Index selection for relative searches uses an ancient index ?

[henrikjohansen]

Poking around our test cluster I found something odd when searching for messages in the last 5,15 and 30 minutes :

Indices used for this search:
graylog2_820
graylog2_821
graylog2_118

graylog2_118 is ancient :

[kroepke]

@henrikjohansen could you attach the content of the index_ranges mongodb collection, please?

e.g. with mongoexport -d graylog2 -c index_ranges

Thanks!

[henrikjohansen]

@kroepke sorry for the delay ... I've been swamped :(

The mongo data is here :

https://gist.github.com/henrikjohansen/a3cdb138fa04eb534175

[kroepke]

Thanks!

That data validates our suspicion. That index contains a message with a future date (in your case it's 2015-12-31 23:59) and the index selection currently does not limit the upper bound of indices it looks into.

There's an issue for this in the web interface repo: graylog-labs/graylog2-web-interface#1238
We will be looking to resolve that in an upcoming bug fix release.

[kroepke]

I'll leave this one open until we've fix the linked issue.

[zexxon]

Please see the linked issue: #1208