I suspect some bad data was input into my HTTPscstatus which normally ingests data via NXLog parsing IIS logs in standard format.
When I click “Quick values”, it returns error
Could not load quick values
Loading quick values failed with status: Error: cannot GET https://gl2web.ochsner.org/restapi/search/universal/absolute/terms?query=*&from=2017-02-15T05%3A40%3A24.000Z&to=2017-02-15T05%3A47%3A33.000Z&field=HTTPscstatus
If i go to the page directly in the web browser it returns
{"type":"ApiError","message":"Unable to fulfill search request"}
Any other field does return correctly. I checked the Graylog server logs (on all nodes, and web interface node) as well as the elasticsearch nodes, I don’t see any errors.
I imagine the field needs to be reindexed in elasticsearch but I’m not sure. Any ideas?
EDIT
The log on the web interface node DOES have an error, not very helpful though:
2017-02-16 16:40:09,835 WARN : org.graylog2.rest.resources.search.SearchResource - Unable to execute search: [reduce]