticsearch. Data are restored, and I see them on graylog, but I can’t see newer logs. Nothing is written. No error on logs. I tryed recalculate index range but still nothing. Im on graylog 2.3 with ES 2.3 ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [January 23, 2018, 3:24pm UTC](https://community.graylog.org/t/restore-index-but-cant-write/3910/2 "2018-01-23T15:24:03Z")
What was the reason for the corruption? What did you do to restore data and which data specifically? What’s in the logs of your Graylog and Elasticsearch nodes? ---
**Author:** ![Le-DOC](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@Le-DOC](https://community.graylog.org/u/Le-DOC)\ **Post date:** [January 23, 2018, 3:29pm UTC](https://community.graylog.org/t/restore-index-but-cant-write/3910/3 "2018-01-23T15:29:42Z")
Corruption was from the disk (ext2…) i move my datas on xfs volume with same mount point. my restore script is: curl -s -XPOST “[http://localhost:9200/\_snapshot/quotidien/quotidien/\_restore](http://localhost:9200/_snapshot/quotidien/quotidien/_restore)” -d “{“indices”: “graylog2\_17”, “ignore\_unavailable”: true, “include\_global\_state”: false}” Graylog node have nothing special, and ES log have only restore logs GREEN to RED, and RED to GREEN ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [January 23, 2018, 3:31pm UTC](https://community.graylog.org/t/restore-index-but-cant-write/3910/4 "2018-01-23T15:31:26Z")
> [@Le-DOC](#): > > Corruption was from the disk (ext2…) Was the Graylog journal directory on the same disk? > [@Le-DOC](#): > > Graylog node have nothing special How do you know? What’s the status of the Graylog Deflector index alias in Elasticsearch? ---
**Author:** ![Le-DOC](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@Le-DOC](https://community.graylog.org/u/Le-DOC)\ **Post date:** [January 23, 2018, 3:33pm UTC](https://community.graylog.org/t/restore-index-but-cant-write/3910/5 "2018-01-23T15:33:07Z")
What do you means about graylog journal directory ? log ? the deflector indexes are online, I just create a new ont to be sure, and 0 message. ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [January 23, 2018, 3:34pm UTC](https://community.graylog.org/t/restore-index-but-cant-write/3910/6 "2018-01-23T15:34:24Z")
> [@Le-DOC](#): > > What do you means about graylog journal directory ? log ? > > [@Le-DOC](#): > > the deflector indexes are online, I just create a new ont to be sure, and 0 message. What did you do exactly? How exactly did you check the status of the deflector alias? And is it an index or an index alias? ---
**Author:** ![Le-DOC](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@Le-DOC](https://community.graylog.org/u/Le-DOC)\ **Post date:** [January 23, 2018, 3:37pm UTC](https://community.graylog.org/t/restore-index-but-cant-write/3910/7 "2018-01-23T15:37:01Z")
message\_journal is on other dir: /var/lib/graylog-server/journal for deflector, i checked on head. graylog2\_deflector is an alias of graylog2\_18 ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [January 23, 2018, 3:54pm UTC](https://community.graylog.org/t/restore-index-but-cant-write/3910/8 "2018-01-23T15:54:29Z")
Try removing all files in `/var/lib/graylog-server/journal/` while Graylog is stopped and start it afterwards. Disclaimer: This will delete all log messages which are in the journal and haven’t been written to Elasticsearch yet. ---
**Author:** ![Le-DOC](https://avatars.discourse-cdn.com/v4/letter/l/4af34b/32.png) [@Le-DOC](https://community.graylog.org/u/Le-DOC)\ **Post date:** [January 23, 2018, 3:57pm UTC](https://community.graylog.org/t/restore-index-but-cant-write/3910/9 "2018-01-23T15:57:56Z")
Wonderful, it work ! Thanks for quick answer ! ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [February 6, 2018, 3:57pm UTC](https://community.graylog.org/t/restore-index-but-cant-write/3910/10 "2018-02-06T15:57:56Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.