AWS Elasticsearch unable to create indices

I’m working on building Graylog 2.4.0-1 in Kubernetes and using the AWS Elasticsearch service( version 5.5) as my endpoint. I’m able to get data to Graylog, but its not writing to the index. When looking at the logs from my Graylog pod, I see the following message repeated:

2018-04-12 16:12:51,342 INFO : org.graylog2.indexer.MongoIndexSet - Did not find a deflector alias. Setting one up now.
2018-04-12 16:12:51,353 INFO : org.graylog2.indexer.MongoIndexSet - There is no index target to point to. Creating one now.
2018-04-12 16:12:51,367 INFO : org.graylog2.indexer.MongoIndexSet - Cycling from <none> to <graylog_0>.
2018-04-12 16:12:51,367 INFO : org.graylog2.indexer.MongoIndexSet - Creating target index <graylog_0>.
2018-04-12 16:12:51,390 ERROR: org.graylog2.periodical.IndexRotationThread - Couldn't point deflector to a new index
org.graylog2.indexer.ElasticsearchException: Unable to create index template graylog-internal

Compressor detection can only be called on some xcontent bytes or compressed xcontent bytes
	at org.graylog2.indexer.cluster.jest.JestUtils.specificException( ~[graylog.jar:?]
	at org.graylog2.indexer.cluster.jest.JestUtils.execute( ~[graylog.jar:?]
	at org.graylog2.indexer.cluster.jest.JestUtils.execute( ~[graylog.jar:?]
	at org.graylog2.indexer.indices.Indices.ensureIndexTemplate( ~[graylog.jar:?]
	at org.graylog2.indexer.indices.Indices.create( ~[graylog.jar:?]
	at org.graylog2.indexer.indices.Indices.create( ~[graylog.jar:?]
	at org.graylog2.indexer.MongoIndexSet.cycle( ~[graylog.jar:?]
	at org.graylog2.indexer.MongoIndexSet.setUp( ~[graylog.jar:?]
	at org.graylog2.periodical.IndexRotationThread.checkAndRepair( ~[graylog.jar:?]
	at org.graylog2.periodical.IndexRotationThread.lambda$doRun$0( ~[graylog.jar:?]
	at java.lang.Iterable.forEach( [?:1.8.0_151]
	at org.graylog2.periodical.IndexRotationThread.doRun( [graylog.jar:?]
	at [graylog.jar:?]
	at java.util.concurrent.Executors$ [?:1.8.0_151]
	at java.util.concurrent.FutureTask.runAndReset( [?:1.8.0_151]
	at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301( [?:1.8.0_151]
	at java.util.concurrent.ScheduledThreadPoolExecutor$ [?:1.8.0_151]
	at java.util.concurrent.ThreadPoolExecutor.runWorker( [?:1.8.0_151]
	at java.util.concurrent.ThreadPoolExecutor$ [?:1.8.0_151]
	at [?:1.8.0_151]

From the documentation, I have the elasticsearch_discovery_enabled set to false and elasticsearch_hosts set to my Elasticsearch URL. I also tested that can create and delete indices to the Elasticearch cluster outside of Graylog.

You have to disable request compression if you’re using the AWS Elasticsearch service:

For reference:

Awesome, that did the trick! Thanks!

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.