Hi, it seems as if your deflector (an Elasticsearch index alias <http://www.elasticsearch.org/guide/en/elasticsearch/reference/0.90/indices-aliases.html> used by Graylog2) has been corrupted. Graylog2 currently doesn't support index aliases with more than 1 target index.
You can either fix this manually by deleting the "graylog2_deflector" index alias in Elasticsearch and restart Graylog2, or by running the appropriate Graylog2 system job with: curl --user $user:$password -X POST http://127.0.0.1:12900/system/deflector/cycle Of course it would also be interesting to find out why the index alias was corrupted in the first place. Cheers, Jochen Am Mittwoch, 13. August 2014 14:37:10 UTC+2 schrieb Guanqing Lu: > > Hi > > Welcome for any help to troubleshoot following error message, it > updates every second. > > Our graylog2 version is 0.20.6-1. > > # dpkg -l |grep graylog2 > ii graylog2-server 0.20.6-1 all > Graylog2 Loggingframework - Server > > Thanks in advance. > > Guanqing > > 2014-08-12* 00:05:43,*057 ERROR: > org.graylog2.outputs.BatchedElasticSearchOutput - Unable to flush message > buffer: org.elasticsearch.ElasticSearchIllegalArgumentException: Alias > [graylog2_deflector] has more than one indices associated with it > [[graylog2_1084, graylog2_1081]], can't execute a single index op - > [org.elasticsearch.cluster.metadata.MetaData.concreteIndex(MetaData.java:593), > > org.elasticsearch.action.bulk.TransportBulkAction.executeBulk(TransportBulkAction.java:159), > > org.elasticsearch.action.bulk.TransportBulkAction.doExecute(TransportBulkAction.java:140), > > org.elasticsearch.action.bulk.TransportBulkAction.doExecute(TransportBulkAction.java:63), > > org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:63), > > org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:49), > > org.elasticsearch.client.node.NodeClient.execute(NodeClient.java:85), > org.elasticsearch.client.support.AbstractClient.bulk(AbstractClient.java:144), > > org.graylog2.indexer.Indexer.bulkIndex(Indexer.java:290), > org.graylog2.outputs.ElasticSearchOutput.write(ElasticSearchOutput.java:73), > org.graylog2.outputs.BatchedElasticSearchOutput.synchronousFlush(BatchedElasticSearchOutput.java:62), > > org.graylog2.outputs.BatchedElasticSearchOutput$1.run(BatchedElasticSearchOutput.java:76), > > java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471), > java.util.concurrent.FutureTask.run(FutureTask.java:262), > java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145), > > java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615), > > java.lang.Thread.run(Thread.java:744)] > > 2014-08-12* 00:05:44,*071 ERROR: > org.graylog2.outputs.BatchedElasticSearchOutput - Unable to flush message > buffer: org.elasticsearch.ElasticSearchIllegalArgumentException: Alias > [graylog2_deflector] has more than one indices associated with it > [[graylog2_1084, graylog2_1081]], can't execute a single index op - > [org.elasticsearch.cluster.metadata.MetaData.concreteIndex(MetaData.java:593), > > org.elasticsearch.action.bulk.TransportBulkAction.executeBulk(TransportBulkAction.java:159), > > org.elasticsearch.action.bulk.TransportBulkAction.doExecute(TransportBulkAction.java:140), > > org.elasticsearch.action.bulk.TransportBulkAction.doExecute(TransportBulkAction.java:63), > > org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:63), > > org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:49), > > org.elasticsearch.client.node.NodeClient.execute(NodeClient.java:85), > org.elasticsearch.client.support.AbstractClient.bulk(AbstractClient.java:144), > > org.graylog2.indexer.Indexer.bulkIndex(Indexer.java:290), > org.graylog2.outputs.ElasticSearchOutput.write(ElasticSearchOutput.java:73), > org.graylog2.outputs.BatchedElasticSearchOutput.synchronousFlush(BatchedElasticSearchOutput.java:62), > > org.graylog2.outputs.BatchedElasticSearchOutput$1.run(BatchedElasticSearchOutput.java:76), > > java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471), > java.util.concurrent.FutureTask.run(FutureTask.java:262), > java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145), > > java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615), > > java.lang.Thread.run(Thread.java:744)] > > 2014-08-12 *00:05:45,*065 ERROR: > org.graylog2.outputs.BatchedElasticSearchOutput - Unable to flush message > buffer: org.elasticsearch.ElasticSearchIllegalArgumentException: Alias > [graylog2_deflector] has more than one indices associated with it > [[graylog2_1084, graylog2_1081]], can't execute a single index op - > [org.elasticsearch.cluster.metadata.MetaData.concreteIndex(MetaData.java:593), > > org.elasticsearch.action.bulk.TransportBulkAction.executeBulk(TransportBulkAction.java:159), > > org.elasticsearch.action.bulk.TransportBulkAction.doExecute(TransportBulkAction.java:140), > > org.elasticsearch.action.bulk.TransportBulkAction.doExecute(TransportBulkAction.java:63), > > org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:63), > > org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:49), > > org.elasticsearch.client.node.NodeClient.execute(NodeClient.java:85), > org.elasticsearch.client.support.AbstractClient.bulk(AbstractClient.java:144), > > org.graylog2.indexer.Indexer.bulkIndex(Indexer.java:290), > org.graylog2.outputs.ElasticSearchOutput.write(ElasticSearchOutput.java:73), > org.graylog2.outputs.BatchedElasticSearchOutput.synchronousFlush(BatchedElasticSearchOutput.java:62), > > org.graylog2.outputs.BatchedElasticSearchOutput$1.run(BatchedElasticSearchOutput.java:76), > > java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471), > java.util.concurrent.FutureTask.run(FutureTask.java:262), > java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145), > > java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615), > > java.lang.Thread.run(Thread.java:744)] > [GC 54268866K->42916553K(136795840K), 0.0652890 secs] > > 2014-08-12 *00:05:46*,063 ERROR: > org.graylog2.outputs.BatchedElasticSearchOutput - Unable to flush message > buffer: org.elasticsearch.ElasticSearchIllegalArgumentException: Alias > [graylog2_deflector] has more than one indices associated with it > [[graylog2_1084, graylog2_1081]], can't execute a single index op - > [org.elasticsearch.cluster.metadata.MetaData.concreteIndex(MetaData.java:593), > > org.elasticsearch.action.bulk.TransportBulkAction.executeBulk(TransportBulkAction.java:159), > > org.elasticsearch.action.bulk.TransportBulkAction.doExecute(TransportBulkAction.java:140), > > org.elasticsearch.action.bulk.TransportBulkAction.doExecute(TransportBulkAction.java:63), > > org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:63), > > org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:49), > > org.elasticsearch.client.node.NodeClient.execute(NodeClient.java:85), > org.elasticsearch.client.support.AbstractClient.bulk(AbstractClient.java:144), > > org.graylog2.indexer.Indexer.bulkIndex(Indexer.java:290), > org.graylog2.outputs.ElasticSearchOutput.write(ElasticSearchOutput.java:73), > org.graylog2.outputs.BatchedElasticSearchOutput.synchronousFlush(BatchedElasticSearchOutput.java:62), > > org.graylog2.outputs.BatchedElasticSearchOutput$1.run(BatchedElasticSearchOutput.java:76), > > java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471), > java.util.concurrent.FutureTask.run(FutureTask.java:262), > java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145), > > java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615), > > java.lang.Thread.run(Thread.java:744)] > > -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
