Cluster is green, negative number of journal messages, no out

We have a Graylog server that is showing negative 19 billion journal entries and will not output any messages to ES. The cluster status is green. Incoming messages do seem to be getting written to the journal (journal utilization is increasing).

Graylog server.log from startup:

 2021-02-09T08:44:41.317-05:00 INFO  [CmdLineTool] Running with JVM arguments: -Xms6g -Xmx6g -XX:NewRatio=1 -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:-OmitStackTraceInFastThrow -XX:+UseParNewGC -Dlog4j.configurationFile=file:///etc/graylog/server/log4j2.xml -Djava.library.path=/usr/share/graylog-server/lib/sigar -Dgraylog2.installation_source=deb
2021-02-09T08:44:41.506-05:00 INFO  [Version] HV000001: Hibernate Validator null
2021-02-09T08:44:43.912-05:00 INFO  [InputBufferImpl] Message journal is enabled.
2021-02-09T08:44:43.927-05:00 INFO  [NodeId] Node ID: f9a6cc54-0ef3-46b6-8668-b0f36109d20e
2021-02-09T08:44:44.088-05:00 INFO  [LogManager] Loading logs.
2021-02-09T08:44:44.134-05:00 INFO  [LogManager] Logs loading complete.
2021-02-09T08:44:44.138-05:00 INFO  [KafkaJournal] Initialized Kafka based journal at /var/lib/graylog-server/journal
2021-02-09T08:44:44.158-05:00 INFO  [cluster] Cluster created with settings {hosts=[localhost:27017], mode=SINGLE, requiredClusterType=UNKNOWN, serverSelectionTimeout='30000 ms', maxWaitQueueSize=5000}
2021-02-09T08:44:44.202-05:00 INFO  [cluster] Cluster description not yet available. Waiting for 30000 ms before timing out
2021-02-09T08:44:44.218-05:00 INFO  [connection] Opened connection [connectionId{localValue:1, serverValue:28}] to localhost:27017
2021-02-09T08:44:44.222-05:00 INFO  [cluster] Monitor thread successfully connected to server with description ServerDescription{address=localhost:27017, type=STANDALONE, state=CONNECTED, ok=true, version=ServerVersion{versionList=[3, 6, 11]}, minWireVersion=0, maxWireVersion=6, maxDocumentSize=16777216, logicalSessionTimeoutMinutes=30, roundTripTimeNanos=2524813}
2021-02-09T08:44:44.234-05:00 INFO  [connection] Opened connection [connectionId{localValue:2, serverValue:29}] to localhost:27017
2021-02-09T08:44:44.421-05:00 INFO  [InputBufferImpl] Initialized InputBufferImpl with ring size <65536> and wait strategy <BlockingWaitStrategy>, running 2 parallel message handlers.
2021-02-09T08:44:44.667-05:00 INFO  [ElasticsearchVersionProvider] Elasticsearch cluster is running v6.8.10
2021-02-09T08:44:44.705-05:00 INFO  [AbstractJestClient] Setting server pool to a list of 1 servers: [http://10.0.16.134:9200]
2021-02-09T08:44:44.706-05:00 INFO  [JestClientFactory] Using multi thread/connection supporting pooling connection manager
2021-02-09T08:44:44.759-05:00 INFO  [JestClientFactory] Using custom ObjectMapper instance
2021-02-09T08:44:44.759-05:00 INFO  [JestClientFactory] Node Discovery enabled...
2021-02-09T08:44:44.771-05:00 INFO  [JestClientFactory] Idle connection reaping disabled...
2021-02-09T08:44:45.147-05:00 INFO  [ProcessBuffer] Initialized ProcessBuffer with ring size <65536> and wait strategy <BlockingWaitStrategy>.
2021-02-09T08:44:45.261-05:00 INFO  [connection] Opened connection [connectionId{localValue:3, serverValue:30}] to localhost:27017
2021-02-09T08:44:45.272-05:00 INFO  [OutputBuffer] Initialized OutputBuffer with ring size <65536> and wait strategy <BlockingWaitStrategy>.
2021-02-09T08:44:46.015-05:00 INFO  [ServerBootstrap] Graylog server 4.0.2+1987d10 starting up
2021-02-09T08:44:46.015-05:00 INFO  [ServerBootstrap] JRE: Private Build 1.8.0_275 on Linux 4.15.0-133-generic
2021-02-09T08:44:46.015-05:00 INFO  [ServerBootstrap] Deployment: deb
2021-02-09T08:44:46.015-05:00 INFO  [ServerBootstrap] OS: Ubuntu 16.04.6 LTS (xenial)
2021-02-09T08:44:46.015-05:00 INFO  [ServerBootstrap] Arch: amd64
2021-02-09T08:44:46.035-05:00 INFO  [PeriodicalsService] Starting 30 periodicals ...
2021-02-09T08:44:46.036-05:00 INFO  [Periodicals] Starting [org.graylog2.periodical.ThroughputCalculator] periodical in [0s], polling every [1s].
2021-02-09T08:44:46.040-05:00 INFO  [Periodicals] Starting [org.graylog.plugins.pipelineprocessor.periodical.LegacyDefaultStreamMigration] periodical, running forever.
2021-02-09T08:44:46.041-05:00 INFO  [PeriodicalsService] Not starting [org.graylog2.periodical.AlertScannerThread] periodical. Not configured to run on this node.
2021-02-09T08:44:46.043-05:00 INFO  [LegacyDefaultStreamMigration] Legacy default stream has no connections, no migration needed.
2021-02-09T08:44:46.044-05:00 INFO  [Periodicals] Starting [org.graylog2.periodical.BatchedElasticSearchOutputFlushThread] periodical in [0s], polling every [1s].
2021-02-09T08:44:46.045-05:00 INFO  [Periodicals] Starting [org.graylog2.periodical.ClusterHealthCheckThread] periodical in [120s], polling every [20s].
2021-02-09T08:44:46.046-05:00 INFO  [PeriodicalsService] Not starting [org.graylog2.periodical.ContentPackLoaderPeriodical] periodical. Not configured to run on this node.
2021-02-09T08:44:46.047-05:00 INFO  [Periodicals] Starting [org.graylog2.periodical.GarbageCollectionWarningThread] periodical, running forever.
2021-02-09T08:44:46.047-05:00 INFO  [Periodicals] Starting [org.graylog2.periodical.IndexerClusterCheckerThread] periodical in [0s], polling every [30s].
2021-02-09T08:44:46.048-05:00 INFO  [Periodicals] Starting [org.graylog2.periodical.IndexRetentionThread] periodical in [0s], polling every [300s].
2021-02-09T08:44:46.049-05:00 INFO  [Periodicals] Starting [org.graylog2.periodical.IndexRotationThread] periodical in [0s], polling every [10s].
2021-02-09T08:44:46.050-05:00 INFO  [Periodicals] Starting [org.graylog2.periodical.NodePingThread] periodical in [0s], polling every [1s].
2021-02-09T08:44:46.050-05:00 INFO  [Periodicals] Starting [org.graylog2.periodical.VersionCheckThread] periodical in [300s], polling every [1800s].
2021-02-09T08:44:46.050-05:00 INFO  [Periodicals] Starting [org.graylog2.periodical.ThrottleStateUpdaterThread] periodical in [1s], polling every [1s].
2021-02-09T08:44:46.125-05:00 INFO  [Periodicals] Starting [org.graylog2.events.ClusterEventPeriodical] periodical in [0s], polling every [1s].
2021-02-09T08:44:46.126-05:00 INFO  [Periodicals] Starting [org.graylog2.events.ClusterEventCleanupPeriodical] periodical in [0s], polling every [86400s].
2021-02-09T08:44:46.129-05:00 INFO  [connection] Opened connection [connectionId{localValue:4, serverValue:32}] to localhost:27017
2021-02-09T08:44:46.130-05:00 INFO  [connection] Opened connection [connectionId{localValue:5, serverValue:31}] to localhost:27017
2021-02-09T08:44:46.131-05:00 INFO  [Periodicals] Starting [org.graylog2.periodical.ClusterIdGeneratorPeriodical] periodical, running forever.
2021-02-09T08:44:46.138-05:00 INFO  [Periodicals] Starting [org.graylog2.periodical.IndexRangesMigrationPeriodical] periodical, running forever.
2021-02-09T08:44:46.140-05:00 INFO  [Periodicals] Starting [org.graylog2.periodical.IndexRangesCleanupPeriodical] periodical in [15s], polling every [3600s].
2021-02-09T08:44:46.142-05:00 INFO  [connection] Opened connection [connectionId{localValue:6, serverValue:33}] to localhost:27017
2021-02-09T08:44:46.142-05:00 INFO  [connection] Opened connection [connectionId{localValue:7, serverValue:34}] to localhost:27017
2021-02-09T08:44:46.163-05:00 INFO  [PeriodicalsService] Not starting [org.graylog2.periodical.UserPermissionMigrationPeriodical] periodical. Not configured to run on this node.
2021-02-09T08:44:46.163-05:00 INFO  [Periodicals] Starting [org.graylog2.periodical.ConfigurationManagementPeriodical] periodical, running forever.
2021-02-09T08:44:46.166-05:00 INFO  [Periodicals] Starting [org.graylog2.periodical.IndexFailuresPeriodical] periodical, running forever.
2021-02-09T08:44:46.171-05:00 INFO  [Periodicals] Starting [org.graylog2.periodical.TrafficCounterCalculator] periodical in [0s], polling every [1s].
2021-02-09T08:44:46.173-05:00 INFO  [Periodicals] Starting [org.graylog2.indexer.fieldtypes.IndexFieldTypePollerPeriodical] periodical in [0s], polling every [3600s].
2021-02-09T08:44:46.181-05:00 INFO  [Periodicals] Starting [org.graylog.scheduler.periodicals.ScheduleTriggerCleanUp] periodical in [120s], polling every [86400s].
2021-02-09T08:44:46.187-05:00 INFO  [Periodicals] Starting [org.graylog2.periodical.ESVersionCheckPeriodical] periodical in [0s], polling every [30s].
2021-02-09T08:44:46.190-05:00 INFO  [Periodicals] Starting [org.graylog.plugins.sidecar.periodical.PurgeExpiredSidecarsThread] periodical in [0s], polling every [600s].
2021-02-09T08:44:46.191-05:00 INFO  [Periodicals] Starting [org.graylog.plugins.sidecar.periodical.PurgeExpiredConfigurationUploads] periodical in [0s], polling every [600s].
2021-02-09T08:44:46.193-05:00 INFO  [Periodicals] Starting [org.graylog.plugins.views.search.db.SearchesCleanUpJob] periodical in [3600s], polling every [28800s].
2021-02-09T08:44:46.197-05:00 INFO  [Periodicals] Starting [org.graylog.events.periodicals.EventNotificationStatusCleanUp] periodical in [120s], polling every [86400s].
2021-02-09T08:44:46.208-05:00 INFO  [Periodicals] Starting [org.graylog.plugins.collector.periodical.PurgeExpiredCollectorsThread] periodical in [0s], polling every [3600s].
2021-02-09T08:44:46.248-05:00 WARN  [OTXDataAdapter] OTX API key is missing. Make sure to add the key to allow higher request limits.
2021-02-09T08:44:46.259-05:00 INFO  [LookupTableService] Data Adapter otx-api-domain/5b08336273566e0d6eb2e29e [@d37d5d6] STARTING
2021-02-09T08:44:46.260-05:00 INFO  [LookupTableService] Data Adapter otx-api-domain/5b08336273566e0d6eb2e29e [@d37d5d6] RUNNING
2021-02-09T08:44:46.261-05:00 INFO  [LookupTableService] Data Adapter abuse-ch-ransomware-domains/5b08336273566e0d6eb2e2a0 [@21ae1f0d] STARTING
2021-02-09T08:44:46.261-05:00 WARN  [OTXDataAdapter] OTX API key is missing. Make sure to add the key to allow higher request limits.
2021-02-09T08:44:46.260-05:00 ERROR [LookupDataAdapter] Couldn't start data adapter <abuse-ch-ransomware-domains/5b08336273566e0d6eb2e2a0/@21ae1f0d>
org.graylog.plugins.threatintel.tools.AdapterDisabledException: The abuse.ch Ransomware Tracker was shut down on 2019-12-08. This Data Adapter should be deleted.
    at org.graylog.plugins.threatintel.adapters.abusech.AbuseChRansomAdapter.doStart(AbuseChRansomAdapter.java:65) ~[?:?]
    at org.graylog2.plugin.lookup.LookupDataAdapter.startUp(LookupDataAdapter.java:79) [graylog.jar:?]
    at com.google.common.util.concurrent.AbstractIdleService$DelegateService$1.run(AbstractIdleService.java:62) [graylog.jar:?]
    at com.google.common.util.concurrent.Callables$4.run(Callables.java:119) [graylog.jar:?]
    at java.lang.Thread.run(Thread.java:748) [?:1.8.0_275]
2021-02-09T08:44:46.284-05:00 INFO  [LookupTableService] Data Adapter otx-api-ip/5b08336273566e0d6eb2e2a5 [@301add3c] STARTING
2021-02-09T08:44:46.284-05:00 INFO  [LookupTableService] Data Adapter otx-api-ip/5b08336273566e0d6eb2e2a5 [@301add3c] RUNNING
2021-02-09T08:44:46.286-05:00 INFO  [LookupTableService] Data Adapter abuse-ch-ransomware-domains/5b08336273566e0d6eb2e2a0 [@21ae1f0d] RUNNING
2021-02-09T08:44:46.303-05:00 INFO  [LookupTableService] Data Adapter whois/5b08336273566e0d6eb2e2a4 [@71f881f6] STARTING
2021-02-09T08:44:46.303-05:00 INFO  [LookupTableService] Data Adapter tor-exit-node/5b08336273566e0d6eb2e2a3 [@53258bcf] STARTING
2021-02-09T08:44:46.305-05:00 INFO  [LookupTableService] Data Adapter abuse-ch-ransomware-ip/5b08336273566e0d6eb2e2a2 [@40bce4c1] STARTING
2021-02-09T08:44:46.305-05:00 ERROR [LookupDataAdapter] Couldn't start data adapter <abuse-ch-ransomware-ip/5b08336273566e0d6eb2e2a2/@40bce4c1>
org.graylog.plugins.threatintel.tools.AdapterDisabledException: The abuse.ch Ransomware Tracker was shut down on 2019-12-08. This Data Adapter should be deleted.
    at org.graylog.plugins.threatintel.adapters.abusech.AbuseChRansomAdapter.doStart(AbuseChRansomAdapter.java:65) ~[?:?]
    at org.graylog2.plugin.lookup.LookupDataAdapter.startUp(LookupDataAdapter.java:79) [graylog.jar:?]
    at com.google.common.util.concurrent.AbstractIdleService$DelegateService$1.run(AbstractIdleService.java:62) [graylog.jar:?]
    at com.google.common.util.concurrent.Callables$4.run(Callables.java:119) [graylog.jar:?]
    at java.lang.Thread.run(Thread.java:748) [?:1.8.0_275]
2021-02-09T08:44:46.323-05:00 INFO  [LookupTableService] Data Adapter spamhaus-drop/5b08336273566e0d6eb2e2a1 [@3716d398] STARTING
2021-02-09T08:44:46.324-05:00 INFO  [LookupTableService] Data Adapter abuse-ch-ransomware-ip/5b08336273566e0d6eb2e2a2 [@40bce4c1] RUNNING
2021-02-09T08:44:46.325-05:00 INFO  [LookupTableService] Data Adapter whois/5b08336273566e0d6eb2e2a4 [@71f881f6] RUNNING
2021-02-09T08:44:46.423-05:00 INFO  [LookupTableService] Cache otx-api-ip-cache/5b08336273566e0d6eb2e29a [@76a073b] STARTING
2021-02-09T08:44:46.425-05:00 INFO  [LookupTableService] Cache whois-cache/5b08336273566e0d6eb2e29b [@139eec8] STARTING
2021-02-09T08:44:46.441-05:00 INFO  [LookupTableService] Cache otx-api-domain-cache/5b08336273566e0d6eb2e29d [@4c32c5a0] STARTING
2021-02-09T08:44:46.441-05:00 INFO  [LookupTableService] Cache whois-cache/5b08336273566e0d6eb2e29b [@139eec8] RUNNING
2021-02-09T08:44:46.442-05:00 INFO  [LookupTableService] Cache spamhaus-e-drop-cache/5b08336273566e0d6eb2e299 [@9765da8] STARTING
2021-02-09T08:44:46.443-05:00 INFO  [LookupTableService] Cache threat-intel-uncached-adapters/5b08336273566e0d6eb2e29c [@4715b59b] STARTING
2021-02-09T08:44:46.443-05:00 INFO  [LookupTableService] Cache otx-api-ip-cache/5b08336273566e0d6eb2e29a [@76a073b] RUNNING
2021-02-09T08:44:46.445-05:00 INFO  [LookupTableService] Cache spamhaus-e-drop-cache/5b08336273566e0d6eb2e299 [@9765da8] RUNNING
2021-02-09T08:44:46.445-05:00 INFO  [LookupTableService] Cache threat-intel-uncached-adapters/5b08336273566e0d6eb2e29c [@4715b59b] RUNNING
2021-02-09T08:44:46.447-05:00 INFO  [LookupTableService] Cache otx-api-domain-cache/5b08336273566e0d6eb2e29d [@4c32c5a0] RUNNING
2021-02-09T08:44:48.463-05:00 ERROR [LookupDataAdapter] Couldn't start data adapter <tor-exit-node/5b08336273566e0d6eb2e2a3/@53258bcf>
javax.net.ssl.SSLException: Connection reset
    at sun.security.ssl.Alert.createSSLException(Alert.java:127) ~[?:1.8.0_275]
    at sun.security.ssl.TransportContext.fatal(TransportContext.java:324) ~[?:1.8.0_275]
    at sun.security.ssl.TransportContext.fatal(TransportContext.java:267) ~[?:1.8.0_275]
    at sun.security.ssl.TransportContext.fatal(TransportContext.java:262) ~[?:1.8.0_275]
    at sun.security.ssl.SSLTransport.decode(SSLTransport.java:135) ~[?:1.8.0_275]
    at sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1143) ~[?:1.8.0_275]
    at sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1054) ~[?:1.8.0_275]
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:394) ~[?:1.8.0_275]
    at okhttp3.internal.connection.RealConnection.connectTls(RealConnection.java:336) ~[graylog.jar:?]
    at okhttp3.internal.connection.RealConnection.establishProtocol(RealConnection.java:300) ~[graylog.jar:?]
    at okhttp3.internal.connection.RealConnection.connect(RealConnection.java:185) ~[graylog.jar:?]
    at okhttp3.internal.connection.ExchangeFinder.findConnection(ExchangeFinder.java:224) ~[graylog.jar:?]
    at okhttp3.internal.connection.ExchangeFinder.findHealthyConnection(ExchangeFinder.java:108) ~[graylog.jar:?]
    at okhttp3.internal.connection.ExchangeFinder.find(ExchangeFinder.java:88) ~[graylog.jar:?]
    at okhttp3.internal.connection.Transmitter.newExchange(Transmitter.java:169) ~[graylog.jar:?]
    at okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.java:41) ~[graylog.jar:?]
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142) ~[graylog.jar:?]
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:117) ~[graylog.jar:?]
    at okhttp3.internal.cache.CacheInterceptor.intercept(CacheInterceptor.java:94) ~[graylog.jar:?]
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142) ~[graylog.jar:?]
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:117) ~[graylog.jar:?]
    at okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.java:93) ~[graylog.jar:?]
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142) ~[graylog.jar:?]
    at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.java:88) ~[graylog.jar:?]
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142) ~[graylog.jar:?]
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:117) ~[graylog.jar:?]
    at okhttp3.RealCall.getResponseWithInterceptorChain(RealCall.java:229) ~[graylog.jar:?]
    at okhttp3.RealCall.execute(RealCall.java:81) ~[graylog.jar:?]
    at org.graylog.plugins.threatintel.adapters.tor.TorExitNodeDataAdapter.doStart(TorExitNodeDataAdapter.java:99) ~[?:?]
    at org.graylog2.plugin.lookup.LookupDataAdapter.startUp(LookupDataAdapter.java:79) [graylog.jar:?]
    at com.google.common.util.concurrent.AbstractIdleService$DelegateService$1.run(AbstractIdleService.java:62) [graylog.jar:?]
    at com.google.common.util.concurrent.Callables$4.run(Callables.java:119) [graylog.jar:?]
    at java.lang.Thread.run(Thread.java:748) [?:1.8.0_275]
    Suppressed: java.net.SocketException: Broken pipe (Write failed)
            at java.net.SocketOutputStream.socketWrite0(Native Method) ~[?:1.8.0_275]
            at java.net.SocketOutputStream.socketWrite(SocketOutputStream.java:111) ~[?:1.8.0_275]
            at java.net.SocketOutputStream.write(SocketOutputStream.java:155) ~[?:1.8.0_275]
            at sun.security.ssl.SSLSocketOutputRecord.encodeAlert(SSLSocketOutputRecord.java:81) ~[?:1.8.0_275]
            at sun.security.ssl.TransportContext.fatal(TransportContext.java:355) ~[?:1.8.0_275]
            at sun.security.ssl.TransportContext.fatal(TransportContext.java:267) ~[?:1.8.0_275]
            at sun.security.ssl.TransportContext.fatal(TransportContext.java:262) ~[?:1.8.0_275]
            at sun.security.ssl.SSLTransport.decode(SSLTransport.java:135) ~[?:1.8.0_275]
            at sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1143) ~[?:1.8.0_275]
            at sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1054) ~[?:1.8.0_275]
            at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:394) ~[?:1.8.0_275]
            at okhttp3.internal.connection.RealConnection.connectTls(RealConnection.java:336) ~[graylog.jar:?]
            at okhttp3.internal.connection.RealConnection.establishProtocol(RealConnection.java:300) ~[graylog.jar:?]
            at okhttp3.internal.connection.RealConnection.connect(RealConnection.java:185) ~[graylog.jar:?]
            at okhttp3.internal.connection.ExchangeFinder.findConnection(ExchangeFinder.java:224) ~[graylog.jar:?]
            at okhttp3.internal.connection.ExchangeFinder.findHealthyConnection(ExchangeFinder.java:108) ~[graylog.jar:?]
            at okhttp3.internal.connection.ExchangeFinder.find(ExchangeFinder.java:88) ~[graylog.jar:?]
            at okhttp3.internal.connection.Transmitter.newExchange(Transmitter.java:169) ~[graylog.jar:?]
            at okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.java:41) ~[graylog.jar:?]
            at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142) ~[graylog.jar:?]
            at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:117) ~[graylog.jar:?]
            at okhttp3.internal.cache.CacheInterceptor.intercept(CacheInterceptor.java:94) ~[graylog.jar:?]
            at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142) ~[graylog.jar:?]
            at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:117) ~[graylog.jar:?]
            at okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.java:93) ~[graylog.jar:?]
            at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142) ~[graylog.jar:?]
            at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.java:88) ~[graylog.jar:?]
            at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:142) ~[graylog.jar:?]
            at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:117) ~[graylog.jar:?]
            at okhttp3.RealCall.getResponseWithInterceptorChain(RealCall.java:229) ~[graylog.jar:?]
            at okhttp3.RealCall.execute(RealCall.java:81) ~[graylog.jar:?]
            at org.graylog.plugins.threatintel.adapters.tor.TorExitNodeDataAdapter.doStart(TorExitNodeDataAdapter.java:99) ~[?:?]
            at org.graylog2.plugin.lookup.LookupDataAdapter.startUp(LookupDataAdapter.java:79) [graylog.jar:?]
            at com.google.common.util.concurrent.AbstractIdleService$DelegateService$1.run(AbstractIdleService.java:62) [graylog.jar:?]
            at com.google.common.util.concurrent.Callables$4.run(Callables.java:119) [graylog.jar:?]
            at java.lang.Thread.run(Thread.java:748) [?:1.8.0_275]
Caused by: java.net.SocketException: Connection reset
    at java.net.SocketInputStream.read(SocketInputStream.java:210) ~[?:1.8.0_275]
    at java.net.SocketInputStream.read(SocketInputStream.java:141) ~[?:1.8.0_275]
    at sun.security.ssl.SSLSocketInputRecord.read(SSLSocketInputRecord.java:457) ~[?:1.8.0_275]
    at sun.security.ssl.SSLSocketInputRecord.decode(SSLSocketInputRecord.java:165) ~[?:1.8.0_275]
    at sun.security.ssl.SSLTransport.decode(SSLTransport.java:108) ~[?:1.8.0_275]
    ... 28 more
2021-02-09T08:44:48.465-05:00 INFO  [LookupTableService] Data Adapter tor-exit-node/5b08336273566e0d6eb2e2a3 [@53258bcf] RUNNING
2021-02-09T08:44:48.465-05:00 INFO  [LookupDataAdapterRefreshService] Adding job for <tor-exit-node/5b08336273566e0d6eb2e2a3/@53258bcf> [interval=3600000ms]
2021-02-09T08:44:48.646-05:00 INFO  [LookupTableService] Data Adapter spamhaus-drop/5b08336273566e0d6eb2e2a1 [@3716d398] RUNNING
2021-02-09T08:44:48.647-05:00 INFO  [LookupDataAdapterRefreshService] Adding job for <spamhaus-drop/5b08336273566e0d6eb2e2a1/@3716d398> [interval=43200000ms]
2021-02-09T08:44:48.655-05:00 INFO  [LookupTableService] Starting lookup table tor-exit-node-list/5b08336273566e0d6eb2e2a6 [@33a9649e] using cache threat-intel-uncached-adapters/5b08336273566e0d6eb2e29c [@4715b59b], data adapter tor-exit-node/5b08336273566e0d6eb2e2a3 [@53258bcf]
2021-02-09T08:44:48.655-05:00 INFO  [LookupTableService] Starting lookup table whois/5b08336273566e0d6eb2e2a7 [@694005e6] using cache whois-cache/5b08336273566e0d6eb2e29b [@139eec8], data adapter whois/5b08336273566e0d6eb2e2a4 [@71f881f6]
2021-02-09T08:44:48.655-05:00 INFO  [LookupTableService] Starting lookup table abuse-ch-ransomware-domains/5b08336273566e0d6eb2e2a8 [@beb679a] using cache threat-intel-uncached-adapters/5b08336273566e0d6eb2e29c [@4715b59b], data adapter abuse-ch-ransomware-domains/5b08336273566e0d6eb2e2a0 [@21ae1f0d]
2021-02-09T08:44:48.656-05:00 INFO  [LookupTableService] Starting lookup table otx-api-domain/5b08336273566e0d6eb2e2a9 [@1638091] using cache otx-api-domain-cache/5b08336273566e0d6eb2e29d [@4c32c5a0], data adapter otx-api-domain/5b08336273566e0d6eb2e29e [@d37d5d6]
2021-02-09T08:44:48.656-05:00 INFO  [LookupTableService] Starting lookup table spamhaus-drop/5b08336273566e0d6eb2e2aa [@799699b7] using cache spamhaus-e-drop-cache/5b08336273566e0d6eb2e299 [@9765da8], data adapter spamhaus-drop/5b08336273566e0d6eb2e2a1 [@3716d398]
2021-02-09T08:44:48.656-05:00 INFO  [LookupTableService] Starting lookup table otx-api-ip/5b08336273566e0d6eb2e2ab [@1090cc56] using cache otx-api-ip-cache/5b08336273566e0d6eb2e29a [@76a073b], data adapter otx-api-ip/5b08336273566e0d6eb2e2a5 [@301add3c]
2021-02-09T08:44:48.656-05:00 INFO  [LookupTableService] Starting lookup table abuse-ch-ransomware-ip/5b08336273566e0d6eb2e2ac [@4017ae69] using cache threat-intel-uncached-adapters/5b08336273566e0d6eb2e29c [@4715b59b], data adapter abuse-ch-ransomware-ip/5b08336273566e0d6eb2e2a2 [@40bce4c1]
2021-02-09T08:45:03.322-05:00 INFO  [NetworkListener] Started listener bound to [10.0.16.134:9000]
2021-02-09T08:45:03.323-05:00 INFO  [HttpServer] [HttpServer] Started.
2021-02-09T08:45:03.323-05:00 INFO  [JerseyService] Started REST API at <10.0.16.134:9000>
2021-02-09T08:45:03.324-05:00 INFO  [ServiceManagerListener] Services are healthy
2021-02-09T08:45:03.324-05:00 INFO  [InputSetupService] Triggering launching persisted inputs, node transitioned from Uninitialized [LB:DEAD] to Running [LB:ALIVE]
2021-02-09T08:45:03.325-05:00 INFO  [ServerBootstrap] Services started, startup times in ms: {BufferSynchronizerService [RUNNING]=7, OutputSetupService [RUNNING]=9, JobSchedulerService [RUNNING]=9, EtagService [RUNNING]=10, JournalReader [RUNNING]=11, InputSetupService [RUNNING]=11, GracefulShutdownService [RUNNING]=11, UrlWhitelistService [RUNNING]=12, KafkaJournal [RUNNING]=16, MongoDBProcessingStatusRecorderService [RUNNING]=88, ConfigurationEtagService [RUNNING]=106, StreamCacheService [RUNNING]=149, PeriodicalsService [RUNNING]=179, LookupTableService [RUNNING]=2616, JerseyService [RUNNING]=17292}
2021-02-09T08:45:03.329-05:00 INFO  [ServerBootstrap] Graylog server up and running.
2021-02-09T08:45:03.376-05:00 INFO  [InputStateListener] Input [GELF TCP/5fda5dd562168437725e201e] is now STARTING
2021-02-09T08:45:03.389-05:00 INFO  [InputStateListener] Input [Syslog UDP/5b08384273566e04761c7e00] is now STARTING
2021-02-09T08:45:03.465-05:00 INFO  [InputStateListener] Input [GELF TCP/5fda5dd562168437725e201e] is now RUNNING
2021-02-09T08:45:03.526-05:00 WARN  [UdpTransport] receiveBufferSize (SO_RCVBUF) for input SyslogUDPInput{title=Firewalls, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=f9a6cc54-0ef3-46b6-8668-b0f36109d20e} (channel [id: 0x6b22f7c6, L:/10.0.16.134:2514]) should be 262144 but is 425984.
2021-02-09T08:45:03.526-05:00 WARN  [UdpTransport] receiveBufferSize (SO_RCVBUF) for input SyslogUDPInput{title=Firewalls, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=f9a6cc54-0ef3-46b6-8668-b0f36109d20e} (channel [id: 0xd4e3658c, L:/10.0.16.134:2514]) should be 262144 but is 425984.
2021-02-09T08:45:03.527-05:00 WARN  [UdpTransport] receiveBufferSize (SO_RCVBUF) for input SyslogUDPInput{title=Firewalls, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=f9a6cc54-0ef3-46b6-8668-b0f36109d20e} (channel [id: 0x90238728, L:/10.0.16.134:2514]) should be 262144 but is 425984.
2021-02-09T08:45:03.526-05:00 WARN  [UdpTransport] receiveBufferSize (SO_RCVBUF) for input SyslogUDPInput{title=Firewalls, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=f9a6cc54-0ef3-46b6-8668-b0f36109d20e} (channel [id: 0x1bc7205a, L:/10.0.16.134:2514]) should be 262144 but is 425984.
2021-02-09T08:45:03.526-05:00 WARN  [UdpTransport] receiveBufferSize (SO_RCVBUF) for input SyslogUDPInput{title=Firewalls, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=f9a6cc54-0ef3-46b6-8668-b0f36109d20e} (channel [id: 0x13115506, L:/10.0.16.134:2514]) should be 262144 but is 425984.
2021-02-09T08:45:03.526-05:00 WARN  [AbstractTcpTransport] receiveBufferSize (SO_RCVBUF) for input GELFTCPInput{title=WindowsServers, type=org.graylog2.inputs.gelf.tcp.GELFTCPInput, nodeId=f9a6cc54-0ef3-46b6-8668-b0f36109d20e} (channel [id: 0x4f678e2f, L:/0:0:0:0:0:0:0:0%0:12205]) should be 1048576 but is 425984.
2021-02-09T08:45:03.526-05:00 WARN  [UdpTransport] receiveBufferSize (SO_RCVBUF) for input SyslogUDPInput{title=Firewalls, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=f9a6cc54-0ef3-46b6-8668-b0f36109d20e} (channel [id: 0x12ee55f7, L:/10.0.16.134:2514]) should be 262144 but is 425984.
2021-02-09T08:45:03.526-05:00 WARN  [UdpTransport] receiveBufferSize (SO_RCVBUF) for input SyslogUDPInput{title=Firewalls, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=f9a6cc54-0ef3-46b6-8668-b0f36109d20e} (channel [id: 0xfc6f5966, L:/10.0.16.134:2514]) should be 262144 but is 425984.
2021-02-09T08:45:03.530-05:00 WARN  [UdpTransport] receiveBufferSize (SO_RCVBUF) for input SyslogUDPInput{title=Firewalls, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=f9a6cc54-0ef3-46b6-8668-b0f36109d20e} (channel [id: 0x63fa762c, L:/10.0.16.134:2514]) should be 262144 but is 425984.
2021-02-09T08:45:03.537-05:00 INFO  [InputStateListener] Input [Syslog UDP/5b08384273566e04761c7e00] is now RUNNING

Elasticsearch logs from start:

https://pastebin.com/QUUYxShm

ES cluster health:

  "cluster_name" : "graylog",
  "status" : "green",
  "timed_out" : false,
  "number_of_nodes" : 1,
  "number_of_data_nodes" : 1,
  "active_primary_shards" : 446,
  "active_shards" : 446,
  "relocating_shards" : 0,
  "initializing_shards" : 0,
  "unassigned_shards" : 0,
  "delayed_unassigned_shards" : 0,
  "number_of_pending_tasks" : 0,
  "number_of_in_flight_fetch" : 0,
  "task_max_waiting_in_queue_millis" : 0,
  "active_shards_percent_as_number" : 100.0

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.