今天接到另一個問題
有人把graylog的index在沒有close情況下砍光了
然後出現了
graylog_deflector
這個index
砍了又會自動生出來
然後資料也進不去
本來想說再建一個indexset然後改成default再把原來的砍了
但 不行
找了半天
處理方法如下

Stop all Graylog nodes

(OPTIONAL) If you want to keep the already ingested messages, reindex them into the Elasticsearch index with the greatest number, e. g. graylog_23 if you want to fix the deflector graylog_deflector, via the Elasticsearch Reindex API.

Delete the graylog_deflector index via the Elasticsearch Delete Index API.


curl -u user:passwd -XDELETE http://10.0.0.0:9200/graylog_1

Add action.auto_create_index: false to the configuration files of all Elasticsearch nodes in your cluster and restart these Elasticsearch nodes, see Elasticsearch Index API - Automatic Index Creation and Creating an Index for details.

Start the Graylog master node.

Manually rotate the active write index of the index set on the System / Indices / Index Set page in the Maintenance dropdown menu.

(OPTIONAL) Start all remaining Graylog slave nodes.

https://community.graylog.org/t/graylog-error/10800

http://docs.graylog.org/en/3.0/pages/faq.html#how-do-i-fix-the-deflector-exists-as-an-index-and-is-not-an-alias-error-message

目前正常
觀察中