Hi Jason, what's your Graylog and Elasticsearch configuration? Are there any error messages in the logs of either Graylog or Elasticsearch?
Cheers, Jochen On Monday, 11 April 2016 07:15:17 UTC+2, Jason Haar wrote: > > Hi there > > Over the weekend I installed the ES marvel diagnostics package and the > following day noticed that graylog was broken. Restarting ES showed 20,000 > shards in an UNASSIGNED state. I disabled graylog-server (so there was no > new data flowing in) and watched over the next couple of hours as that > UNASSIGNED number dropped down to 0 (and GREEN). I then restarted ES and - > bam - back to 20,000 UNASSIGNED shards again > > I've now done three iterations of that - looks like it's completely > borked. There's over 5TB of data in there - how can I regain it? > > PS: I don't know if this has anything to do with marvel - it's just the > last change I made. The reason I installed it was because I have had ES > continually doing this kind of thing - but previously stopping graylog, > restarting ES and waiting would lead to a happy ES - but no longer. > > -- > Cheers > > Jason Haar > Information Security Manager, Trimble Navigation Ltd. > Phone: +1 408 481 8171 > PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1 > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/507dbfa3-0239-45ca-9799-2cae7db65418%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
