Fixing Nazara errors

roles/Sharingan/README.md

@@ -29,6 +29,26 @@ TODO
 
 ## Monit
 
+## Graylog
+
+## Elasticsearch
+Elasticsearch acts as graylog's data backend. 
+
+We have seen issues where poor disk i/o or unplanned shutdown can cause Elasticsearch to have index corruption. 
+
+1. Stop elasticsearch
+1. From `/usr/share/elasticsearch/lib`, you can use `java -cp lucene-core*.jar -ea:org.apache.lucene... org.apache.lucene.index.CheckIndex /usr/share/elasticsearch/data/nodes/0/indices/1nJc43t7TGuHmVR3Q5w9PA/1/index -verbose -exorcise` (on the right index) to exorcise the corrupted data. 
+1. Remove corruption flags: `rm /usr/share/elasticsearch/data/nodes/0/indices/1nJc43t7TGuHmVR3Q5w9PA/1/index/corrupted_*`
+1. Restart elasticsearch
+1. Retry shard allocation:
+```
+curl -X POST http://127.0.0.1:9200/_cluster/reroute?retry_failed=true
+curl -XGET localhost:9200/_cluster/allocation/explain?pretty
+```
+
+## Mongodb
+MongoDB holds the graylog config for us.
+
 # Available Clients
 See [[WebServer#Available Clients|AniNIX::Webserver's client list]].