# Graylog Central (peer support) **URL:** https://community.graylog.org/c/graylog/8.md?page=1 [Latest](https://community.graylog.org/latest.md) · [Categories](https://community.graylog.org/categories.md) · [Tags](https://community.graylog.org/tags.md) **Page:** 2 --- ## [Not able to upgrade beyond 6.3.11 - Couldn't deserialize value (encrypted\_value and salt must be strings and cannot be missing)](https://community.graylog.org/t/not-able-to-upgrade-beyond-6-3-11-couldnt-deserialize-value-encrypted-value-and-salt-must-be-strings-and-cannot-be-missing/37437)
**Author:** [@ddean](https://community.graylog.org/u/ddean)\ **Replies:** 3\ **Last updated:** [July 20, 2026, 10:52am UTC](https://community.graylog.org/t/not-able-to-upgrade-beyond-6-3-11-couldnt-deserialize-value-encrypted-value-and-salt-must-be-strings-and-cannot-be-missing/37437 "2026-07-20T10:52:30Z")
1. Describe your incident: When starting a processing node on 6.3.12 or later, the node logs errors that a “decrypted\_value and salt must be strings and cannot be missing” and then restarts. The cluster runs on version … --- ## [Missing Permissions on 7.1.5 for Reader Role](https://community.graylog.org/t/missing-permissions-on-7-1-5-for-reader-role/37431)
**Author:** [@rodney\_vdw](https://community.graylog.org/u/rodney_vdw)\ **Replies:** 1\ **Last updated:** [July 14, 2026, 8:12am UTC](https://community.graylog.org/t/missing-permissions-on-7-1-5-for-reader-role/37431 "2026-07-14T08:12:37Z")
after upgrading to Graylog 7.1.5, users (with Reader permission) can see and search messages in streams shared with them as per usual, but clicking on a message “permalink” results in a permission denied error. Has some… --- ## [Pipeline does not work anymore after upgrade to 7.1.3 from 7.0](https://community.graylog.org/t/pipeline-does-not-work-anymore-after-upgrade-to-7-1-3-from-7-0/37403)
**Author:** [@schurd](https://community.graylog.org/u/schurd)\ **Replies:** 4\ **Last updated:** [July 13, 2026, 7:55am UTC](https://community.graylog.org/t/pipeline-does-not-work-anymore-after-upgrade-to-7-1-3-from-7-0/37403 "2026-07-13T07:55:23Z")
Hello, a complex pipeline with 4 stages and 5 rules does not work like before in Graylog 7.0.8. In stage 4 a rule is applied to a newly created field (created in stage 2, there is no stage 3). The rule is applied only … --- ## [Graylog no longer works following an upgrade to Graylog Server 7.1.4](https://community.graylog.org/t/graylog-no-longer-works-following-an-upgrade-to-graylog-server-7-1-4/37409)
**Author:** [@reni](https://community.graylog.org/u/reni)\ **Replies:** 8\ **Last updated:** [July 2, 2026, 10:39am UTC](https://community.graylog.org/t/graylog-no-longer-works-following-an-upgrade-to-graylog-server-7-1-4/37409 "2026-07-02T10:39:40Z")
Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic! 1. Describ… --- ## [Upgrade form 7.0.8 to 7.1.3 MongoDB error 63](https://community.graylog.org/t/upgrade-form-7-0-8-to-7-1-3-mongodb-error-63/37380)
**Author:** [@schurd](https://community.graylog.org/u/schurd)\ **Replies:** 2\ **Last updated:** [June 30, 2026, 6:13am UTC](https://community.graylog.org/t/upgrade-form-7-0-8-to-7-1-3-mongodb-error-63/37380 "2026-06-30T06:13:17Z")
After Upgrade form 7.0.8 to 7.1.3 on one node I got this error ERROR: Unable to connect to MongoDB. Is it running and the configuration correct? Details: Command execution failed on MongoDB server with error 86 (Index… --- ## [How to minimize log loss on graylog server outage](https://community.graylog.org/t/how-to-minimize-log-loss-on-graylog-server-outage/37388)
**Author:** [@duxieking](https://community.graylog.org/u/duxieking)\ **Replies:** 3\ **Last updated:** [June 26, 2026, 7:07pm UTC](https://community.graylog.org/t/how-to-minimize-log-loss-on-graylog-server-outage/37388 "2026-06-26T19:07:30Z")
Hello I hope someone can point me to the right direction on this one. We use 3 Graylog servers and 3 datanodes cluster, and we would like to use it as as a central logging however, a few months ago we had an complete ou… --- ## [Filebeat GCS input with Content-Type text/plain error](https://community.graylog.org/t/filebeat-gcs-input-with-content-type-text-plain-error/37376)
**Author:** [@ten10](https://community.graylog.org/u/ten10)\ **Replies:** 4\ **Last updated:** [June 19, 2026, 12:59pm UTC](https://community.graylog.org/t/filebeat-gcs-input-with-content-type-text-plain-error/37376 "2026-06-19T12:59:16Z")
I am using Filebeat (its GCS input) to read the logs from a GCS bucket and pass them to Graylog. The issue: Filebeat’s GCS input only accepts objects whose Content-Type metadata is application/json or application/x-ndjso… --- ## [Log4J Vulnerability - Graylog Datanode](https://community.graylog.org/t/log4j-vulnerability-graylog-datanode/37358)
**Author:** [@baadaasz](https://community.graylog.org/u/baadaasz)\ **Replies:** 7\ **Last updated:** [June 19, 2026, 7:11am UTC](https://community.graylog.org/t/log4j-vulnerability-graylog-datanode/37358 "2026-06-19T07:11:15Z")
I am running a vulnerability scan using Tenable Nessus, which has identified several Log4j files related to the datanode: Path : /usr/share/graylog-datanode/dist/opensearch-2.19.5-linux-x64/lib/log4j-core-2.25.3.jarInst… --- ## [Upgrade from 7.0.1 to 7.1.3 data node metrics load error](https://community.graylog.org/t/upgrade-from-7-0-1-to-7-1-3-data-node-metrics-load-error/37377)
**Author:** [@cawfehman](https://community.graylog.org/u/cawfehman)\ **Replies:** 1\ **Last updated:** [June 18, 2026, 9:56am UTC](https://community.graylog.org/t/upgrade-from-7-0-1-to-7-1-3-data-node-metrics-load-error/37377 "2026-06-18T09:56:57Z")
I upgraded my system from 7.0.1 to 7.1.3, seemed to have gone ok, but under system | cluster configuration, I’m constantly getting the following error pop up… Could not load Data Node metrics. Loading metrics for Data … --- ## [Could not fetch AI Configuration](https://community.graylog.org/t/could-not-fetch-ai-configuration/37374)
**Author:** [@schurd](https://community.graylog.org/u/schurd)\ **Replies:** 2\ **Last updated:** [June 17, 2026, 7:37am UTC](https://community.graylog.org/t/could-not-fetch-ai-configuration/37374 "2026-06-17T07:37:11Z")
In the version 7.0.8 of Graylog Enterprise we get the annoying popup message: Could not fetch AI Configuration Fetching AI Configuration with status: FetchError: There was an error fetching a resource: Payment Require… --- ## [MongoDB cannot start: Linux kernel versions 6.19 and newer has a known incompatibility](https://community.graylog.org/t/mongodb-cannot-start-linux-kernel-versions-6-19-and-newer-has-a-known-incompatibility/37373)
**Author:** [@drewdingray](https://community.graylog.org/u/drewdingray)\ **Replies:** 6\ **Last updated:** [June 16, 2026, 9:46pm UTC](https://community.graylog.org/t/mongodb-cannot-start-linux-kernel-versions-6-19-and-newer-has-a-known-incompatibility/37373 "2026-06-16T21:46:55Z")
Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic! 1. Describ… --- ## [Datanode Upgrade Issue 7.0.5 to 7.1.3](https://community.graylog.org/t/datanode-upgrade-issue-7-0-5-to-7-1-3/37370)
**Author:** [@psfletchthetek](https://community.graylog.org/u/psfletchthetek)\ **Replies:** 3\ **Last updated:** [June 15, 2026, 6:06am UTC](https://community.graylog.org/t/datanode-upgrade-issue-7-0-5-to-7-1-3/37370 "2026-06-15T06:06:32Z")
Hi All, Upgraded following this Upgrade Graylog on Ubuntu Graylog servers work fine, but on the datanode first one i now get the following. It’s like during the upgrade the certificates have been overwritten or movd/… --- ## [Docker graylog-open graylog-datanode - Waiting for datanode certificate renewal](https://community.graylog.org/t/docker-graylog-open-graylog-datanode-waiting-for-datanode-certificate-renewal/37355)
**Author:** [@pixeldoc2000](https://community.graylog.org/u/pixeldoc2000)\ **Replies:** 5\ **Last updated:** [June 12, 2026, 1:13pm UTC](https://community.graylog.org/t/docker-graylog-open-graylog-datanode-waiting-for-datanode-certificate-renewal/37355 "2026-06-12T13:13:02Z")
1. Describe your incident: graylog-datanode container: certificate is expired automatic certificate renewal does not work log: ... 2026-06-08T07:18:39.710Z INFO \[cluster\] Waiting for server to become available for… --- ## [Graylog 7.1 Message Errors](https://community.graylog.org/t/graylog-7-1-message-errors/37362)
**Author:** [@d\_a\_parker](https://community.graylog.org/u/d_a_parker)\ **Replies:** 2\ **Last updated:** [June 11, 2026, 1:06pm UTC](https://community.graylog.org/t/graylog-7-1-message-errors/37362 "2026-06-11T13:06:48Z")
We just upgraded from 7.0.4 to 7.1.3, and are now seeing a large number of “Message Errors” on one of our Beats inputs, relative to the total number of messages being received. This input receives Filebeat logs from side… --- ## [About Graylog Open System Architecture](https://community.graylog.org/t/about-graylog-open-system-architecture/37345)
**Author:** [@sering](https://community.graylog.org/u/sering)\ **Replies:** 2\ **Last updated:** [June 9, 2026, 11:53am UTC](https://community.graylog.org/t/about-graylog-open-system-architecture/37345 "2026-06-09T11:53:47Z")
“Hi team, I’m currently running a single-node Graylog Open (all-in-one) setup. As the log volume grows, I plan to migrate to a conventional multi-node deployment (Graylog cluster + external OpenSearch cluster). Could you… --- ## [How to solve .opendistro\_security and .plugins-ml-config in UNASSIGNED state](https://community.graylog.org/t/how-to-solve-opendistro-security-and-plugins-ml-config-in-unassigned-state/37319)
**Author:** [@baalkchina](https://community.graylog.org/u/baalkchina)\ **Replies:** 2\ **Last updated:** [June 8, 2026, 1:39pm UTC](https://community.graylog.org/t/how-to-solve-opendistro-security-and-plugins-ml-config-in-unassigned-state/37319 "2026-06-08T13:39:22Z")
Hi all, since my graylog datanode disk full, I had add some new nodes, and my cluster has enough disk space now. But my Open Search cluster still in yellow state, like this: OpenSearch cluster datanode-cluster is yello… --- ## [Event Failures after upgrade from 7.0.6 to 7.1.1](https://community.graylog.org/t/event-failures-after-upgrade-from-7-0-6-to-7-1-1/37265)
**Author:** [@lpop](https://community.graylog.org/u/lpop)\ **Replies:** 9\ **Last updated:** [June 5, 2026, 7:44am UTC](https://community.graylog.org/t/event-failures-after-upgrade-from-7-0-6-to-7-1-1/37265 "2026-06-05T07:44:10Z")
1. Describe your incident Since migrating from Graylog 7.0.6 to 7.1.0, the Event Definitions page (/alerts/definitions) no longer loads any content. The UI displays the following error at the bottom of the page: Could … --- ## [Token created for many years but stops working after months](https://community.graylog.org/t/token-created-for-many-years-but-stops-working-after-months/37329)
**Author:** [@lecko](https://community.graylog.org/u/lecko)\ **Replies:** 1\ **Last updated:** [June 4, 2026, 6:57pm UTC](https://community.graylog.org/t/token-created-for-many-years-but-stops-working-after-months/37329 "2026-06-04T18:57:01Z")
I use graylog 7.x on our own bare metal envrinment graylog Open version. I have a user that uses api and wished to have a tokem for longer time. So I now twice created in GUI token for him for 1000 days and it worked. … --- ## [Upgrade question (will server 7.1 works with datanode 7.0?)](https://community.graylog.org/t/upgrade-question-will-server-7-1-works-with-datanode-7-0/37344)
**Author:** [@baalkchina](https://community.graylog.org/u/baalkchina)\ **Replies:** 1\ **Last updated:** [June 4, 2026, 6:50pm UTC](https://community.graylog.org/t/upgrade-question-will-server-7-1-works-with-datanode-7-0/37344 "2026-06-04T18:50:53Z")
Hi, I had a Graylog 7.0.1cluster, with 3 servers(nginx as load balance), and 10 data nodes. The OS is rocky and using rpm package. Now if I want to upgrade them to 7.1. In docs(Upgrade Graylog) I noticed this:“Both Gra… --- ## [Graylog Cluster with MongoDB 8](https://community.graylog.org/t/graylog-cluster-with-mongodb-8/37341)
**Author:** [@DoubleM](https://community.graylog.org/u/DoubleM)\ **Replies:** 2\ **Last updated:** [June 4, 2026, 9:39am UTC](https://community.graylog.org/t/graylog-cluster-with-mongodb-8/37341 "2026-06-04T09:39:51Z")
1. Describe your incident: I am building a Graylog Cluster, consisting of 2 Graylog Server and 2 Datanode Server. As I followed the Installation Manual I build a MongoDB ReplicaSet named “rs0”. Find the exact environm… --- ## [Force merge of index did not complete in 1 hour messages in logs](https://community.graylog.org/t/force-merge-of-index-did-not-complete-in-1-hour-messages-in-logs/37325)
**Author:** [@rihorr](https://community.graylog.org/u/rihorr)\ **Replies:** 2\ **Last updated:** [June 2, 2026, 9:05am UTC](https://community.graylog.org/t/force-merge-of-index-did-not-complete-in-1-hour-messages-in-logs/37325 "2026-06-02T09:05:04Z")
After upgrading Graylog to 7.1.2-1, OptimizeIndexJob started failing during index optimization / force merge. It looks like Graylog does not wait for elasticsearch\_index\_optimization\_timeout. Instead, the job fails when… --- ## [Graylog sidecar rpm repo problem](https://community.graylog.org/t/graylog-sidecar-rpm-repo-problem/37337)
**Author:** [@wscherer.uillinois](https://community.graylog.org/u/wscherer.uillinois)\ **Replies:** 2\ **Last updated:** [June 1, 2026, 1:13pm UTC](https://community.graylog.org/t/graylog-sidecar-rpm-repo-problem/37337 "2026-06-01T13:13:18Z")
I’ve noticed that since last week (May 21) when trying to update the graylog-sidecar package on RHEL-8/9 I get these errors $ yum list available graylog-sidecar \ graylog … --- ## [No permissions for \[\] and User when change datanode setting with curl?](https://community.graylog.org/t/no-permissions-for-and-user-when-change-datanode-setting-with-curl/37331)
**Author:** [@baalkchina](https://community.graylog.org/u/baalkchina)\ **Replies:** 1\ **Last updated:** [May 28, 2026, 9:48am UTC](https://community.graylog.org/t/no-permissions-for-and-user-when-change-datanode-setting-with-curl/37331 "2026-05-28T09:48:43Z")
Hello, I am trying to modify index.unassigned.node\_left.delayed\_timeout to 5min, so I enter one of my datanode(with graylog datanode 7.0.1, but got an 403 error: \[root@graylog-data1 gray\]# curl -k -XPUT “https://1.1.1… --- ## [Input Extractor Failed after upgrade to 7.1.0](https://community.graylog.org/t/input-extractor-failed-after-upgrade-to-7-1-0/37308)
**Author:** [@mulo](https://community.graylog.org/u/mulo)\ **Replies:** 12\ **Last updated:** [May 26, 2026, 9:12am UTC](https://community.graylog.org/t/input-extractor-failed-after-upgrade-to-7-1-0/37308 "2026-05-26T09:12:32Z")
1. Describe your incident: After Upgrade to from 7.0.6 to 7.1.0, one of my input extractor not working anymore. I try to edit the extractors, but the configuration page for this input extractors load infinity. I have ot… --- ## [Graylog server repeatedly crashing on startup - TCPNIOBindingHandler issue](https://community.graylog.org/t/graylog-server-repeatedly-crashing-on-startup-tcpniobindinghandler-issue/37316)
**Author:** [@ahnaf702](https://community.graylog.org/u/ahnaf702)\ **Replies:** 1\ **Last updated:** [May 26, 2026, 7:16am UTC](https://community.graylog.org/t/graylog-server-repeatedly-crashing-on-startup-tcpniobindinghandler-issue/37316 "2026-05-26T07:16:31Z")
Hi Community, I am running into an issue where our Graylog server keeps shutting down immediately after attempting to start. The /var/log/graylog-server/server.log indicates a port binding conflict. The server throws a… --- ## [Solver: Graylog 7.1+ on FreeBSD](https://community.graylog.org/t/solver-graylog-7-1-on-freebsd/37321)
**Author:** [@borjam](https://community.graylog.org/u/borjam)\ **Replies:** 0\ **Last updated:** [May 25, 2026, 11:26am UTC](https://community.graylog.org/t/solver-graylog-7-1-on-freebsd/37321 "2026-05-25T11:26:59Z")
I reported some trouble to run Graylog 7.1+ on FreeBSD. I know, unsopported. Turns out my problem was a permissions problem. I keep the Graylog data in a different dataset/filesystem mounted on /var/db/graylog and, as… --- ## [Troubleshooting Log Ingestion: Syslog and Windows Event Logs (Winlogbeat/Sidecar) not appearing in Search](https://community.graylog.org/t/troubleshooting-log-ingestion-syslog-and-windows-event-logs-winlogbeat-sidecar-not-appearing-in-search/37318)
**Author:** [@ahnaf702](https://community.graylog.org/u/ahnaf702)\ **Replies:** 3\ **Last updated:** [May 23, 2026, 2:15pm UTC](https://community.graylog.org/t/troubleshooting-log-ingestion-syslog-and-windows-event-logs-winlogbeat-sidecar-not-appearing-in-search/37318 "2026-05-23T14:15:11Z")
Hi Graylog Community Team, I am experiencing an issue where my Graylog server is not successfully ingesting or displaying forwarded logs. I am currently trying to set up two parallel ingestion streams: Syslog for networ… --- ## [Greylog message error](https://community.graylog.org/t/greylog-message-error/37315)
**Author:** [@dgchultaeiz](https://community.graylog.org/u/dgchultaeiz)\ **Replies:** 0\ **Last updated:** [May 22, 2026, 2:04pm UTC](https://community.graylog.org/t/greylog-message-error/37315 "2026-05-22T14:04:02Z")
Describe your incident: I have a random UI message in Graylog: “Node cannot be found among active nodes” The node is real and active: Single-node installation The node ID exists in: /etc/graylog/server/node-… --- ## [Start "auto-refresh" automatically via a saved search or other query parameter?](https://community.graylog.org/t/start-auto-refresh-automatically-via-a-saved-search-or-other-query-parameter/37310)
**Author:** [@luckman212](https://community.graylog.org/u/luckman212)\ **Replies:** 1\ **Last updated:** [May 22, 2026, 8:37am UTC](https://community.graylog.org/t/start-auto-refresh-automatically-via-a-saved-search-or-other-query-parameter/37310 "2026-05-22T08:37:25Z")
There is a 7 year old post here about this: Query parameter to enable search auto refresh But I thought I’d bring up the topic again in 2026 + Graylog 7.x I have some saved searches that I always want the Auto-Refresh … --- ## [Request for Clarification / Temporary Compatibility Guidance for Graylog 7.0 with MongoDB 4.4](https://community.graylog.org/t/request-for-clarification-temporary-compatibility-guidance-for-graylog-7-0-with-mongodb-4-4/37311)
**Author:** [@ahnaf702](https://community.graylog.org/u/ahnaf702)\ **Replies:** 1\ **Last updated:** [May 21, 2026, 3:21pm UTC](https://community.graylog.org/t/request-for-clarification-temporary-compatibility-guidance-for-graylog-7-0-with-mongodb-4-4/37311 "2026-05-21T15:21:18Z")
Hello Graylog Support Team, We are currently performing an upgrade and compatibility validation for our Graylog environment and would appreciate your guidance regarding MongoDB compatibility behavior in Graylog 7.0. En… [Previous page](https://community.graylog.org/c/graylog/8.md) [Next page](https://community.graylog.org/c/graylog/8.md?page=2)