Hi Eugene, Graylog itself doesn't filter out "duplicate" data.
You could check your Elasticsearch indices using the approach laid out in https://qbox.io/blog/minimizing-document-duplication-in-elasticsearch after ingesting the missing data. Cheers, Jochen On Thursday, 3 November 2016 09:48:42 UTC+1, Eugene Gwon wrote: > > Hello all, > I have a problem. please help :( > I'm running 3 node of Elasticsearch. 1 master + data, and 2 data node. log > shipper is fluentd. > Unfortunately, today, I accidentally restarted graylog server. > this caused lost of some data, which sent from another servers. > > so I must re-insert data, but WITHOUT duplication. > Is it possible? > > or, can I just filtering duplicated data when search? > > Thanks for your help. > > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/f61136dd-7a1d-4af6-8bb9-6fc31e4647bc%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
