以下是整理關於因為es故障造成graylog 異常的一些解決方法
問題
- 現象
Deflector exists as an index and is not an alias - 解決
官方的步驟
- Stop all Graylog nodes
- (OPTIONAL) If you want to keep the already ingested messages, reindex them into the Elasticsearch index with the greatest number, e. g. graylog_23 if you want to fix the deflector graylog_deflector, via the Elasticsearch Reindex API.
- Delete the graylog_deflector index via the Elasticsearch Delete Index API.
- Add action.auto_create_index: false to the configuration files of all Elasticsearch nodes in your cluster and restart these Elasticsearch nodes, see Elasticsearch Index API - Automatic Index Creation and Creating an Index for details.
- Start the Graylog master node.
- Manually rotate the active write index of the index set on the System / Indices / Index Set page in the Maintenance dropdown menu.
- (OPTIONAL) Start all remaining Graylog slave nodes.
實際上我們可以不按照官方的做法，以下是一些實踐（前提是現有的數據不是很重要，可以刪除的）
- 可以不用停止graylog server
- 修改es 配置，添加action.auto_create_index: false注意需要重啟es集群，理論上單台重啟不會有影響的（和部署模型也有關系）
- 刪除*_deflector 索引（可以通過api以及ui）
- 手工 rotate active write