Upgraded to Graylog 4.0 and ElasticSearch 7.10 on Ubuntu 20.04 - Tons of errors in Deprecation Log

Graylog Central (peer support)
1

Howdy all. I just upgraded from Graylog 3.x to 4.0 and also ElasticSearch 6.8 to 7.10.

I’m trying to squash bugs, and I noticed that my deprecation log is almost 1GB in size and the below messages are being spammed like crazy. All the same two messages below, but I’m getting them 10-15 times per second.

Does ANYONE have any idea how I could troubleshoot this further? I really have no idea what’s going on and google searching hasn’t pulled up anything useful, except that the ELK documentation states the below is alerting me to something that needs to be changed. It doesn’t say what, and it doesn’t say how to find it.

Any help would be greatly appreciated.

[2020-12-23T23:56:48,477][DEPRECATION][o.e.d.c.m.IndexNameExpressionResolver] [app01] this request accesses system indices: [.apm-agent-configuration, .apm-custom-link, .kibana_1, .kibana_2, .kibana_task_manager_1, .kibana_task_manager_2, .tasks], but in a future major version, direct access to system indices will be prevented by default
[2020-12-23T23:56:48,477][DEPRECATION][o.e.d.a.a.i.a.g.TransportGetAliasesAction] [app01] this request accesses system indices: [.kibana_2, .kibana_1, .apm-agent-configuration, .kibana_task_manager_1, .tasks, .apm-custom-link, .kibana_task_manager_2], but in a future major version, direct access to system indices will be prevented by default
2

:wave: I noticed you didn’t get a reply here. Given your post in Purge configuration of Graylog 4, is it safe to assume that you’re starting from scratch?

3

Unfortunately. I’d still like to know WHY those things are happening though…

4

Hmmmm…Hard to say, tbh. What version of Graylog did you upgrade from?

5

It was the latest 3.x branch, I can’t remember off the top of my head. I think that I was having a TON of issues related to an ancient pfSense + Suricata thing I tried to do (that worked), but was abandoned by the creator and fell apart when things started to upgrade. I had originally started with Graylog 2 (I think) and ELK 2.0, and had been doing rolling upgrades accompanied with rolling OS updates.

Sometimes a fresh slate isn’t a bad thing… I just wish I knew more about how these pieces play together so I could have done more meaningful troubleshooting, but with errors that amount to “this thing failed, and will fail worse in the future”, without any idea of WHAT generated the query, etc., complicates things outside my level of understanding.

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.