Error, when booting docker container: ERROR: org.graylog2.periodical.IndexRotationThread - Couldn't point deflector to a new index

Graylog Central (peer support)
1

Hi dear community,

I have a Graylog running in a docker container. When booting, I get this errors in the log. It seems, as if everything is working fine, but I am not sure about it.
Any feedback on how to fix this would be very appreciated.

2023-05-14 21:41:42,423 ERROR: org.graylog2.periodical.IndexRotationThread - Couldn't point deflector to a new index

java.lang.RuntimeException: Unable to extract count from response.

	at org.graylog.storage.elasticsearch7.IndicesAdapterES7.numberOfMessages(IndicesAdapterES7.java:275) ~[?:?]

	at org.graylog2.indexer.indices.Indices.numberOfMessages(Indices.java:125) ~[graylog.jar:?]

	at org.graylog2.indexer.rotation.strategies.MessageCountRotationStrategy.shouldRotate(MessageCountRotationStrategy.java:68) ~[graylog.jar:?]

	at org.graylog2.indexer.rotation.strategies.MessageCountRotationStrategy.shouldRotate(MessageCountRotationStrategy.java:34) ~[graylog.jar:?]

	at org.graylog2.indexer.rotation.strategies.AbstractRotationStrategy.rotate(AbstractRotationStrategy.java:71) ~[graylog.jar:?]

	at org.graylog2.periodical.IndexRotationThread.checkForRotation(IndexRotationThread.java:127) ~[graylog.jar:?]

	at org.graylog2.periodical.IndexRotationThread.lambda$doRun$0(IndexRotationThread.java:91) ~[graylog.jar:?]

	at java.lang.Iterable.forEach(Unknown Source) [?:?]

	at org.graylog2.periodical.IndexRotationThread.doRun(IndexRotationThread.java:87) [graylog.jar:?]

	at org.graylog2.plugin.periodical.Periodical.run(Periodical.java:94) [graylog.jar:?]

	at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:?]

	at java.util.concurrent.FutureTask.runAndReset(Unknown Source) [?:?]

	at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown Source) [?:?]

	at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?]

	at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?]

	at java.lang.Thread.run(Unknown Source) [?:?]

2023-05-14 21:41:42,587 ERROR: org.graylog2.periodical.IndexRotationThread - Couldn't point deflector to a new index

java.lang.RuntimeException: Unable to extract count from response.

	at org.graylog.storage.elasticsearch7.IndicesAdapterES7.numberOfMessages(IndicesAdapterES7.java:275) ~[?:?]

	at org.graylog2.indexer.indices.Indices.numberOfMessages(Indices.java:125) ~[graylog.jar:?]

	at org.graylog2.indexer.rotation.strategies.TimeBasedRotationStrategy.isEmptyIndexSet(TimeBasedRotationStrategy.java:248) ~[graylog.jar:?]

	at org.graylog2.indexer.rotation.strategies.TimeBasedRotationStrategy.shouldRotate(TimeBasedRotationStrategy.java:229) ~[graylog.jar:?]

	at org.graylog2.indexer.rotation.strategies.AbstractRotationStrategy.rotate(AbstractRotationStrategy.java:71) ~[graylog.jar:?]

	at org.graylog2.periodical.IndexRotationThread.checkForRotation(IndexRotationThread.java:127) ~[graylog.jar:?]

	at org.graylog2.periodical.IndexRotationThread.lambda$doRun$0(IndexRotationThread.java:91) ~[graylog.jar:?]

	at java.lang.Iterable.forEach(Unknown Source) [?:?]

	at org.graylog2.periodical.IndexRotationThread.doRun(IndexRotationThread.java:87) [graylog.jar:?]

	at org.graylog2.plugin.periodical.Periodical.run(Periodical.java:94) [graylog.jar:?]

	at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:?]

	at java.util.concurrent.FutureTask.runAndReset(Unknown Source) [?:?]

	at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown Source) [?:?]

	at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?]

	at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?]

	at java.lang.Thread.run(Unknown Source) [?:?]

2023-05-14 21:41:42,637 ERROR: org.graylog2.periodical.IndexRotationThread - Couldn't point deflector to a new index

java.lang.RuntimeException: Unable to extract count from response.

	at org.graylog.storage.elasticsearch7.IndicesAdapterES7.numberOfMessages(IndicesAdapterES7.java:275) ~[?:?]

	at org.graylog2.indexer.indices.Indices.numberOfMessages(Indices.java:125) ~[graylog.jar:?]

	at org.graylog2.indexer.rotation.strategies.TimeBasedRotationStrategy.isEmptyIndexSet(TimeBasedRotationStrategy.java:248) ~[graylog.jar:?]

	at org.graylog2.indexer.rotation.strategies.TimeBasedRotationStrategy.shouldRotate(TimeBasedRotationStrategy.java:229) ~[graylog.jar:?]

	at org.graylog2.indexer.rotation.strategies.AbstractRotationStrategy.rotate(AbstractRotationStrategy.java:71) ~[graylog.jar:?]

	at org.graylog2.periodical.IndexRotationThread.checkForRotation(IndexRotationThread.java:127) ~[graylog.jar:?]

	at org.graylog2.periodical.IndexRotationThread.lambda$doRun$0(IndexRotationThread.java:91) ~[graylog.jar:?]

	at java.lang.Iterable.forEach(Unknown Source) [?:?]

	at org.graylog2.periodical.IndexRotationThread.doRun(IndexRotationThread.java:87) [graylog.jar:?]

	at org.graylog2.plugin.periodical.Periodical.run(Periodical.java:94) [graylog.jar:?]

	at java.util.concurrent.Executors$RunnableAdapter.call(Unknown Source) [?:?]

	at java.util.concurrent.FutureTask.runAndReset(Unknown Source) [?:?]

	at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(Unknown Source) [?:?]

	at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?]

	at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?]

	at java.lang.Thread.run(Unknown Source) [?:?]

Thank you,
Chris

EDIT:
Graylog 5.0.7, Elasticsearch, MongoDB

2

Graylog is checking whether an index needs to be rotated. ES is returning an incomplete response to the _stats API call.
Its not immediately blocking if an index cant be rotated. But eventually things will fail. Does this repeat periodically or was it a one-time thing?

3

Hi,
well, I don’t know, if this is repeated. I updated my docker container to the newest graylog version and that is, when I have seen the logs.

Should I try another reboot?

4

Hi @patrickmann,

I just did a restart of my graylog-docker-container. The error did not re-appear. This might have been a onetime error. :slight_smile:

Thank you anyway,
Chris

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.