daniel2
September 8, 2023, 10:09am
1
I found this:https://go2docs.graylog.org/5-0/getting_in_log_data/indexer_and_processing_failures.html?tocpath=Setting%20up%20Graylog|Getting%20Started|Indexer%20Failures|_____1
via:
opened 08:06AM - 14 Feb 18 UTC
closed 08:45AM - 18 Aug 22 UTC
feature
triaged
## Expected Behavior
Graylog is reporting indexer failures with an index and a … letter id, but doesn't store the failed message anywhere. This makes it hard to debug and fix those failures.
## Current Behavior
Currently there is no way of debugging indexer failures. It's more of a guessing game.
## Possible Solution
One way would be to use the mongodb to also store the failed, raw message alongside the indexer failure. This would obviously increase the mongodb load. Another way would be a ring buffer on the disk.
## Context
Everytime you switch the logging of a new application on to Graylog, you're somewhat guessing the things, that may get logged, but these guesses may be wrong and lead to indexer failures. If you have a lot of new applications in one go, you have a hard time finding the actual failed message.
## Your Environment
* Graylog Version: 2.2.3
* Elasticsearch Version: 2.3.5
* MongoDB Version: 3.4.0
* Operating System: Ubuntu 16.04
* Browser version: Chrome 64.0.3282.140 on macOS 10.13.3
Problem is I can’t find that setting. The documentation only talks about the web interface, but that seems to have changed. I searched the Configurations site with strg + f for “fail” with no result.
Version: Graylog 5.1.5
To my understanding there should be (as of ~ Aug 4, 2022) an option to enable storing messages where indexing failed. But I can’t find any hint of that in my Graylog. Is it an Enterprise feature?
Edit:
You are correct. It appears that is a paid/licensed feature.
However, any sort of errors like that should still be viewable in graylog’s server.log
system
September 25, 2023, 8:56pm
3
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
