Error with "message" and "source" fields


(Mohamed Bahaa) #1

please support to solve this issue in viewing quick values and analise “message” and “source” fields


Could not load quick values (500)
(Jan Doberstein) #2

That is currently not an issue or error - that is a feature.


(Mohamed Bahaa) #3

how can i adjust it to be viewed, as it was working normally before


#4

I have found QuickValues for the source field extreme useful, for e.g. looking at all sources send logs, or a widget showing the efficiency of a load balancing setup for a selected subset of sources and a specific query.

As this feature has been removed, what would be the correct way to do it with 2.4.X (I have to adjust several dashboards after the upgrade).


#5

I upgraded my test setup, and it seems that the source field should work as before, and message field does note have that option any more.

So the problem of the original poster could be about something elset?


(Mohamed Bahaa) #6

Dears,

Please help me with my issue as I could previously view quick value figures for both message and source fields but after upgrading to v2.3x from v2.4x I faced administration issue with one of them and error with the other.

I already provided snapshot showing the 2 problems in one graph.


#7

Any errors in the graylog’s or elasticsearch’s log files?


Loading field graph for 'message' with status 500 graylog
(Jan Doberstein) #8

You can configure the Fields that are disabled for analysis in System > Configuration

Your Screenshot is not enough Information to help you in any way.


(Mohamed Bahaa) #9

thanks for the provided snapshot that helped me with the “message” field administration issue.

But i still face the following errors when i click on the buttons of “Generate Chart” or “Quick Values”:

Updating field graph data failed: Error: cannot GET http://10.39.6.2:9000/api/search/universal/relative/fieldhistogram?query=*&range=0&interval=minute&field=message&cardinality=false (500)

Loading field graph for ‘message’ failed with status 500


Message Quick Vaules Error
(Jan Doberstein) #10

without any more information - log messages for example from Graylog it is hard to tell what the reason is for that.


(Mohamed Bahaa) #11

Forgive me as I’m not familiar enough with graylog.

If you could tell which logs to share I’ll do at once


(Jan Doberstein) #12

we have covered the locations here: http://docs.graylog.org/en/stable/pages/configuration/file_location.html

the Graylog server.log would be needed information - at first.


(system) #13

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.