API：Absolute-Search response time is not correct

Graylog Central (peer support)
1

I try to search messages by API(Search/Absolute : Message search) between 2 hours ago and current time,but got empty list,on fact there are many messages in that time range.

so I checked the response from API,
I found the begin-time and end-time is not correct as below:

image.png1244×605 40.5 KB

is this a bug of Graylog? or I mistaked some setting？

2

The “begin” and “end” attributes are taken from the index range information Graylog stores about Elasticsearch indices. You can manually recalculate the index ranges via the web interface on the System / Indices / Index Set page.

3

I try to recalculate the index range like below way:

image.png1911×854 107 KB

but the time in response is still not correct…

4

there are below Error message when I recalculate manual.

image.png1411×635 27.7 KB

2017-06-15T08:01:41.924-04:00 ERROR [CreateNewSingleIndexRangeJob] Exception during index range calculation for index test_index_set_1
org.elasticsearch.index.IndexNotFoundException: no such index
at org.graylog2.indexer.indices.Indices.indexRangeStatsOfIndex(Indices.java:638) ~[graylog.jar:?]
at org.graylog2.indexer.ranges.MongoIndexRangeService.calculateRange(MongoIndexRangeService.java:146) ~[graylog.jar:?]
at org.graylog2.indexer.ranges.CreateNewSingleIndexRangeJob.execute(CreateNewSingleIndexRangeJob.java:61) [graylog.jar:?]
at org.graylog2.system.jobs.SystemJobManager$1.run(SystemJobManager.java:89) [graylog.jar:?]
at com.codahale.metrics.InstrumentedScheduledExecutorService$InstrumentedRunnable.run(InstrumentedScheduledExecutorService.java:235) [graylog.jar:?]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_131]
at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_131]
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180) [?:1.8.0_131]
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293) [?:1.8.0_131]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [?:1.8.0_131]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [?:1.8.0_131]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_131]
Caused by: org.elasticsearch.action.search.SearchPhaseExecutionException: all shards failed
at org.elasticsearch.action.search.AbstractSearchAsyncAction.onFirstPhaseResult(AbstractSearchAsyncAction.java:206) ~[graylog.jar:?]
at org.elasticsearch.action.search.AbstractSearchAsyncAction$1.onFailure(AbstractSearchAsyncAction.java:152) ~[graylog.jar:?]
at org.elasticsearch.action.ActionListenerResponseHandler.handleException(ActionListenerResponseHandler.java:46) ~[graylog.jar:?]
at org.elasticsearch.transport.netty.MessageChannelHandler.handleException(MessageChannelHandler.java:184) ~[graylog.jar:?]
at org.elasticsearch.transport.netty.MessageChannelHandler.handlerResponseError(MessageChannelHandler.java:174) ~[graylog.jar:?]
at org.elasticsearch.transport.netty.MessageChannelHandler.messageReceived(MessageChannelHandler.java:122) ~[graylog.jar:?]
at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) ~[graylog.jar:?]
at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) ~[graylog.jar:?]
at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) ~[graylog.jar:?]
at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:296) ~[graylog.jar:?]
at org.jboss.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:462) ~[graylog.jar:?]
at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:443) ~[graylog.jar:?]
at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303) ~[graylog.jar:?]
at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) ~[graylog.jar:?]
at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) ~[graylog.jar:?]
at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559) ~[graylog.jar:?]
at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268) ~[graylog.jar:?]
at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255) ~[graylog.jar:?]
at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88) ~[graylog.jar:?]
at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108) ~[graylog.jar:?]
at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337) ~[graylog.jar:?]
at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89) ~[graylog.jar:?]
at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178) ~[graylog.jar:?]
at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108) ~[graylog.jar:?]
at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42) ~[graylog.jar:?]
… 3 more
Caused by: org.elasticsearch.ElasticsearchException$1: Expected numeric type on field [timestamp], but got [string]
at org.elasticsearch.ElasticsearchException.guessRootCauses(ElasticsearchException.java:386) ~[graylog.jar:?]
at org.elasticsearch.action.search.SearchPhaseExecutionException.guessRootCauses(SearchPhaseExecutionException.java:152) ~[graylog.jar:?]
at org.elasticsearch.action.search.SearchPhaseExecutionException.getCause(SearchPhaseExecutionException.java:99) ~[graylog.jar:?]
at org.apache.logging.log4j.core.impl.ThrowableProxy.(ThrowableProxy.java:164) ~[graylog.jar:?]
at org.apache.logging.log4j.core.impl.ThrowableProxy.(ThrowableProxy.java:140) [graylog.jar:?]
at org.apache.logging.log4j.core.impl.ThrowableProxy.(ThrowableProxy.java:121) [graylog.jar:?]
at org.apache.logging.log4j.core.impl.MutableLogEvent.getThrownProxy(MutableLogEvent.java:329) [graylog.jar:?]
at org.apache.logging.log4j.core.pattern.ExtendedThrowablePatternConverter.format(ExtendedThrowablePatternConverter.java:61) [graylog.jar:?]
at org.apache.logging.log4j.core.pattern.PatternFormatter.format(PatternFormatter.java:38) [graylog.jar:?]
at org.apache.logging.log4j.core.layout.PatternLayout$PatternSerializer.toSerializable(PatternLayout.java:294) [graylog.jar:?]
at org.apache.logging.log4j.core.layout.PatternLayout.toText(PatternLayout.java:195) [graylog.jar:?]
at org.apache.logging.log4j.core.layout.PatternLayout.encode(PatternLayout.java:180) [graylog.jar:?]
at org.apache.logging.log4j.core.layout.PatternLayout.encode(PatternLayout.java:57) [graylog.jar:?]
at org.apache.logging.log4j.core.appender.AbstractOutputStreamAppender.directEncodeEvent(AbstractOutputStreamAppender.java:176) [graylog.jar:?]
at org.apache.logging.log4j.core.appender.AbstractOutputStreamAppender.tryAppend(AbstractOutputStreamAppender.java:169) [graylog.jar:?]
at org.apache.logging.log4j.core.appender.AbstractOutputStreamAppender.append(AbstractOutputStreamAppender.java:160) [graylog.jar:?]
at org.apache.logging.log4j.core.appender.RollingFileAppender.append(RollingFileAppender.java:281) [graylog.jar:?]
at org.apache.logging.log4j.core.config.AppenderControl.tryCallAppender(AppenderControl.java:156) [graylog.jar:?]
at org.apache.logging.log4j.core.config.AppenderControl.callAppender0(AppenderControl.java:129) [graylog.jar:?]
at org.apache.logging.log4j.core.config.AppenderControl.callAppenderPreventRecursion(AppenderControl.java:120) [graylog.jar:?]
at org.apache.logging.log4j.core.config.AppenderControl.callAppender(AppenderControl.java:84) [graylog.jar:?]
at org.apache.logging.log4j.core.config.LoggerConfig.callAppenders(LoggerConfig.java:447) [graylog.jar:?]
at org.apache.logging.log4j.core.config.LoggerConfig.processLogEvent(LoggerConfig.java:432) [graylog.jar:?]
at org.apache.logging.log4j.core.config.LoggerConfig.log(LoggerConfig.java:416) [graylog.jar:?]
at org.apache.logging.log4j.core.config.LoggerConfig.logParent(LoggerConfig.java:438) [graylog.jar:?]
at org.apache.logging.log4j.core.config.LoggerConfig.processLogEvent(LoggerConfig.java:433) [graylog.jar:?]
at org.apache.logging.log4j.core.config.LoggerConfig.log(LoggerConfig.java:416) [graylog.jar:?]
at org.apache.logging.log4j.core.config.LoggerConfig.log(LoggerConfig.java:402) [graylog.jar:?]
at org.apache.logging.log4j.core.config.AwaitCompletionReliabilityStrategy.log(AwaitCompletionReliabilityStrategy.java:63) [graylog.jar:?]
at org.apache.logging.log4j.core.Logger.logMessage(Logger.java:146) [graylog.jar:?]
at org.apache.logging.log4j.spi.AbstractLogger.logMessageSafely(AbstractLogger.java:2091) [graylog.jar:?]
at org.apache.logging.log4j.spi.AbstractLogger.logMessage(AbstractLogger.java:1988) [graylog.jar:?]
at org.apache.logging.log4j.spi.AbstractLogger.logIfEnabled(AbstractLogger.java:1960) [graylog.jar:?]
at org.apache.logging.slf4j.Log4jLogger.error(Log4jLogger.java:319) [graylog.jar:?]
at org.graylog2.indexer.ranges.CreateNewSingleIndexRangeJob.execute(CreateNewSingleIndexRangeJob.java:65) ~[graylog.jar:?]
… 9 more
Caused by: java.lang.IllegalArgumentException: Expected numeric type on field [timestamp], but got [string]
at org.elasticsearch.search.aggregations.support.AggregationContext.numericField(AggregationContext.java:161) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.support.AggregationContext.originalValuesSource(AggregationContext.java:145) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.support.AggregationContext.valuesSource(AggregationContext.java:85) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.support.ValuesSourceAggregatorFactory.createInternal(ValuesSourceAggregatorFactory.java:60) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.AggregatorFactory.create(AggregatorFactory.java:102) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.AggregatorFactories.createSubAggregators(AggregatorFactories.java:76) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.AggregatorBase.(AggregatorBase.java:69) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.bucket.BucketsAggregator.(BucketsAggregator.java:48) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.bucket.SingleBucketAggregator.(SingleBucketAggregator.java:38) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.bucket.filter.FilterAggregator.(FilterAggregator.java:54) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.bucket.filter.FilterAggregator$Factory.createInternal(FilterAggregator.java:108) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.AggregatorFactory.create(AggregatorFactory.java:102) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.AggregatorFactories.createTopLevelAggregators(AggregatorFactories.java:87) ~[graylog.jar:?]
at org.elasticsearch.search.aggregations.AggregationPhase.preProcess(AggregationPhase.java:85) ~[graylog.jar:?]
at org.elasticsearch.search.query.QueryPhase.execute(QueryPhase.java:111) ~[graylog.jar:?]
at org.elasticsearch.search.SearchService.loadOrExecuteQueryPhase(SearchService.java:372) ~[graylog.jar:?]
at org.elasticsearch.search.SearchService.executeFetchPhase(SearchService.java:480) ~[graylog.jar:?]
at org.elasticsearch.search.action.SearchServiceTransportAction$SearchQueryFetchTransportHandler.messageReceived(SearchServiceTransportAction.java:392) ~[graylog.jar:?]
at org.elasticsearch.search.action.SearchServiceTransportAction$SearchQueryFetchTransportHandler.messageReceived(SearchServiceTransportAction.java:389) ~[graylog.jar:?]
at org.elasticsearch.transport.TransportRequestHandler.messageReceived(TransportRequestHandler.java:33) ~[graylog.jar:?]
at org.elasticsearch.transport.RequestHandlerRegistry.processMessageReceived(RequestHandlerRegistry.java:77) ~[graylog.jar:?]
at org.elasticsearch.transport.netty.MessageChannelHandler$RequestHandler.doRun(MessageChannelHandler.java:293) ~[graylog.jar:?]
at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) ~[graylog.jar:?]
… 3 more

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.