Hi Eugene, Graylog itself doesn't filter out "duplicate" data.
You could check your Elasticsearch indices using the approach laid out in https://qbox.io/blog/minimizing-document-duplication-in-elasticsearch after ingesting the missing data. Cheers, Jochen On Thursday, 3 November 2016 09:48:42 UTC+1, Eugene Gwon wrote: > > Hello all, > I have a problem. please help :( > I'm running 3 node of Elasticsearch. 1 master + data, and 2 data node. log > shipper is fluentd. > Unfortunately, today, I accidentally restarted graylog server. > this caused lost of some data, which sent from another servers. > > so I must re-insert data, but WITHOUT duplication. > Is it possible? > > or, can I just filtering duplicated data when search? > > Thanks for your help. > > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/f61136dd-7a1d-4af6-8bb9-6fc31e4647bc%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
