Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. Don’t forget to select tags to help index your topic!
1. Describe your incident:
Getting a 502 bad gateway when accessing the web console
2. Describe your environment:
OS Information:
Ubuntu 22.04
Package Version:
Service logs, configurations, and environment variables:
3. What steps have you already taken to try and solve the problem?
It used to work and stopped
Rebooted
Confirmed Graylog service is running
Reverted the server.conf to default
Running the following commands give me the following result:
curl -i -H ‘Accept: application/json’ ‘http://172.16.1.145:12900/?pretty=true’
curl: (7) Failed to connect to 172.16.1.145 port 12900 after 0 ms: Connection refused
4. How can the community help?
Not really sure what to do here, so any guidance for what to try to fix the issue is greatly appreaciated
Thats doesnt look like a default port used for Elasticsearch/Opensearch. It should be 9200.
Graylog Web UI is port 9000. That IP address looks familiar, by chance is that docker?
On second though, what version of Graylog is this?
If you reverted the server.log to default does this mean the ‘http_bind_address’ is currently listening on 127.0.0.1? If so try altering it to 172.16.1.145 or 0.0.0.0.
Can you confirm the elasticsearch/opensearch service is running, also worth checking mongo.
Running the below on the ubuntu box Graylog is installed to should give an idea of what process is running on which port, this includes Graylog, Mongo and Open/Elasticsearch.
sudo lsof -i -n -P
If you still can’t hit the Graylog ui http://172.16.1.145:9000, then a good place to begin troubleshooting is the log file found in this location /var/log/graylog/server.log.
Since it seams that your trying to make a connection to Elasticsearch using cURL. Like @Wine_Merchant suggested, make sure the network_host setting in Elasticsearch yaml file has that IP ADDRESS (i.e.,172.16.1.145 ), if not then it would normally be 127.0.0.1 and/or localhost.
Try something like this
curl -XGET http://172.16.1.145:9200/
or
curl -XGET http://localhost:9200/
BUT to get 502 bad gateway this would be your MongoDb/Graylog instance. If those two are functioning you should be able to logon without Elasticsearch.
