I can confirm this is a bug. When I issue the query by hand via curl, and I see the raw data, I can see that somehow, when Graylog is passing the data to ES, it is still tagging it with the old gl2_source_input (the one from the original Input). It is not using the existing ObjectId from Mongo.
On Tuesday, December 13, 2016 at 11:46:57 AM UTC-6, Jochen Schalanda wrote: > > Hi Jason, > > On Tuesday, 13 December 2016 17:16:37 UTC+1, Jason Close wrote: >> >> I then deleted it, and later came back and recreated that same input. >> >> Now, I cannot get data to show up when I query the received messages for >> that input, no matter the time range. >> > > You didn't create the same input, you created a new input with the same > name and probably the same settings. But it's not the same input. > > >> Is it possible that something is not getting properly updated or deleted >> within the config of Graylog that tells it which input buffer to look in? >> > > No, everything is working as intended, as far as I see. > > > Cheers, > Jochen > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/11f57ba5-41af-4652-b3aa-9dd462e1e78c%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
