Grafana Graylog (Elasticsearch) Integration

Graylog Central (peer support)
1

Hi Team,

I am trying to setup the Grafana as link, but getting error (screenshot attached)

Capture1
Capture1.PNG952×847 31.2 KB
.
I have Graylog+Elasticsearch+MongoDB on 1 server and Grafana on another server, as per link you helped in solving my query, but looks like because of that I am not able to connect Grafana to Elasticsearch.
Kindly let me know what needs to change or if there is any more details needed.

2

What version of Grafana is that? On mine, I got a 502 error when I didn’t fill in the host name, but the 502 actually shows up in the bar above “Save & Test”

Check firewall ports to make sure that server 2 can talk to server 1 on port 9200, check your hostname, make sure that resolves (it looks like you might not be using a fully qualified hostname) etc.

3

Grafana version : 6.2.5

On Graylog server :
netstat -tlupna | grep 9200
tcp 0 0 127.0.0.1:9200 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:53138 127.0.0.1:9200 ESTABLISHED -
tcp 0 0 127.0.0.1:9200 127.0.0.1:53136 ESTABLISHED -
tcp 0 0 127.0.0.1:9200 127.0.0.1:53138 ESTABLISHED -
tcp 0 0 127.0.0.1:53136 127.0.0.1:9200 ESTABLISHED -

On Grafana server :
telnet <graylog -server-fqdn> 9200
Trying <graylog -server-ip>…
telnet: connect to address <graylog -server-ip>: Connection refused

4

Not sure if netstat will show a port as listening even if your firewall is not configured?

The command would vary depending on your OS, for me it’s “firewall-cmd --list-all”

Have you edited the elasticsearch.yml file?

https://www.elastic.co/guide/en/elasticsearch/reference/current/network.host.html

What does your Graylog config specify as the url for elasticsearch? Mine is still default, I still only have a single dev server, so using default localhost works fine.

#List of Elasticsearch hosts Graylog should connect to.
# Need to be specified as a comma-separated list of valid URIs for the http ports of your elasticsearch nodes.
# If one or more of your elasticsearch hosts require authentication, include the credentials in each node URI that
# requires authentication.
#
# Default: http://127.0.0.1:9200
#elasticsearch_hosts = http://node1:9200,http://user:password@node2:19200
5

Your netstat output from your graylog server shows that port 9200 is listening on the loop-back address (127.0.0.1)

You need to configure ES to listen on a non-loopback address that is reachable from your Grafana server.

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.