# Could not execute search after new installation

**URL:** <https://community.graylog.org/t/could-not-execute-search-after-new-installation/579>\
**Category:** Graylog Central (peer support)\
**Created:** [March 26, 2017, 7:20pm UTC](https://community.graylog.org/t/could-not-execute-search-after-new-installation/579 "2017-03-26T19:20:22Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![IBulti](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ibulti/32/216_2.png) [@IBulti](https://community.graylog.org/u/IBulti)\
**Post date:** [March 26, 2017, 7:20pm UTC](https://community.graylog.org/t/could-not-execute-search-after-new-installation/579/1 "2017-03-26T19:20:22Z")

</div>

Hi,  
I followed the instructions as defined in -  
[http://docs.graylog.org/en/2.2/pages/installation/os/ubuntu.html](http://docs.graylog.org/en/2.2/pages/installation/os/ubuntu.html)  
When I open the Web interface I am getting -

```auto
Error Message:
    blocked by: [SERVICE_UNAVAILABLE/1/state not recovered / initialized];: cannot GET http://x.x.x.x:9000/api/search/universal/relative?query=%2A&range=300&limit=150&sort=timestamp%3Adesc (500)
Search status code:
    500

```

In the log file I see the following error :-

```auto
2017-03-26T17:13:55.100+01:00 ERROR [CmdLineTool] Invalid configuration
com.github.joschi.jadconfig.ValidationException: The minimum length for "password_secret" is 16 characters.
        at org.graylog2.Configuration.validatePasswordSecret(Configuration.java:326) ~[graylog.jar:?]
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_121]
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_121]
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_121]
        at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_121]
        at com.github.joschi.jadconfig.ReflectionUtils.invokeMethodsWithAnnotation(ReflectionUtils.java:53) ~[graylog.jar:?]
        at com.github.joschi.jadconfig.JadConfig.invokeValidatorMethods(JadConfig.java:221) ~[graylog.jar:?]
        at com.github.joschi.jadconfig.JadConfig.process(JadConfig.java:100) ~[graylog.jar:?]
        at org.graylog2.bootstrap.CmdLineTool.processConfiguration(CmdLineTool.java:351) [graylog.jar:?]
        at org.graylog2.bootstrap.CmdLineTool.readConfiguration(CmdLineTool.java:344) [graylog.jar:?]
        at org.graylog2.bootstrap.CmdLineTool.run(CmdLineTool.java:177) [graylog.jar:?]
        at org.graylog2.bootstrap.Main.main(Main.java:44) [graylog.jar:?]

```

However in the config file I used the command `pwgen -N 1 -s 96`, Therefore, the password\_secret is 96 characters long so well exceeds the minimum of 16.

What have I done wrong?

---

<div class="post-metadata">

**Author:** ![rafaelcarsetimo](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/rafaelcarsetimo/32/215_2.png) [@rafaelcarsetimo](https://community.graylog.org/u/rafaelcarsetimo)\
**Post date:** [March 27, 2017, 1:17am UTC](https://community.graylog.org/t/could-not-execute-search-after-new-installation/579/2 "2017-03-27T01:17:26Z")

</div>

> [@IBulti](#):
>
> The minimum length for “password\_secret” is 16 characters.

You need set the password with the minimum of 16 characters… After set, you graylog will Start.  
Have Fun!

---

<div class="post-metadata">

**Author:** ![IBulti](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ibulti/32/216_2.png) [@IBulti](https://community.graylog.org/u/IBulti)\
**Post date:** [March 27, 2017, 1:01pm UTC](https://community.graylog.org/t/could-not-execute-search-after-new-installation/579/3 "2017-03-27T13:01:09Z")

</div>

Hi,Thanks for the reply. The password has 96 characters. As the example showed.

Regards IanMailto: ian@bultitude.orgPhone: +44 7785 532 628Sent from my Samsung device

---

<div class="post-metadata">

**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\
**Post date:** [March 27, 2017, 1:20pm UTC](https://community.graylog.org/t/could-not-execute-search-after-new-installation/579/4 "2017-03-27T13:20:01Z")

</div>

@IBulti

you should double check - might be that you have set that setting twice.

---

<div class="post-metadata">

**Author:** ![rafaelcarsetimo](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/rafaelcarsetimo/32/215_2.png) [@rafaelcarsetimo](https://community.graylog.org/u/rafaelcarsetimo)\
**Post date:** [March 27, 2017, 2:00pm UTC](https://community.graylog.org/t/could-not-execute-search-after-new-installation/579/5 "2017-03-27T14:00:36Z")

</div>

96 characters!!! OMG… Put 20 and see if works.

---

<div class="post-metadata">

**Author:** ![IBulti](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ibulti/32/216_2.png) [@IBulti](https://community.graylog.org/u/IBulti)\
**Post date:** [March 28, 2017, 7:54pm UTC](https://community.graylog.org/t/could-not-execute-search-after-new-installation/579/6 "2017-03-28T19:54:50Z")

</div>

Hi rafaelcarsetimo,

Well I tried that and still no joy.

I have just looked at the Office system and the sting is about 130.

Thanks for your time.

---

<div class="post-metadata">

**Author:** ![IBulti](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ibulti/32/216_2.png) [@IBulti](https://community.graylog.org/u/IBulti)\
**Post date:** [March 28, 2017, 7:59pm UTC](https://community.graylog.org/t/could-not-execute-search-after-new-installation/579/7 "2017-03-28T19:59:09Z")

</div>

Thanks jan,

but it is only in there once.

I can send you the file if you want. (personal data & IP addresses removed)

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [March 29, 2017, 7:20am UTC](https://community.graylog.org/t/could-not-execute-search-after-new-installation/579/8 "2017-03-29T07:20:57Z")

</div>

I think you’re hunting ghosts. If the `password_secret` really was invalid (i. e. less than 16 characters long), Graylog wouldn’t start and you wouldn’t be able to connect to the web interface.

Please post the complete logs of your Graylog and Elasticsearch nodes.

---

<div class="post-metadata">

**Author:** ![IBulti](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ibulti/32/216_2.png) [@IBulti](https://community.graylog.org/u/IBulti)\
**Post date:** [March 29, 2017, 7:07pm UTC](https://community.graylog.org/t/could-not-execute-search-after-new-installation/579/9 "2017-03-29T19:07:53Z")

</div>

Hi jochen

I have tried to post the server log file directly on the website but it is BIG. unfortunately I was unable to upload it as a file.

There does not appear to be any log file for Elasticsearch at least not in /var/log/elasticsearch.

This sounds like a clue. I am wondering if this is the problem and not Graylog?

---

<div class="post-metadata">

**Author:** ![IBulti](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ibulti/32/216_2.png) [@IBulti](https://community.graylog.org/u/IBulti)\
**Post date:** [March 29, 2017, 7:26pm UTC](https://community.graylog.org/t/could-not-execute-search-after-new-installation/579/10 "2017-03-29T19:26:22Z")

</div>

Hi jochen,

How can I get the log file to you? Can I PM you or something with a file attached?

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [March 29, 2017, 7:41pm UTC](https://community.graylog.org/t/could-not-execute-search-after-new-installation/579/11 "2017-03-29T19:41:54Z")

</div>

Please use services like [https://0bin.net](https://0bin.net), [http://pastebin.com](http://pastebin.com), or [https://gist.github.com](https://gist.github.com) for sharing these logs.

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [March 29, 2017, 7:42pm UTC](https://community.graylog.org/t/could-not-execute-search-after-new-installation/579/12 "2017-03-29T19:42:18Z")

</div>

> [@IBulti](#):
>
> There does not appear to be any log file for Elasticsearch at least not in /var/log/elasticsearch.

That’s odd. Are you sure that Elasticsearch is running?

---

<div class="post-metadata">

**Author:** ![IBulti](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ibulti/32/216_2.png) [@IBulti](https://community.graylog.org/u/IBulti)\
**Post date:** [March 29, 2017, 8:13pm UTC](https://community.graylog.org/t/could-not-execute-search-after-new-installation/579/13 "2017-03-29T20:13:22Z")

</div>

Hi jochen,

Thanks but I still seem to hit size limit. The file is about 4.6M. I tried to zip it but that is not accepted.

Sorry I am very new to this sort of thing.

Thanks for your help.

Regards

Ian

[mailto:ian@bultitude.org](mailto:ian@bultitude.org)

---

<div class="post-metadata">

**Author:** ![IBulti](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ibulti/32/216_2.png) [@IBulti](https://community.graylog.org/u/IBulti)\
**Post date:** [March 29, 2017, 8:19pm UTC](https://community.graylog.org/t/could-not-execute-search-after-new-installation/579/14 "2017-03-29T20:19:41Z")

</div>

Hi jochen,

Hmm no it would not appear to be.

ps ax | grep -i elasticsearch

30658 pts/17 S+ 0:00 grep --color=auto -i elasticsearch

here is the config file may be I have got it wrong.

```auto
##################### Elasticsearch Configuration Example #####################
# This file contains an overview of various configuration settings,
# targeted at operations staff. Application developers should
# consult the guide at <http://elasticsearch.org/guide>.

```

---

<div class="post-metadata">

**Author:** ![IBulti](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ibulti/32/216_2.png) [@IBulti](https://community.graylog.org/u/IBulti)\
**Post date:** [March 29, 2017, 8:40pm UTC](https://community.graylog.org/t/could-not-execute-search-after-new-installation/579/15 "2017-03-29T20:40:22Z")

</div>

Hi jochen,

Fingers crossed. The file I think is on at:-

> <https://gist.github.com/anonymous/2ff3ec6a034fc2d177ab0802178fe5e2>

Regards

Ian

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [March 30, 2017, 7:34am UTC](https://community.graylog.org/t/could-not-execute-search-after-new-installation/579/16 "2017-03-30T07:34:11Z")

</div>

> [@IBulti](#):
>
> here is the config file may be I have got it wrong.

This looks empty…

> [@IBulti](#):
>
> The file I think is on at:-

The logs stop at 2017-03-27 and it’s obviously waiting for Elasticsearch to come up. So try fixing your Elasticsearch setup and Graylog should be fine.

---

<div class="post-metadata">

**Author:** ![IBulti](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ibulti/32/216_2.png) [@IBulti](https://community.graylog.org/u/IBulti)\
**Post date:** [March 30, 2017, 4:31pm UTC](https://community.graylog.org/t/could-not-execute-search-after-new-installation/579/17 "2017-03-30T16:31:46Z")

</div>

Hi jochen,

Thanks again for your time,

Are you saying the file was blank?

Which file the log file or the Elasticsearch config file?

Would it help if I setup a TeamViewer session with you?

Regards Ian

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [March 30, 2017, 5:06pm UTC](https://community.graylog.org/t/could-not-execute-search-after-new-installation/579/18 "2017-03-30T17:06:44Z")

</div>

> [@IBulti](#):
>
> Which file the log file or the Elasticsearch config file?

You’ve posted only 3 lines of your Elasticsearch configuration. If that’s your complete configuration, that’s the problem.

See [http://docs.graylog.org/en/2.2/pages/configuration/file\_location.html#deb-package](http://docs.graylog.org/en/2.2/pages/configuration/file_location.html#deb-package) for the relevant file locations and [http://docs.graylog.org/en/2.2/pages/configuration/elasticsearch.html](http://docs.graylog.org/en/2.2/pages/configuration/elasticsearch.html) for information about how to configure Elasticsearch.

> [@IBulti](#):
>
> Would it help if I setup a TeamViewer session with you?

Unless you’re buying [professional support](https://www.graylog.org/professional-support), definitely no.

---

<div class="post-metadata">

**Author:** ![IBulti](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/ibulti/32/216_2.png) [@IBulti](https://community.graylog.org/u/IBulti)\
**Post date:** [March 30, 2017, 5:33pm UTC](https://community.graylog.org/t/could-not-execute-search-after-new-installation/579/19 "2017-03-30T17:33:24Z")

</div>

Ah!

Hi jochen,

No that is not the full file then!!!

let’s try again.

```auto
##################### Elasticsearch Configuration Example #####################

 

# This file contains an overview of various configuration settings,

# targeted at operations staff. Application developers should

# consult the guide at <http://elasticsearch.org/guide>.

```

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [March 30, 2017, 8:37pm UTC](https://community.graylog.org/t/could-not-execute-search-after-new-installation/579/20 "2017-03-30T20:37:47Z")

</div>

It’s the same 4 lines again, all of which are comments.

As I said before, if this is your whole Elasticsearch configuration, you’re missing some important settings.

[Next page](https://community.graylog.org/t/could-not-execute-search-after-new-installation/579.md?page=2)