There were # failed indexing attempts in the last 24 hours NOT UPDATING

Graylog Central (peer support)
1

On the Overview page it is displaying “There were 20,353 failed indexing attempts in the last 24 hours.” When you go to show the errors it shows the last error over a month ago. For some reason the warning isn’t going away like it used to when no errors are present within 24 hours.

3 Node graylog cluster on version 4.2.6.
Nginx reverse proxy in front of Graylog.
HA proxy balancing in front of that.
5 node Elastic cluster version 7.10.0
All Centos 7.

Issue first occured on 4.2.5. Still present on 4.2.6.
Tried clearing cache and a different browser in case it was that, no luck.
Restarted the Graylog nodes and Elasticsearch nodes, no luck.

Any ideas?

2

Hello,

It takes 24 hours since the issue and the error shown will go away.

Yes it will keep the previous errors there.

Check you log files and permission on Graylog server.

I personal haven’t had this issue, but if it was my environment I would be searching all over my Graylog server for any clues on why/What is going on.

3

Thanks?

I’m aware the error on the Overview page should disappear after 24hr without index error. The fact it hasn’t is the question.

I’ve looked on the servers but haven’t found any clues yet.

4

Understood,
just an fyi MongoDb holds all the metadata. Might want to check there.

1 Like
5

@rfinney

Perhaps this may help, just came across it.

1 Like
6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.