Greetings! I’d highly appreciate, if someone wiser here would be able to assist in a few issues I’m experiencing.
I updated our Graylog instance from 2.5.2 to the latest 3.1 following to the update documentation as closely as possible. Elasticsearch was already 5.6.13 thus no separate update for that required. In short, I’ve updated the server.conf with new settings as well as the nginx configuration.
Graylog loads up and I’m able to access it and various settings and the dashboards we have in use. However, I’m unable to open the System>Nodes>our node ID. This results in a HTTP 500 error code with the following error messages:
Could not get plugins: Getting plugins on node "<node ID>" failed: Error: cannot GET https://<FQDN>/api/cluster/<node ID>/plugins (500) Could not get JVM information Getting JVM information for node '<node ID>' failed: Error: cannot GET https://<FQDN>/api/cluster/<node ID>/jvm (500)
I’m also unable to start any inputs, resulting in the following error message and log entry:
Input '<input name>' could not be started. Request to start input '<input name>' failed. Check your Graylog logs for more information. WARN [ProxiedResource] Unable to call https://api/system/inputstates/<input ID> on node <<node ID>>: api
At this point I also noticed that the server.log is getting spammed with similar error messages:
WARN [ProxiedResource] Unable to call https://api/system/metrics/multiple on node <<node ID>>: api
Correct me if I’m wrong, but there’s definitely something fishy going on if the system is trying to call to an address without the server IP or FQDN name? The IP/FQDN related parameters that I have in the server.conf are the following:
http_bind_address = 127.0.0.1:9000 http_publish_uri = https://$http_bind_address/ http_external_uri = <FQDN>/ (same issues persist even with this removed) elasticsearch_hosts = http://127.0.0.1:9200
Considering that everything was working before updating from 2.5.2, what am I missing? Luckily I do have a snapshot from before the update, but it would be nice to have the new features, you know?
Thanks a ton in advance!