Effect of deleting index after disk space crash

Elastic Stack Elasticsearch
1

Hi All,

Kindly forgive a very basic question.

I use Graylog + ES.

Say my disk runs out of space, crashes and I do a system reboot. Now, I
restart ES and then graylog. On the graylog web ui, my search does not
work and I get the error:

URI::InvalidURIError (bad URI(is not URI?): http://localhost:9200/NOTARGET*,-graylog2_recent/message/_search?from=0&size=100):

On searching the net for the above issue, I found that one of the means to
resolve this was to stop graylog server, delete the previous elastic
search index by say :
curl -XDELETE localhost:9200/graylog2_*
and then start graylog.

Now my question is, if I do the same, will my previous data get lost or
not? On deleting the index, does the data get lost? If yes, how to go
about it if I want to retain my old data?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

2

Hi,

If you are deleting your index then your old data from the index will be
gone. If the problem is on one node then you could delete just the shard
that's on that node and ES will make another copy of the shard from the
replica. I'm assuming you added more disk space, but you mentioned just a
reboot.

Otis

ELASTICSEARCH Performance Monitoring - Sematext Monitoring | Infrastructure Monitoring Service

On Wednesday, April 17, 2013 3:59:22 PM UTC-4, Kaushal wrote:

Hi All,

Kindly forgive a very basic question.

I use Graylog + ES.

Say my disk runs out of space, crashes and I do a system reboot. Now, I
restart ES and then graylog. On the graylog web ui, my search does not
work and I get the error:

URI::InvalidURIError (bad URI(is not URI?): http://localhost:9200/NOTARGET*,-graylog2_recent/message/_search?from=0&size=100):

On searching the net for the above issue, I found that one of the means to
resolve this was to stop graylog server, delete the previous elastic
search index by say :
curl -XDELETE localhost:9200/graylog2_*
and then start graylog.

Now my question is, if I do the same, will my previous data get lost or
not? On deleting the index, does the data get lost? If yes, how to go
about it if I want to retain my old data?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

3

Thanks Otis... But I have further doubts!!!

2 questions. Again, forgive the simplicity of them:

  1. Isn't a shard a Lucene instance? Then how to delete a shard?

  2. I have 1 shard on graylog2_0 node. Then which replica are we talking
    about?

On Thursday, 18 April 2013 06:08:37 UTC+5:30, Otis Gospodnetic wrote:

Hi,

If you are deleting your index then your old data from the index will be
gone. If the problem is on one node then you could delete just the shard
that's on that node and ES will make another copy of the shard from the
replica. I'm assuming you added more disk space, but you mentioned just a
reboot.

Otis

ELASTICSEARCH Performance Monitoring - Sematext Monitoring | Infrastructure Monitoring Service

On Wednesday, April 17, 2013 3:59:22 PM UTC-4, Kaushal wrote:

Hi All,

Kindly forgive a very basic question.

I use Graylog + ES.

Say my disk runs out of space, crashes and I do a system reboot. Now, I
restart ES and then graylog. On the graylog web ui, my search does not
work and I get the error:

URI::InvalidURIError (bad URI(is not URI?): http://localhost:9200/NOTARGET*,-graylog2_recent/message/_search?from=0&size=100):

On searching the net for the above issue, I found that one of the means
to resolve this was to stop graylog server, delete the previous elastic
search index by say :
curl -XDELETE localhost:9200/graylog2_*
and then start graylog.

Now my question is, if I do the same, will my previous data get lost or
not? On deleting the index, does the data get lost? If yes, how to go
about it if I want to retain my old data?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.

4

Hi All,

I resolved the problem by deleting the alias deflector target and
restarting the Graylog server. Can anyone tell me a bit more about what an
alias deflector target is?

On Thursday, 18 April 2013 06:08:37 UTC+5:30, Otis Gospodnetic wrote:

Hi,

If you are deleting your index then your old data from the index will be
gone. If the problem is on one node then you could delete just the shard
that's on that node and ES will make another copy of the shard from the
replica. I'm assuming you added more disk space, but you mentioned just a
reboot.

Otis

ELASTICSEARCH Performance Monitoring - Sematext Monitoring | Infrastructure Monitoring Service

On Wednesday, April 17, 2013 3:59:22 PM UTC-4, Kaushal wrote:

Hi All,

Kindly forgive a very basic question.

I use Graylog + ES.

Say my disk runs out of space, crashes and I do a system reboot. Now, I
restart ES and then graylog. On the graylog web ui, my search does not
work and I get the error:

URI::InvalidURIError (bad URI(is not URI?): http://localhost:9200/NOTARGET*,-graylog2_recent/message/_search?from=0&size=100):

On searching the net for the above issue, I found that one of the means
to resolve this was to stop graylog server, delete the previous elastic
search index by say :
curl -XDELETE localhost:9200/graylog2_*
and then start graylog.

Now my question is, if I do the same, will my previous data get lost or
not? On deleting the index, does the data get lost? If yes, how to go
about it if I want to retain my old data?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.