Error create Quick Values

Graylog Central (peer support)
1

Hi, I’ to create Quick Values at to Graylog server at event arch at to graylog server log.

and
Message error in http when click in Quick Values

Could not load quick values
Loading quick values failed with status: Error cannot GET http://10.0.20.40:12900/search/universal/relative/terms?query=*&range=300&field=message&order=message%3Adesc&desc&size=50&stacked_fields={500)

2019-10-25T10:24:19.703-03:00 ERROR [DecodingProcessor] Error processing message RawMessage{id=c036e162-f72a-11e9-8ad4-00155d141905, journalOffset=39165385, codec=gelf, payloadSize=473, timestamp=2019-10-25T13:24:19.702Z, remoteAddress=/10.0.20.19:1105}

With that I can’t create the Quick Values.

2

this has to do with the database message field.

the field in eslasticsearch shows size = 50

this may be the mistake

3

what graylog version did you use?

did you try to make a quick value out of the message field?

4

My version is 2.2.
The Elasticsearch version is 2.4.1

5

first the error from the log is not connected to your 500 loading error - because that is about ingesting a messages.

You tried quick values on the field message? That is a full text field and can contain really different kind of content. That is why this can fail - because the variance is to big. For that reason quick values on the message field is disabled.

For you - yes that can happen. You can only separate the data you are interested in to different fields and run the quick values on that.

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.