Hi, Are these retention strategies applied only to newly created indices?
As far as I understand it is only for new indices. You could install the ElasticHQ plugin, and delete one or more indices with it safely. Do not forget to recalculate the indices from the grayling interface. hth,, Arie Op maandag 20 april 2015 18:34:22 UTC+2 schreef Mustafa Khafateh: > > Hello, > > It looks like I allocated more space than available on disk. The > elasticsearch status is red, and graylog-server is not starting. > > This graylog instance is installed from the 1.0.1 OVA. The total root > partition size: ~17GB. The retention strategy was "size", 1GB per index and > 10 indices. (I'm guessing Ubuntu also takes up ~5GB.) > > I did "sudo /usr/bin/graylog-ctl restart" after both changing the > retention strategy decreasing the number/size of indices. graylog-server > and elasticsearch aren't starting up and giving the same error messages > below. > > Are these retention strategies applied only to newly created indices? > > Is there a way to delete old indices and start elasticsearch again? > > > in /var/log/graylog/server/current: > 2015-04-16_21:23:24.37414 2015-04-16 17:23:24,374 WARN : > org.graylog2.indexer.esplugin.ClusterStateMonitor - No Elasticsearch data > nodes in cluster, cluster is completely offline. > > 2015-04-16_21:23:27.58418 2015-04-16 17:23:27,584 WARN : > org.graylog2.initializers.BufferSynchronizerService - Elasticsearch is > unavailable. Not waiting to clear buffers and caches, as we have no healthy > cluster. > > 2015-04-16_21:23:27.54738 2015-04-16 17:23:27,547 ERROR: org.graylog2.UI - > 2015-04-16_21:23:27.54739 > 2015-04-16_21:23:27.54740 > ################################################################################ > 2015-04-16_21:23:27.54740 > 2015-04-16_21:23:27.54740 ERROR: The Elasticsearch cluster state is RED > which means shards are unassigned. This usually indicates a crashed and > corrupt cluster and needs to be investigated. Graylog will shut down. > 2015-04-16_21:23:27.54741 > > > in /var/log/graylog/elasticsearch/current: > 2015-04-16_21:10:04.22641 [2015-04-16 17:10:04,226][WARN > ][cluster.routing.allocation.decider] [Berzerker] high disk watermark [10%] > exceeded on [cz0c8J6PRdG4Kuwnbz6rMQ][Berzerker] free: 718.3mb[4.7%], shards > will be relocated away from this node > 2015-04-16_21:10:04.22659 [2015-04-16 17:10:04,226][INFO > ][cluster.routing.allocation.decider] [Berzerker] high disk watermark > exceeded on one or more nodes, rerouting shards > > Thanks, > Mustafa > -- You received this message because you are subscribed to the Google Groups "graylog2" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
