Content Pack - Event Source Not Sending Logs

Hi Team
While installing “Event Source Not Sending Logs” content pack on my gray log I am getting an error and it is not installing.

My Env information
Docker containerized Graylog system.
DockerHost: Ubuntu 14.04.3 LTS

Package versions
Elasticsearch :

The error I am getting while installing Graylog Knowledge Base - Content Pack - Event Source Not Sending Logs this content pack is.


graylog_1_4007d1c21604 | 2022-01-24 12:16:29,197 ERROR: - Unhandled exception in REST resource
graylog_1_4007d1c21604 | java.lang.IllegalArgumentException: Could not resolve type id ‘correlation-v1’ as a subtype of [simple type, class]: known type ids = [aggregation-v1] (for POJO property ‘config’)
graylog_1_4007d1c21604 | at [Source: UNKNOWN; line: -1, column: -1] (through reference chain:$Builder[“config”])
graylog_1_4007d1c21604 | at com.fasterxml.jackson.databind.ObjectMapper._convert( ~[graylog.jar:?]
graylog_1_4007d1c21604 | at com.fasterxml.jackson.databind.ObjectMapper.convertValue( ~[graylog.jar:?]
graylog_1_4007d1c21604 | at ~[graylog.jar:?]
graylog_1_4007d1c21604 | at ~[graylog.jar:?]


Installing content pack failed with status: FetchError: There was an error fetching a resource: Internal Server Error. Additional information: Could not resolve type id ‘correlation-v1’ as a subtype of [simple type, class]: known type ids = [aggregation-v1] (for POJO property ‘config’) at [Source: UNKNOWN; line: -1, column: -1] (through reference chain:$Builder[“config”]). Could not install Content Pack with ID: d21a07c7-9611-xxxx

I am trying to find a solution to monitor my docker containers when it go down.

Could you please help me to sort this issue out?

That was actually written by @jan for Graylog version 3.2.3 which I believe uses a legacy alerting system so it won’t work in your 4.2 version of Graylog. Jan doesn’t have that on his github page anymore but perhaps he has a newer version that will work with 4.2? (he is tagged ^) Otherwise you would likely have to parse the 3.2.3 settings out of the JSON to create a new version yourself. (found this out by reading the header in the JSON.) :smiley:

1 Like

sorry @tmacgbay as I’m not using Graylog anymore I do not have that adjusted.

Worth a try… good luck in your non-Graylog endeavors!

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.