Any idea why this happens? I’m not aware of any changes so far to the Graylog instance besides updating from 4.0.1 to 4.0.2, and I have no clue where to look or how to debug further.
Yes you are right. The “issue” was introduced in Graylog v4.0.2 as the timestamp format for new ES indices were changed to 8yyyy-MM... which is not supported by ES 6.4. As ES 6.4 is AFAIK EOL anyway and not supported by Graylog anymore that was my fault and I have to upgrade.