Edit Index Set "t.state is null" in Graylog 4.3.3

After the upgrade to Graylog 4.3.3 from the previous Graylog 4.3.x release, I’m now seeing an error when clicking “Edit Index Set” from within the Index Set Overview.

System / Indices > Indices > Default > Edit Index Set.

t.state is null

Stack Trace:


Component Stack:

    in f
    in Unknown
    in Unknown
    in ConnectStoresWrapper[Unknown/Anonymous] stores=indexSets,indicesConfigurations
    in n
    in t
    in t
    in div
    in t
    in PageContentLayout__StyledGrid
    in s
    in div
    in PageContentLayout__Container
    in E
    in t
    in t
    in div
    in App__PageContent
    in i
    in jt
    in div
    in App__AppLayout
    in m
    in an
    in t
    in t
    in o
    in t
    in it
    in Unknown
    in ConnectStoresWrapper[Unknown/Anonymous] stores=streams
    in _t
    in De
    in z
    in Et
    in Rt
    in It
    in bt
    in Pt
    in Ot
    in c
    in Yt
    in Lt
    in n
    in ee
    in De
    in z
    in ge

Please note that clicking “Edit” on the index from the “Indices & Index Sets” page still works correctly.

Our setup is as follows:

3 graylog VMs running Graylog and Mongodb
Centos 7
Graylog 4.3.3+86369d3
openjdk version "1.8.0_332

Nginx reverse proxy in front of Graylog.
HA proxy balancing in front of that.

5 elasticsearch VM nodes
Centos 7
elasticsearch 7.10.0

Hello @rfinney

I just update my Graylog server 4.3.2 → 4.3.3. I restart graylog service and tailed log file. I don’t have Nginx nor 3 GL/Mongo Servers. No errors were show in the log files, But I must mention before I restart Graylog-service my frontend crash after refreshing the browser tab, hence why I restart Graylog services.

Can I ask what have you tried already?
What does Elasticsearch/Graylog log file show?
Did you execute the basic checks (i.e. Firewall, Selinux, permissions, etc…)
Are there any outdated plugins?


Ok maybe I should have waited, I just found something out.

I can edit the index on this page.


BUT I can not on this page.

And I receive this error.

Looks like this issue.

I check both logs ES & GL nothing. I’m still labbing this out.

EDIT: Yeah looks like a bug man. I should have been more thorough before posting.

1 Like


On my side i cannot reproduce the issue with theses versions :

OS : Rocky Linux 8.6

  • graylog-server-4.3.3-1.noarch
  • mongodb-org-4.4.15-1.el8.x86_64
  • elasticsearch-7.10.2-1.x86_64
  • java-17-openjdk-headless-

I also have this issue.

At the same time I see another issue. If I create a new Index, it looks like its created ok in Graylog. But in System / Overview I get the following error :
“Could not retrieve Elasticsearch cluster health. Fetching Elasticsearch cluster health failed: There was an error fetching a resource: Internal Server Error. Additional information: Couldn’t read Elasticsearch cluster health”

If I check with curl -X GET “localhost:9200/_cluster/health?pretty” it looks like a green status.
But the newly created Index do not work.

Graylog 4.3.3-1
Elasticsearch 7.10.2-1

Can you check if you can create new indexes without getting the same error as me?

If i check indicies with curl http://localhost:9200/_aliases , it is not visible. So it looks like the new index fails to be created in Elasticsearch afaikt.

Anyone with any tip to help me out?


Answer to your question is yes I can create a new index. No issues
Index Created:

View Index

Click Edit Index Set button in the upper right-side. I receive this.

Which lead me here.

Now here is the weird part. In System/Indices if I click on the “Edit” button from my example above. I receive this. It seams that if I’m not within the index set I can edit the index.

Have you tried rotating an active write index? When I do, nothing happens. No new index is created. Haven’t found anything in the logs yet.

I found this : https://www.reddit.com/r/graylog/comments/vy8sea/elasticsearch_cluster_warning/
This solved my issue with the creation of new index. I had 1000 shards, and when I delete some old unused indexes I got down to about 880. Then I could create the new Index withtout getting the error.

Still have the same issue as OP with only beeing able to edit index from overview page, and not if Im on one index.


That’s strange. Having 1000 shards shouldn’t be an issue if your system can handle it. I have 1677 active primary shards and 4998 active shards total. Never had this issue before.

If I had to guess, the issue has to do with the details page again. The Edit Index Set doesn’t work from the index details page, and then the rotate active index doesn’t work from the same page. May be related?

1 Like

I believe so, For myself its something with the Edit Index Set button. I’m able to rotate the index set but unable, like yourself to edit the index set from that page.

1 Like

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.