Cannot auto install content pack

Graylog Central (peer support)
1

1. Describe your incident:

Auto-installing a content_pack onto a new graylog container.

2. Describe your environment:

  • OS Information:
    rocky linux 9 (host)

  • Package Version:
    graylog 5.1.1

  • Service logs, configurations, and environment variables:

I have the following env variables in my docker-compose file

      GRAYLOG_CONTENT_PACKS_LOADER_ENABLED: true
      GRAYLOG_CONTENT_PACKS_DIR: "/usr/share/graylog/data/contentpacks"
      GRAYLOG_CONTENT_AUTO_INSTALL: "dcom-content-pack.json"

Logs i see:

2023-06-14 15:31:23,560 INFO : org.graylog2.bootstrap.ServerBootstrap - Running 53 migrations...
2023-06-14 15:31:24,010 ERROR: org.graylog2.bootstrap.ServerBootstrap - Exception while running migrations
java.lang.RuntimeException: Could not install Source Page Content Pack.
	at org.graylog2.migrations.V20191219090834_AddSourcesPage.upgrade(V20191219090834_AddSourcesPage.java:84) ~[graylog.jar:?]
	at org.graylog2.bootstrap.ServerBootstrap.lambda$runMigrations$2(ServerBootstrap.java:356) ~[graylog.jar:?]
	at com.google.common.collect.ImmutableList.forEach(ImmutableList.java:422) ~[graylog.jar:?]
	at com.google.common.collect.RegularImmutableSortedSet.forEach(RegularImmutableSortedSet.java:88) ~[graylog.jar:?]
	at org.graylog2.bootstrap.ServerBootstrap.runMigrations(ServerBootstrap.java:353) ~[graylog.jar:?]
	at org.graylog2.bootstrap.ServerBootstrap.startCommand(ServerBootstrap.java:279) [graylog.jar:?]
	at org.graylog2.bootstrap.CmdLineTool.doRun(CmdLineTool.java:324) [graylog.jar:?]
	at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:260) [graylog.jar:?]
	at org.graylog2.bootstrap.Main.main(Main.java:45) [graylog.jar:?]
Caused by: org.graylog2.contentpacks.exceptions.ContentPackException: Content pack 04fcf179-49e0-4e8f-9c02-0ff13062efbe with this revision 1 already found!
	at org.graylog2.migrations.V20191219090834_AddSourcesPage.lambda$upgrade$0(V20191219090834_AddSourcesPage.java:77) ~[graylog.jar:?]
	at java.util.Optional.orElseThrow(Unknown Source) ~[?:?]
	at org.graylog2.migrations.V20191219090834_AddSourcesPage.upgrade(V20191219090834_AddSourcesPage.java:75) ~[graylog.jar:?]
	... 8 more
wait-for-it: waiting 15 seconds for localhost:9200
wait-for-it: localhost:9200 is available after 0 seconds
2023-06-14 15:31:26,254 INFO : org.graylog2.featureflag.ImmutableFeatureFlagsCollector - Following feature flags are used: {default properties file=[cloud_inputs=on, scripting_api_preview=on, search_filter=on, preflight_web=off]}
2023-06-14 15:31:27,117 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: AWS plugins 5.1.1 [org.graylog.aws.AWSPlugin]
2023-06-14 15:31:27,118 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Integrations 5.1.1 [org.graylog.integrations.IntegrationsPlugin]

3. What steps have you already taken to try and solve the problem?

4. How can the community help?

As you can see in the logs, graylog is still waiting for opensearch to come up, so i can understand the content_pack not installing since graylog is not up yet…

However, once it comes up, i dont see any indication in the logs that a content_pack was installed and in the UI under system/contentpacks, i can see our custom content_pack there but I must manually click the install button for it to apply.

Am I missing something?
Shouldn’t setting GRAYLOG_CONTENT_AUTO_INSTALL install it automatically?

Our content_pack contains all our inputs,events_definitions,streams,notifications

Any input is appreciated.

Thank you,
Dave

2

Greetings! First of all, WOW, i did not know this exists and i’ve used graylog since before 1.0 GA.

I looked through these settings and did some testing. A quick note regarding the translation of graylog server properties (e.g. via server.conf) and docker properties: you can take any of the properties from server.conf and prepend GRAYLOG_ to it.

For example, content_packs_auto_install from server.conf would become GRAYLOG_CONTENT_PACKS_AUTO_INSTALL in the docker compose file.

This can be helpful if you are unsure what the correct property name is. I found these in the default server.conf in `graylog2-server github repo: https://github.com/Graylog2/graylog2-server/blob/master/misc/graylog.conf#L656

Regarding your question:
I notice you are setting GRAYLOG_CONTENT_AUTO_INSTALL which should instead be GRAYLOG_CONTENT_PACKS_AUTO_INSTALL. However, it does look like something is installing because the log you provide says

Could not install Source Page Content Pack.
…
Content pack 04fcf179-49e0-4e8f-9c02-0ff13062efbe with this revision 1 already found!

Which appears to be saying graylog failed to install this content pack because it is already installed. Although I would not expect this to be a fatal error and to completely stop the boot process of graylog-server.

Can you confirm if the content pack you are trying to auto install is already present or not?

3

For what its worth, i’m not able to reproduce the error from your log, testing with Graylog 5.1.2 image.

4

Thank you for the input!

Didn’t realize the variable name was off.
Will try that and report back

5

That was it.

The var name was wrong.

-GRAYLOG_CONTENT_AUTO_INSTALL: "dcom-content-pack.json"
+GRAYLOG_CONTENT_PACKS_AUTO_INSTALL: "dcom-content-pack.json"

Thank you @drewmiranda-gl for the extra pair of eyes

1 Like
6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.