I can confirm this is a bug. When I issue the query by hand via curl, and I see the raw data, I can see that somehow, when Graylog is passing the data to ES, it is still tagging it with the old gl2_source_input (the one from the original Input). It is not using the existing ObjectId from Mongo.
On Tuesday, December 13, 2016 at 11:46:57 AM UTC-6, Jochen Schalanda wrote: > > Hi Jason, > > On Tuesday, 13 December 2016 17:16:37 UTC+1, Jason Close wrote: >> >> I then deleted it, and later came back and recreated that same input. >> >> Now, I cannot get data to show up when I query the received messages for >> that input, no matter the time range. >> > > You didn't create the same input, you created a new input with the same > name and probably the same settings. But it's not the same input. > > >> Is it possible that something is not getting properly updated or deleted >> within the config of Graylog that tells it which input buffer to look in? >> > > No, everything is working as intended, as far as I see. > > > Cheers, > Jochen > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/11f57ba5-41af-4652-b3aa-9dd462e1e78c%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
