search

Graylog2 / graylog2-server

Free and open log management
https://www.graylog.org
Other
7.43k stars 1.07k forks source link

Index not found #9595

Closed eglyn closed 4 years ago

eglyn commented 4 years ago

Hi everybody,

I have a greylog 4 setup on a VM and another VM for ElasticSearch 7. It was an old installation witch has been upgrade.

Since the upgrade, I have this error on graylog: image

When I check indices on Elasticsearch I have this: 

 curl -XGET localhost:9200/_cat/indices/
green  open gl-events_0        m4TenP3ARX2iqbbVGubIgA 4 0  0 0   832b   832b
yellow open graylog_deflector  MKf-mcsSQpujXLQzvaRFoQ 1 1 98 0 28.6mb 28.6mb
green  open gl-system-events_0 MXlzHJijT3aEKAeox4qBow 4 0  0 0   832b   832b

I suppose it's yellow because I have only 1 node.

I search a couple of hour on google for a solution, but I did not find anything :(

here the log: 2020-11-24T10:46:56.182+01:00 WARN [IndexFieldTypePollerPeriodical] Active write index for index set "Default index set" (5d7b94d3baa449398c9d9ec4) doesn't exist yet 2020-11-24T10:47:01.182+01:00 WARN [IndexFieldTypePollerPeriodical] Active write index for index set "Default index set" (5d7b94d3baa449398c9d9ec4) doesn't exist yet 2020-11-24T10:47:04.365+01:00 ERROR [AbstractRotationStrategy] Could not find current deflector target of index set <Default index set>. Aborting. org.graylog2.indexer.NoTargetIndexException: Couldn't get newest index number for indices [graylog_deflector] at org.graylog2.indexer.MongoIndexSet.getNewestIndexNumber(MongoIndexSet.java:170) ~[graylog.jar:?] at org.graylog2.indexer.MongoIndexSet.getNewestIndex(MongoIndexSet.java:146) ~[graylog.jar:?] at org.graylog2.indexer.rotation.strategies.AbstractRotationStrategy.rotate(AbstractRotationStrategy.java:60) ~[graylog.jar:?] at org.graylog2.periodical.IndexRotationThread.checkForRotation(IndexRotationThread.java:113) ~[graylog.jar:?] at org.graylog2.periodical.IndexRotationThread.lambda$doRun$0(IndexRotationThread.java:77) ~[graylog.jar:?] at java.lang.Iterable.forEach(Iterable.java:75) [?:1.8.0_272] at org.graylog2.periodical.IndexRotationThread.doRun(IndexRotationThread.java:73) [graylog.jar:?] at org.graylog2.plugin.periodical.Periodical.run(Periodical.java:77) [graylog.jar:?] at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_272] at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308) [?:1.8.0_272] at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180) [?:1.8.0_272] at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294) [?:1.8.0_272] at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_272] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_272] at java.lang.Thread.run(Thread.java:748) [?:1.8.0_272] 2020-11-24T10:47:06.259+01:00 WARN [IndexFieldTypePollerPeriodical] Active write index for index set "Default index set" (5d7b94d3baa449398c9d9ec4) doesn't exist yet Is there a way to "rebuild" indexes ?

jalogisch commented 4 years ago

he @eglyn

did you upgrade elasticsearch and restarted Graylog after the update to elasticsearch 7?

Graylog needs to start and register Elasticsearch7 as warm upgrades from Elasticsearch 6 to 7 are not working (currently).

eglyn commented 4 years ago

Yes Graylog Server has been restarted. We updated graylog 3 to 4, and Elasticsearch 6 to 7 and reboot all servers.

eglyn commented 4 years ago

I found a solution :)

Here -> https://docs.graylog.org/en/2.4/pages/faq.html#how-do-i-fix-the-deflector-exists-as-an-index-and-is-not-an-alias-error-message

And it's working great now :)