Grafana Graylog (Elasticsearch) Integration

Hi Team,

I am trying to setup the Grafana as link, but getting error (screenshot attached)

I have Graylog+Elasticsearch+MongoDB on 1 server and Grafana on another server, as per link you helped in solving my query, but looks like because of that I am not able to connect Grafana to Elasticsearch.
Kindly let me know what needs to change or if there is any more details needed.

What version of Grafana is that? On mine, I got a 502 error when I didn’t fill in the host name, but the 502 actually shows up in the bar above “Save & Test”

Check firewall ports to make sure that server 2 can talk to server 1 on port 9200, check your hostname, make sure that resolves (it looks like you might not be using a fully qualified hostname) etc.

Grafana version : 6.2.5

On Graylog server :
netstat -tlupna | grep 9200
tcp 0 0* LISTEN -

On Grafana server :
telnet <graylog -server-fqdn> 9200
Trying <graylog -server-ip>…
telnet: connect to address <graylog -server-ip>: Connection refused

Not sure if netstat will show a port as listening even if your firewall is not configured?

The command would vary depending on your OS, for me it’s “firewall-cmd --list-all”

Have you edited the elasticsearch.yml file?

What does your Graylog config specify as the url for elasticsearch? Mine is still default, I still only have a single dev server, so using default localhost works fine.

#List of Elasticsearch hosts Graylog should connect to.
# Need to be specified as a comma-separated list of valid URIs for the http ports of your elasticsearch nodes.
# If one or more of your elasticsearch hosts require authentication, include the credentials in each node URI that
# requires authentication.
# Default:
#elasticsearch_hosts = http://node1:9200,http://user:password@node2:19200

Your netstat output from your graylog server shows that port 9200 is listening on the loop-back address (

You need to configure ES to listen on a non-loopback address that is reachable from your Grafana server.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.