Content Pack - Event Source Not Sending Logs

[ajeesh]

Hi Team
While installing “Event Source Not Sending Logs” content pack on my gray log I am getting an error and it is not installing.

My Env information
Docker containerized Graylog system.
DockerHost: Ubuntu 14.04.3 LTS

Package versions
mongo:4.2
Elasticsearch : docker.elastic.co/elasticsearch/elasticsearch-oss:7.10.2
graylog/graylog:4.2

The error I am getting while installing https://graylog.zammad.com/help/en-us/13/53 this content pack is.

Backend:

graylog_1_4007d1c21604 | 2022-01-24 12:16:29,197 ERROR: org.graylog2.shared.rest.exceptionmappers.AnyExceptionClassMapper - Unhandled exception in REST resource
graylog_1_4007d1c21604 | java.lang.IllegalArgumentException: Could not resolve type id ‘correlation-v1’ as a subtype of [simple type, class org.graylog.events.contentpack.entities.EventProcessorConfigEntity]: known type ids = [aggregation-v1] (for POJO property ‘config’)
graylog_1_4007d1c21604 | at [Source: UNKNOWN; line: -1, column: -1] (through reference chain: org.graylog.events.contentpack.entities.AutoValue_EventDefinitionEntity$Builder[“config”])
graylog_1_4007d1c21604 | at com.fasterxml.jackson.databind.ObjectMapper._convert(ObjectMapper.java:3751) ~[graylog.jar:?]
graylog_1_4007d1c21604 | at com.fasterxml.jackson.databind.ObjectMapper.convertValue(ObjectMapper.java:3669) ~[graylog.jar:?]
graylog_1_4007d1c21604 | at org.graylog.events.contentpack.facade.EventDefinitionFacade.resolveForInstallationV1(EventDefinitionFacade.java:208) ~[graylog.jar:?]
graylog_1_4007d1c21604 | at org.graylog.events.contentpack.facade.EventDefinitionFacade.resolveForInstallation(EventDefinitionFacade.java:198) ~[graylog.jar:?]

Frontend:

Error
Installing content pack failed with status: FetchError: There was an error fetching a resource: Internal Server Error. Additional information: Could not resolve type id ‘correlation-v1’ as a subtype of [simple type, class org.graylog.events.contentpack.entities.EventProcessorConfigEntity]: known type ids = [aggregation-v1] (for POJO property ‘config’) at [Source: UNKNOWN; line: -1, column: -1] (through reference chain: org.graylog.events.contentpack.entities.AutoValue_EventDefinitionEntity$Builder[“config”]). Could not install Content Pack with ID: d21a07c7-9611-xxxx

I am trying to find a solution to monitor my docker containers when it go down.

Could you please help me to sort this issue out?

[tmacgbay]

That was actually written by @jan for Graylog version 3.2.3 which I believe uses a legacy alerting system so it won’t work in your 4.2 version of Graylog. Jan doesn’t have that on his github page anymore but perhaps he has a newer version that will work with 4.2? (he is tagged ^) Otherwise you would likely have to parse the 3.2.3 settings out of the JSON to create a new version yourself. (found this out by reading the header in the JSON.)

[jan (Jan Doberstein)]

sorry @tmacgbay as I’m not using Graylog anymore I do not have that adjusted.

[tmacgbay]

Worth a try… good luck in your non-Graylog endeavors!