Errors report when rotate index set

Graylog Central (peer support)
1

I have create my own index set and add an custom index template. after i XPUT the custom index template, i rotate my index set, and i found the following error report in graylog server log:

2018-04-18T15:13:44.772+08:00 INFO  [DeflectorResource] Cycling deflector for index set <5ad6ed7b39445505569abc56>. Reason: REST request.
2018-04-18T15:13:44.780+08:00 INFO  [MongoIndexSet] Cycling from <test_0> to <test_1>.
2018-04-18T15:13:44.780+08:00 INFO  [MongoIndexSet] Creating target index <test_1>.
2018-04-18T15:13:44.822+08:00 INFO  [Indices] Successfully created index template test-template
2018-04-18T15:13:45.398+08:00 INFO  [MongoIndexSet] Waiting for allocation of index <test_1>.
2018-04-18T15:13:45.404+08:00 INFO  [MongoIndexSet] Index <test_1> has been successfully allocated.
2018-04-18T15:13:45.405+08:00 INFO  [MongoIndexSet] Pointing index alias <test_deflector> to new index <test_1>.
2018-04-18T15:13:45.579+08:00 INFO  [SystemJobManager] Submitted SystemJob <08616590-42d8-11e8-887f-525400ca1804> [org.graylog2.indexer.indices.jobs.SetIndexReadOnlyAndCalculateRangeJob]
2018-04-18T15:13:45.579+08:00 INFO  [MongoIndexSet] Successfully pointed index alias <test_deflector> to index <test_1>.
2018-04-18T15:14:15.583+08:00 ERROR [SystemJobManager] Unhandled error while running SystemJob <08616590-42d8-11e8-887f-525400ca1804> [org.graylog2.indexer.indices.jobs.SetIndexReadOnlyAndCalculateRangeJob]
java.lang.IllegalArgumentException: Cat response did not contain a JSON Array
	at io.searchbox.core.Cat.parseResponseBody(Cat.java:61) ~[graylog.jar:?]
	at io.searchbox.action.AbstractAction.createNewElasticSearchResult(AbstractAction.java:71) ~[graylog.jar:?]
	at io.searchbox.core.Cat.createNewElasticSearchResult(Cat.java:44) ~[graylog.jar:?]
	at io.searchbox.core.Cat.createNewElasticSearchResult(Cat.java:16) ~[graylog.jar:?]
	at io.searchbox.client.http.JestHttpClient.deserializeResponse(JestHttpClient.java:212) ~[graylog.jar:?]
	at io.searchbox.client.http.JestHttpClient.execute(JestHttpClient.java:88) ~[graylog.jar:?]
	at org.graylog2.indexer.cluster.jest.JestUtils.execute(JestUtils.java:46) ~[graylog.jar:?]
	at org.graylog2.indexer.cluster.jest.JestUtils.execute(JestUtils.java:62) ~[graylog.jar:?]
	at org.graylog2.indexer.indices.Indices.catIndices(Indices.java:534) ~[graylog.jar:?]
	at org.graylog2.indexer.indices.Indices.getClosedIndices(Indices.java:498) ~[graylog.jar:?]
	at org.graylog2.indexer.indices.Indices.isClosed(Indices.java:519) ~[graylog.jar:?]
	at org.graylog2.indexer.indices.jobs.SetIndexReadOnlyAndCalculateRangeJob.execute(SetIndexReadOnlyAndCalculateRangeJob.java:58) ~[graylog.jar:?]
	at org.graylog2.system.jobs.SystemJobManager$1.run(SystemJobManager.java:89) [graylog.jar:?]
	at com.codahale.metrics.InstrumentedScheduledExecutorService$InstrumentedRunnable.run(InstrumentedScheduledExecutorService.java:235) [graylog.jar:?]
	at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_162]
	at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_162]
	at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$201(ScheduledThreadPoolExecutor.java:180) [?:1.8.0_162]
	at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293) [?:1.8.0_162]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_162]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_162]
	at java.lang.Thread.run(Thread.java:748) [?:1.8.0_162]

also in the elasticsearch log, there are errors reported:

cat graylog_deprecation.log
[2018-04-18T15:11:35,288][WARN ][o.e.d.r.RestController   ] Content type detection for rest requests is deprecated. Specify the content type using the [Content-Type] header.
[2018-04-18T15:12:59,936][WARN ][o.e.d.r.RestController   ] Content type detection for rest requests is deprecated. Specify the content type using the [Content-Type] header.

cat graylog.log
...
[2018-04-18T13:19:32,839][WARN ][c.f.s.c.PrivilegesEvaluator] graylog_deflector does not exist in cluster metadata
[2018-04-18T13:19:33,131][WARN ][c.f.s.c.PrivilegesEvaluator] graylog_0 does not exist in cluster metadata
[2018-04-18T15:02:22,633][WARN ][c.f.s.c.PrivilegesEvaluator] test_deflector does not exist in cluster metadata
[2018-04-18T15:13:44,825][WARN ][c.f.s.c.PrivilegesEvaluator] test_1 does not exist in cluster metadata

i am using elasticsearch 5.6.8-1 with search guard 5.6.8-19.

2

Does it work without Search Guard?

Also, this looks like a duplicate of Can not search and does not display input and sources statistic with pipeline

3

Oh. yes. this also comes without search guard.

4

Try recalculating index ranges for the “Test” index set or delete that index set and recreate it.

1 Like
5

after do “Recalculating index ranges” operation, and manually re-rotate the index set again, this error doesn’t come again.

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.