Snapshot of graylog indices not seen

[dfa (david)]

Hello, excuse my English.

I have exported a snapshot from elasticsearch 7 to another graylog 4.0. Since graylog 4.0, doing a curl on elastic if I see the exported indices, but not from the graylog web panel.

What am I doing wrong?

[aaronsachs]

Graylog literally doesn’t care what indices are in Elasticsearch and honestly, has no way of knowing what indices are in Elasticsearch unless you’ve created an index set in Graylog that references the indices. Have you created an index set in the other Graylog cluster? If not, try that.

[dfa (david)]

@aaronsachs

‎A Graylog literalmente no le importa qué índices hay en Elasticsearch y, honestamente, no tiene forma de saber qué índices hay en Elasticsearch a menos que haya creado un índice establecido en Graylog que haga referencia a los índices. ¿Ha creado un conjunto de índices en el otro clúster de Graylog? Si no, prueba eso.‎

Good! I have copied an index from elastic 6.8 to graylog 4 (with elastic 7).

How can I reference an index created in graylog to its elastic?

Thanks!

[gsmith]

@dfa
Hello,
Just chiming in, Have you seen this?

Elastic Restore Help Please

I’m migrating from Graylog 3.2.x to 4.x and I have made an elastic backup from 3.x. I have added the elastic repo on the new running and logging server. It has been collecting logs for about a week. I’m about ready to pull the trigger on restoring the old data. But I need a sanity check before I blow away a week worth of logs. I’m not exactly sure what happens now. Will I see a new index appear in Graylog after the restore? Will I accidentally erase the new stuff restoring the old? Will Grayl…

[dfa (david)]

Hello and thanks for the answers!

I have restored the snapshot and created the index manually and graylog reads the index without problems, indicating that there is 1 index, 10,541,968 documents, 6.4GiB, this is correct.

But when I go to search, nothing appears!

There is no error in the logs, everything seems correct, but when searching, nothing comes out …

What can happen?

[gsmith]

Have you tried searching for “ALL Messages” in the stream that is attached to index oepm2023?

[dfa (david)]

Hi friend!

I have created a stream pointing to the index and now in the search I have two errors:

I will try to investigate why this occurs.

[dfa (david)]

Good,

I have reindexed again fixing the errors but there are still no records in the search … selecting “all messages” and the index migrated