Restore MongoDump in Graylog

Hello && welcome @mlhb
I see you were unable to save your old logs with restoring MongoDb. I have done this a couple times and received the same/similar error. It has been a a few years ago but my personal documents had a fix, this may or may not help but ill share it with you.

The basic steps I used I shorten it a bit for a general description.

sudo mongodump --db graylog --out /home/mongobackup/`date +"%m-%d-%y"` -u mongo_admin

Copy all the configuration files, certificates, etc… i.e., graylog, Elasticsearch & MongoDb).

curl -X POST "127.0.0.1:9200/_snapshot/my_repo/snapshot_1/_restore?pretty 

Execute mongorestore dump/ and service is working.
Once ES repo is migrated ensure Elasticsearch status is in “Green” .

If an errors do occur check indices.

ERROR [IndexRotationThread] Couldn’t point deflector to a new index
java.lang.IllegalArgumentException: [alias] is unsupported for [REMOVE_INDEX]

Elasticsearch exception [type=index_not_found_exception, reason=no such index ].

curl -XGET 'http://127.0.0.1:9200/_cat/indices?pretty=true'

If there are old indices make sure to remove them.
Example if I restored index graylog_1112 and if is index name graylog_0 or graylog_1 you need to remove them like this.

curl -XDELETE 127.0.0.1:9200/graylog_0

Note:

Rotating the indices manually on each index set.

When Migrating or just installing Graylog. Elasticsearch/OpenSearch is my first priority for starting services, then MongoDb and last start graylog service. When each service is started I also check status and logs files before continuing.

Here is another example of this that may help.

MongoDb does not hold Logs it retains metadata. Basically any configuration that were made. Elasticsearch is where you old logs are stored so if you do get an error like " no index found" you may have to make that index through Graylog GUI and/or MongoDb.

hop that helps