I’ve been experiencing this issue before, and I “resolved” returning to a previous state of the data (mongo/elasticsearch/graylog).
This is happening using the official Docker image. Analysing the Graylog’s log, it hangs without any warning after “INFO : org.graylog2.bindings.providers.RulesEngineProvider - No static rules file loaded.”… No inputs are initialised, no web api, so I don’t really know where to look now.
It’s an Amazon c5.2xlarge instance (8 vCPU, 16 GB of RAM, running with a 300GB SSD). Running a new instance of the graylog stack via docker-compose it works, but obviously I’d loose the previous data and, worst thing, it’d have the same problem again in the future.
I could try recovering it. But I think I can recover the pipeline now:
rule "Drop unsupported browsers errors"
AND lookup_value("unsupported-browsers", $message.user_agent_browser_name_and_version, "0") == "1"
Where “unsupported-browsers” is a cached CSV lookup table