Hello. I’ve been installed Graylog server + Opensearch for collecting syslog messages from Cisco environment. But there is one problem after all steps of installation has passed. When I create new input and go through show received messages I see: “While retrieving data for this widget, the foll…

Hey @boostmachine I have questions on your configuration files, if you dont mind. 1.is_leader = false Is this one node or iis this server in a cluster? If its one node it should be set to TRUE. 2.path.data: /graylog/opensearch/data This data path doesnt look normal. By chance did you reconfi…

The quick and easy thing to do would be to go to System/Indices, then click on the name of your index (probably default index set). You should see three buttons on the right. [image] Click the maintenance button and choose “Rotate Active Write Index”. Then click “recalculate index ranges” If tha…

Hello, Chris, thank you very much for your reply. I do as you said, but for some reason I also show elasticsearch indeсes in that page, but not opensearch. Is this normal? [image] And when I click Recalculate index ranges I see that message: “Could not create a job to start index ranges recalcu…

Hey @boostmachine just chiming in I see you cluster is in Yellow, From you curl command it shows the the index [my-index] is not there.Do you have a index called [My-index] or any stream connect to [My-index] ? As you posted above you have couple indices in yellow and one called myservicena…

Hello here, thank you for your reply. Yeah, I made a mistake and inserted the wrong command output. My index called graylog_deflector. So this output is: curl ‘localhost:9200/_cat/indices?v’ health status index uuid pri rep docs.count docs.deleted store.size pri.st…

Hey @boostmachine [image] boostmachine: I just dont understand why if I start Graylog server there are two shards with the same name and one of that is unassigned: curl ‘localhost:9200/ Only way to tell If you could show your configuration file ( Graylog) and perhaps your ES/OS yaml file…

Hey @boostmachine I over looked this [image] boostmachine: graylog_deflector 0 p STARTED 17 151.5kb 10.53.15.147 krk-log101 graylog_deflector 0 r UNASSIGNED P = Primary shard R = replica shard Thats why you have two, yeah something is up with you index set

I appreciate your help a lot. So I will put only those lines that are uncommented in the server.conf of Graylog. is_leader = false node_id_file = /etc/graylog/server/node-id password_secret = ### root_username = ### root_password_sha2 = ### bin_dir = /usr/share/graylog-server/bin data_dir = /var/l…

Hello, I had something similar on some of my indexes (Indices) Deflector is not “a real” index, I had to do the following: stop INPUT(s) curl -X DELETE localhost:9200/*_deflector (on the node ES/OS is running) rotate the graylog index and you should see graylog0 (index) in the GUI start the inpu…

Sorry, my reply was blocked as spam. I did this common but with my index name (graylog_deflector) curl -X DELETE “localhost:9200/my-index-000001?pretty”, and reload Graylog server and it doesn’t work. So there is my config files of Graylog and Opensearch, could you help me if I made mistake over t…

Hello, thank you for your reply. After the first two steps, the GUI page with the index does not load and hangs like this: [image] Just endless loading. What’s wrong with that? :unamused:

Type=index_not_found_exception

Graylog Central (peer support)

gsmith (GSmith) February 7, 2023, 5:57am 7

Hey @boostmachine

I over looked this

P = Primary  shard
R = replica shard

Thats why you have two, yeah something is up with you index set

Topic		Replies	Views
Graylog Migration from ElasticSearch to OpenSearch Graylog Central (peer support)	1	194	November 10, 2025
Could not retrieve Elasticsearch cluster health. Fetching Elasticsearch cluster health failed: There was an error fetching a resource: Internal Server Error. Additional information: Couldn't read Elasticsearch cluster health Graylog Central (peer support) docker	8	5846	January 24, 2023
New Ubuntu install - initial setup prompting to configure opensearch? Graylog Central (peer support)	19	1774	May 21, 2024
Migration from Elasticsearch to Opensearch gone wrong? Graylog Central (peer support)	13	2237	January 24, 2023
Graylog 5 with Opensearch unable to start because Elasticsearch is not installed Graylog Central (peer support)	6	10661	December 12, 2022

Type=index_not_found_exception

Related topics