# Unable to get any data on streams

**URL:** <https://community.graylog.org/t/unable-to-get-any-data-on-streams/8792>\
**Category:** Graylog Central (peer support)\
**Created:** [February 11, 2019, 11:22am UTC](https://community.graylog.org/t/unable-to-get-any-data-on-streams/8792 "2019-02-11T11:22:26Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![blason](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/blason/32/2930_2.png) [@blason](https://community.graylog.org/u/blason)\
**Post date:** [February 11, 2019, 11:22am UTC](https://community.graylog.org/t/unable-to-get-any-data-on-streams/8792/1 "2019-02-11T11:22:26Z")

</div>

Hi there,

I am facing an issue with Graylog indices, my server HD got full hence Graylog stopped and I could not access graylog console. Since I first had to free up the disk space I had delete few old indices from Curl command line that is

curl -XDELEET [http://127.0.0.1/graylog\_1](http://127.0.0.1/graylog_1) and so on

After this I see the graylog has started however messages were not dumping in any of the indices however I see on the top that messages are being accepted but not sure where are those being stored.

Any clue what could have gone wrong?

---

<div class="post-metadata">

**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\
**Post date:** [February 11, 2019, 11:45am UTC](https://community.graylog.org/t/unable-to-get-any-data-on-streams/8792/2 "2019-02-11T11:45:37Z")

</div>

I recall another recent discussion that mentioned ElasticSearch having lots of trouble after its storage space had filled up. Could be that your Elastic instance has gone tits-up.

---

<div class="post-metadata">

**Author:** ![blason](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/blason/32/2930_2.png) [@blason](https://community.graylog.org/u/blason)\
**Post date:** [February 12, 2019, 2:03am UTC](https://community.graylog.org/t/unable-to-get-any-data-on-streams/8792/3 "2019-02-12T02:03:56Z")

</div>

Well I tried that but nothing worked. I guess reinstalling ES should do the trick? or any other measure you can recommend?

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [February 12, 2019, 8:49am UTC](https://community.graylog.org/t/unable-to-get-any-data-on-streams/8792/4 "2019-02-12T08:49:04Z")

</div>

what is in your Graylog server.log ? If the disk where the Graylog journal is located was full before the journal actually has grown to its max size, the journal is corrupt and you need to delete the message journal.

---

<div class="post-metadata">

**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\
**Post date:** [February 12, 2019, 7:26pm UTC](https://community.graylog.org/t/unable-to-get-any-data-on-streams/8792/5 "2019-02-12T19:26:55Z")

</div>

Reinstalling / wiping ElasticSearch is also a bit dramatic 🙂 Is this your DEV/TEST environment? Or worse, production data?

---

<div class="post-metadata">

**Author:** ![blason](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/blason/32/2930_2.png) [@blason](https://community.graylog.org/u/blason)\
**Post date:** [February 22, 2019, 4:43am UTC](https://community.graylog.org/t/unable-to-get-any-data-on-streams/8792/6 "2019-02-22T04:43:55Z")

</div>

@Totally_Not_A_Robot That was prod data

@jan - How do I delete the journal data then? to make it work? and my version was 2.4.

Please suggest

---

<div class="post-metadata">

**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\
**Post date:** [February 22, 2019, 7:22am UTC](https://community.graylog.org/t/unable-to-get-any-data-on-streams/8792/7 "2019-02-22T07:22:13Z")

</div>

> [@blason](#):
>
> @jan - How do I delete the journal data then? to make it work? and my version was 2.4.

The question is: WAS it the Graylog journal disk that filled up? Or was it the ElasticSearch disk? The solution differs wildly.

---

<div class="post-metadata">

**Author:** ![blason](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/blason/32/2930_2.png) [@blason](https://community.graylog.org/u/blason)\
**Post date:** [February 22, 2019, 5:58pm UTC](https://community.graylog.org/t/unable-to-get-any-data-on-streams/8792/8 "2019-02-22T17:58:23Z")

</div>

Ooops. My bad, didnt read the question correctly.

Yes it was elasticsearch which filled up my disk not journal.

---

<div class="post-metadata">

**Author:** ![laakkus](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/laakkus/32/3060_2.png) [@laakkus](https://community.graylog.org/u/laakkus)\
**Post date:** [February 22, 2019, 10:26pm UTC](https://community.graylog.org/t/unable-to-get-any-data-on-streams/8792/9 "2019-02-22T22:26:38Z")

</div>

Did you try to manually rotate write indexes?  
(Indices - click on name - maintenance)

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [February 23, 2019, 2:06pm UTC](https://community.graylog.org/t/unable-to-get-any-data-on-streams/8792/10 "2019-02-23T14:06:53Z")

</div>

> How do I delete the journal data then? to make it work? and my version was 2.4.

stop graylog delete all content from the folder that is configured as your journal, start Graylog

---

<div class="post-metadata">

**Author:** ![Totally\_Not\_A\_Robot](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/totally_not_a_robot/32/3353_2.png) [@Totally\_Not\_A\_Robot](https://community.graylog.org/u/Totally_Not_A_Robot)\
**Post date:** [February 25, 2019, 9:24am UTC](https://community.graylog.org/t/unable-to-get-any-data-on-streams/8792/11 "2019-02-25T09:24:54Z")

</div>

> [@blason](#):
>
> Yes it was elasticsearch which filled up my disk not journal.

In that case @jan’s suggestion doesn’t apply. But then I’m also not sure on how to proceed, because as I’ve mentioned: I’ve read threads where ElasticSearch itself gets broken from running out of disk space. I reckon you’d do well to also investigate through ElasticSearch documentation and forums.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [March 11, 2019, 9:25am UTC](https://community.graylog.org/t/unable-to-get-any-data-on-streams/8792/12 "2019-03-11T09:25:00Z")

</div>

Closed on March 11, 2019, 9:25am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
