Graylog 2.3.1 - Export to CSV via API Call

Graylog Central (peer support)
1

Hi everyone,

right now i’m trying to automate the export of a simple search query to csv via the Graylog API. When i’m executing the following API Call i get a valid response:

curl -u <USER>:<PW> -H 'Accept: application/json' -X GET 'https://localhost:9000/api/search/universal/relative?query=%22session%20opened%20for%20user%20root%22&range=300&decorate=false&fields=timestamp%2Cmessage'
...
...total_results":13,"from":"2018-02-08T15:20:35.009Z","to":"2018-02-08T15:25:35.009Z","decoration_stats":null}

So far so good, but when i’m calling the export API path, i’m getting a weird HTTP 406 error response:

curl -u <USER>:<PW> -H 'Accept: application/json' -X GET 'https://localhost:9000/api/search/universal/relative/export?query=%22session%20opened%20for%20user%20root%22&range=300&fields=timestamp%2Cmessage'

{"type":"ApiError","message":"HTTP 406 Not Acceptable"}

Simply removing the Header from the curl request doesn’t do anything. In fact when i remove the Header switch, i dont get any error messages or output at all. The Graylog-Server logfile shows no Warnings or Errors whatsoever.

Do you have any ideas how to get this export working? Thanks in Advance and Regards
Kevin

PS: For your convenience, some information about our Graylog-Server:
“version” : “2.3.1+9f2c6ef”,
“operating_system” : “Linux 3.10.0-693.11.6.el7.x86_64”,

2

The CSV export (naturally?) produces output with the MIME type text/csv, which you have to send in your HTTP Accept request header.

3

Hey jochen,

thanks for the quick answering.

Yeah i probably should have noted that in my initial post, i already tried that. When im using the text/csv type request header i get no message/output/error on the command-line whatsoever:

[Kevin.Barros-Weiser@graylog ~]# curl -u USER:PW -H 'Accept: text/csv' -X GET 'https://localhost:9000/api/search/universal/relative/export?query=%22session%20opened%20for%20user%20root%22&range=300&fields=timestamp%2Cmessage'
[Kevin.Barros-Weiser@graylog ~]#

BUT, i do get the following error messages in the Graylog-Server logfile:

2018-02-08 16:50:21,221 ERROR: org.glassfish.jersey.message.internal.WriterInterceptorExecutor - MessageBodyWriter not found for media type=text/csv, type=class org.graylog2.rest.resources.search.responses.AutoValue_SearchError, genericType=class org.graylog2.rest.resources.search.responses.AutoValue_SearchError.
2018-02-08 16:50:21,221 ERROR: org.glassfish.jersey.server.ServerRuntime$Responder - Error occurred when processing a response created from an already mapped exception

Didn’t recognize them before…do i need a special Plugin/Addon for this? The export to CSV should be a builtin function, shouldn’t it?

Regards
Kevin

4

Please add the complete log from your Graylog node and not just the last 2 error messages.

FWIW, the error messages tell you that the search query failed for some reason and there’s no support for emitting error messages in text/csv format.

5

Here is the complete log of my Grayloge node. I restarted the graylog server process and executed the API call again, so you can see what is going on:

2018-02-08 17:40:16,048 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Elastic Beats Input 2.3.1 [org.graylog.plugins.beats.BeatsInputPlugin]
2018-02-08 17:40:16,050 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Collector 2.3.1 [org.graylog.plugins.collector.CollectorPlugin]
2018-02-08 17:40:16,051 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Enterprise Integration Plugin 2.3.1 [org.graylog.plugins.enterprise_integration.EnterpriseIntegrationPlugin]
2018-02-08 17:40:16,051 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: MapWidgetPlugin 2.3.1 [org.graylog.plugins.map.MapWidgetPlugin]
2018-02-08 17:40:16,060 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Pipeline Processor Plugin 2.3.1 [org.graylog.plugins.pipelineprocessor.ProcessorPlugin]
2018-02-08 17:40:16,061 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Anonymous Usage Statistics 2.3.1 [org.graylog.plugins.usagestatistics.UsageStatsPlugin]
2018-02-08 17:40:16,335 INFO : org.graylog2.bootstrap.CmdLineTool - Running with JVM arguments: -Djava.library.path=/appl/graylog/graylog-2.3.1/bin/../lib/sigar -Xms2g -Xmx2g -XX:NewRatio=1 -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow -Djavax.net.ssl.trustStore=/appl/graylog/graylog-2.3.1/lib/cacerts.jks
2018-02-08 17:40:16,599 INFO : org.hibernate.validator.internal.util.Version - HV000001: Hibernate Validator null
2018-02-08 17:40:18,804 INFO : org.graylog2.shared.buffers.InputBufferImpl - Message journal is enabled.
2018-02-08 17:40:18,833 INFO : org.graylog2.plugin.system.NodeId - Node ID: 5f82caa6-2bde-4098-a7d3-25271cd10265
2018-02-08 17:40:19,025 INFO : kafka.log.LogManager - Loading logs.
2018-02-08 17:40:19,095 INFO : kafka.log.LogManager - Logs loading complete.
2018-02-08 17:40:19,096 INFO : org.graylog2.shared.journal.KafkaJournal - Initialized Kafka based journal at data/journal
2018-02-08 17:40:19,110 INFO : org.graylog2.shared.buffers.InputBufferImpl - Initialized InputBufferImpl with ring size <65536> and wait strategy <BlockingWaitStrategy>, running 2 parallel message handlers.
2018-02-08 17:40:19,129 INFO : org.mongodb.driver.cluster - Cluster created with settings {hosts=[localhost:27017], mode=SINGLE, requiredClusterType=UNKNOWN, serverSelectionTimeout='30000 ms', maxWaitQueueSize=5000}
2018-02-08 17:40:19,168 INFO : org.mongodb.driver.cluster - No server chosen by ReadPreferenceServerSelector{readPreference=primary} from cluster description ClusterDescription{type=UNKNOWN, connectionMode=SINGLE, serverDescriptions=[ServerDescription{address=localhost:27017, type=UNKNOWN, state=CONNECTING}]}. Waiting for 30000 ms before timing out
2018-02-08 17:40:19,736 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:1, serverValue:59}] to localhost:27017
2018-02-08 17:40:19,739 INFO : org.mongodb.driver.cluster - Monitor thread successfully connected to server with description ServerDescription{address=localhost:27017, type=STANDALONE, state=CONNECTED, ok=true, version=ServerVersion{versionList=[3, 4, 5]}, minWireVersion=0, maxWireVersion=5, maxDocumentSize=16777216, roundTripTimeNanos=478596}
2018-02-08 17:40:19,794 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:2, serverValue:60}] to localhost:27017
2018-02-08 17:40:20,173 INFO : io.searchbox.client.AbstractJestClient - Setting server pool to a list of 1 servers: [http://127.0.0.1:9200]
2018-02-08 17:40:20,174 INFO : io.searchbox.client.JestClientFactory - Using multi thread/connection supporting pooling connection manager
2018-02-08 17:40:20,249 INFO : io.searchbox.client.JestClientFactory - Using custom ObjectMapper instance
2018-02-08 17:40:20,249 INFO : io.searchbox.client.JestClientFactory - Node Discovery disabled...
2018-02-08 17:40:20,249 INFO : io.searchbox.client.JestClientFactory - Idle connection reaping disabled...
2018-02-08 17:40:20,482 INFO : org.graylog2.shared.buffers.ProcessBuffer - Initialized ProcessBuffer with ring size <65536> and wait strategy <BlockingWaitStrategy>.
2018-02-08 17:40:21,928 INFO : org.graylog2.bindings.providers.RulesEngineProvider - No static rules file loaded.
2018-02-08 17:40:22,141 WARN : org.graylog.plugins.map.geoip.GeoIpResolverEngine - GeoIP database file does not exist: /etc/graylog/server/GeoLite2-City.mmdb
2018-02-08 17:40:22,194 INFO : org.graylog2.buffers.OutputBuffer - Initialized OutputBuffer with ring size <65536> and wait strategy <BlockingWaitStrategy>.
2018-02-08 17:40:22,233 WARN : org.graylog.plugins.map.geoip.GeoIpResolverEngine - GeoIP database file does not exist: /etc/graylog/server/GeoLite2-City.mmdb
2018-02-08 17:40:22,268 WARN : org.graylog.plugins.map.geoip.GeoIpResolverEngine - GeoIP database file does not exist: /etc/graylog/server/GeoLite2-City.mmdb
2018-02-08 17:40:22,300 WARN : org.graylog.plugins.map.geoip.GeoIpResolverEngine - GeoIP database file does not exist: /etc/graylog/server/GeoLite2-City.mmdb
2018-02-08 17:40:22,535 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:3, serverValue:61}] to localhost:27017
2018-02-08 17:40:22,554 WARN : org.graylog.plugins.map.geoip.GeoIpResolverEngine - GeoIP database file does not exist: /etc/graylog/server/GeoLite2-City.mmdb
2018-02-08 17:40:22,796 INFO : org.graylog2.bootstrap.ServerBootstrap - Graylog server 2.3.1+9f2c6ef starting up
2018-02-08 17:40:22,796 INFO : org.graylog2.bootstrap.ServerBootstrap - JRE: Oracle Corporation 1.8.0_102 on Linux 3.10.0-693.11.6.el7.x86_64
2018-02-08 17:40:22,796 INFO : org.graylog2.bootstrap.ServerBootstrap - Deployment: unknown
2018-02-08 17:40:22,797 INFO : org.graylog2.bootstrap.ServerBootstrap - OS: Red Hat Enterprise Linux Server 7.4 (Maipo) (rhel)
2018-02-08 17:40:22,797 INFO : org.graylog2.bootstrap.ServerBootstrap - Arch: amd64
2018-02-08 17:40:22,799 WARN : org.graylog2.shared.events.DeadEventLoggingListener - Received unhandled event of type <org.graylog2.plugin.lifecycles.Lifecycle> from event bus <AsyncEventBus{graylog-eventbus}>
2018-02-08 17:40:22,867 INFO : org.graylog2.shared.initializers.PeriodicalsService - Starting 26 periodicals ...
2018-02-08 17:40:22,869 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.ThroughputCalculator] periodical in [0s], polling every [1s].
2018-02-08 17:40:22,869 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.AlertScannerThread] periodical in [10s], polling every [60s].
2018-02-08 17:40:22,871 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.BatchedElasticSearchOutputFlushThread] periodical in [0s], polling every [1s].
2018-02-08 17:40:22,871 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.ClusterHealthCheckThread] periodical in [120s], polling every [20s].
2018-02-08 17:40:22,872 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.ContentPackLoaderPeriodical] periodical, running forever.
2018-02-08 17:40:22,874 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.GarbageCollectionWarningThread] periodical, running forever.
2018-02-08 17:40:22,874 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.IndexerClusterCheckerThread] periodical in [0s], polling every [30s].
2018-02-08 17:40:22,880 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.IndexRetentionThread] periodical in [0s], polling every [300s].
2018-02-08 17:40:22,880 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.IndexRotationThread] periodical in [0s], polling every [10s].
2018-02-08 17:40:22,963 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.NodePingThread] periodical in [0s], polling every [1s].
2018-02-08 17:40:22,963 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.VersionCheckThread] periodical in [300s], polling every [1800s].
2018-02-08 17:40:22,966 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.ThrottleStateUpdaterThread] periodical in [1s], polling every [1s].
2018-02-08 17:40:22,966 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.events.ClusterEventPeriodical] periodical in [0s], polling every [1s].
2018-02-08 17:40:22,967 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.events.ClusterEventCleanupPeriodical] periodical in [0s], polling every [86400s].
2018-02-08 17:40:22,972 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.ClusterIdGeneratorPeriodical] periodical, running forever.
2018-02-08 17:40:22,972 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.IndexRangesMigrationPeriodical] periodical, running forever.
2018-02-08 17:40:22,973 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.IndexRangesCleanupPeriodical] periodical in [15s], polling every [3600s].
2018-02-08 17:40:23,111 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:5, serverValue:63}] to localhost:27017
2018-02-08 17:40:23,112 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:10, serverValue:68}] to localhost:27017
2018-02-08 17:40:23,114 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:4, serverValue:62}] to localhost:27017
2018-02-08 17:40:23,115 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:7, serverValue:65}] to localhost:27017
2018-02-08 17:40:23,117 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:6, serverValue:64}] to localhost:27017
2018-02-08 17:40:23,117 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:9, serverValue:67}] to localhost:27017
2018-02-08 17:40:23,121 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:8, serverValue:66}] to localhost:27017
2018-02-08 17:40:23,127 INFO : org.graylog2.shared.initializers.PeriodicalsService - Not starting [org.graylog2.periodical.UserPermissionMigrationPeriodical] periodical. Not configured to run on this node.
2018-02-08 17:40:23,127 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.AlarmCallbacksMigrationPeriodical] periodical, running forever.
2018-02-08 17:40:23,128 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.ConfigurationManagementPeriodical] periodical, running forever.
2018-02-08 17:40:23,136 INFO : org.graylog2.shared.initializers.PeriodicalsService - Not starting [org.graylog2.periodical.LdapGroupMappingMigration] periodical. Not configured to run on this node.
2018-02-08 17:40:23,144 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.IndexFailuresPeriodical] periodical, running forever.
2018-02-08 17:40:23,148 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog.plugins.usagestatistics.UsageStatsNodePeriodical] periodical in [300s], polling every [21600s].
2018-02-08 17:40:23,149 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog.plugins.usagestatistics.UsageStatsClusterPeriodical] periodical in [300s], polling every [21600s].
2018-02-08 17:40:23,184 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog.plugins.pipelineprocessor.periodical.LegacyDefaultStreamMigration] periodical, running forever.
2018-02-08 17:40:23,185 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog.plugins.collector.periodical.PurgeExpiredCollectorsThread] periodical in [0s], polling every [3600s].
2018-02-08 17:40:23,191 INFO : org.graylog.plugins.pipelineprocessor.periodical.LegacyDefaultStreamMigration - Legacy default stream has no connections, no migration needed.
2018-02-08 17:40:23,471 INFO : org.graylog2.shared.initializers.JerseyService - Enabling CORS for HTTP endpoint
2018-02-08 17:40:23,723 INFO : org.graylog2.indexer.rotation.strategies.AbstractRotationStrategy - Deflector index <Unix Syslog Mail Index Set> (index set <unix_syslog_mail_0>) should be rotated, Pointing deflector to new index now!
2018-02-08 17:40:23,724 INFO : org.graylog2.indexer.MongoIndexSet - Cycling from <unix_syslog_mail_0> to <unix_syslog_mail_1>.
2018-02-08 17:40:23,724 INFO : org.graylog2.indexer.MongoIndexSet - Creating target index <unix_syslog_mail_1>.
2018-02-08 17:40:23,952 INFO : org.graylog2.indexer.indices.Indices - Successfully created index template unix_syslog_mail-template
2018-02-08 17:40:24,348 INFO : org.graylog2.indexer.MongoIndexSet - Waiting for allocation of index <unix_syslog_mail_1>.
2018-02-08 17:40:24,364 INFO : org.graylog2.indexer.MongoIndexSet - Index <unix_syslog_mail_1> has been successfully allocated.
2018-02-08 17:40:24,364 INFO : org.graylog2.indexer.MongoIndexSet - Pointing index alias <unix_syslog_mail_deflector> to new index <unix_syslog_mail_1>.
2018-02-08 17:40:24,448 INFO : org.graylog2.system.jobs.SystemJobManager - Submitted SystemJob <c2c880f0-0cee-11e8-a915-005056810b61> [org.graylog2.indexer.indices.jobs.SetIndexReadOnlyAndCalculateRangeJob]
2018-02-08 17:40:24,448 INFO : org.graylog2.indexer.MongoIndexSet - Successfully pointed index alias <unix_syslog_mail_deflector> to index <unix_syslog_mail_1>.
2018-02-08 17:40:34,549 INFO : org.glassfish.grizzly.http.server.NetworkListener - Started listener bound to [graylog.postcom.deutschepost.de:9000]
2018-02-08 17:40:34,551 INFO : org.glassfish.grizzly.http.server.HttpServer - [HttpServer] Started.
2018-02-08 17:40:34,551 INFO : org.graylog2.shared.initializers.JerseyService - Started REST API at <https://graylog.postcom.deutschepost.de:9000/api/>
2018-02-08 17:40:34,551 INFO : org.graylog2.shared.initializers.JerseyService - Started Web Interface at <https://graylog.postcom.deutschepost.de:9000/>
2018-02-08 17:40:34,552 INFO : org.graylog2.shared.initializers.ServiceManagerListener - Services are healthy
2018-02-08 17:40:34,553 INFO : org.graylog2.bootstrap.ServerBootstrap - Services started, startup times in ms: {InputSetupService [RUNNING]=5, OutputSetupService [RUNNING]=87, BufferSynchronizerService [RUNNING]=88, KafkaJournal [RUNNING]=108, JournalReader [RUNNING]=263, ConfigurationEtagService [RUNNING]=268, LookupTableService [RUNNING]=303, StreamCacheService [RUNNING]=319, PeriodicalsService [RUNNING]=325, JerseyService [RUNNING]=11685}
2018-02-08 17:40:34,553 INFO : org.graylog2.shared.initializers.InputSetupService - Triggering launching persisted inputs, node transitioned from Uninitialized [LB:DEAD] to Running [LB:ALIVE]
2018-02-08 17:40:34,556 INFO : org.graylog2.bootstrap.ServerBootstrap - Graylog server up and running.
2018-02-08 17:40:34,598 WARN : org.graylog2.plugin.inputs.transports.AbstractTcpTransport - TLS key file or certificate file does not exist, creating a self-signed certificate for input [Beats/5a098baca5eef832717bad19].
2018-02-08 17:40:34,600 INFO : org.graylog2.inputs.InputStateListener - Input [Beats/5a098baca5eef832717bad19] is now STARTING
2018-02-08 17:40:34,604 INFO : org.graylog2.inputs.InputStateListener - Input [Syslog TCP/5a704693a5eef8444da95035] is now STARTING
2018-02-08 17:40:34,630 INFO : org.graylog2.inputs.InputStateListener - Input [Syslog UDP/5a7c09c6a5eef85604ebc977] is now STARTING
2018-02-08 17:40:34,687 WARN : org.graylog2.plugin.inputs.transports.NettyTransport - receiveBufferSize (SO_RCVBUF) for input SyslogUDPInput{title=Syslog_UDP_Unix, type=org.graylog2.inputs.syslog.udp.SyslogUDPInput, nodeId=5f82caa6-2bde-4098-a7d3-25271cd10265} should be 262144 but is 212992.
2018-02-08 17:40:34,688 WARN : org.graylog2.plugin.inputs.transports.NettyTransport - receiveBufferSize (SO_RCVBUF) for input SyslogTCPInput{title=Syslog_TCP_Unix, type=org.graylog2.inputs.syslog.tcp.SyslogTCPInput, nodeId=5f82caa6-2bde-4098-a7d3-25271cd10265} should be 1048576 but is 212992.
2018-02-08 17:40:34,690 INFO : org.graylog2.inputs.InputStateListener - Input [Syslog UDP/5a7c09c6a5eef85604ebc977] is now RUNNING
2018-02-08 17:40:34,694 INFO : org.graylog2.inputs.InputStateListener - Input [Syslog TCP/5a704693a5eef8444da95035] is now RUNNING
2018-02-08 17:40:34,750 INFO : org.graylog2.plugin.inputs.transports.AbstractTcpTransport - Enabled TLS for input [Beats/5a098baca5eef832717bad19]. key-file="/tmp/keyutil_10.175.157.41:null_6059439185389933832.key" cert-file="/tmp/keyutil_10.175.157.41:null_1309926802206608609.crt"
2018-02-08 17:40:34,783 WARN : org.graylog2.plugin.inputs.transports.NettyTransport - receiveBufferSize (SO_RCVBUF) for input BeatsInput{title=WinLog_Beats_Windows, type=org.graylog.plugins.beats.BeatsInput, nodeId=null} should be 1048576 but is 212992.
2018-02-08 17:40:34,785 INFO : org.graylog2.inputs.InputStateListener - Input [Beats/5a098baca5eef832717bad19] is now RUNNING
2018-02-08 17:40:54,486 INFO : org.graylog2.indexer.SetIndexReadOnlyJob - Flushing old index <unix_syslog_mail_0>.
2018-02-08 17:40:54,590 INFO : org.graylog2.indexer.SetIndexReadOnlyJob - Setting old index <unix_syslog_mail_0> to read-only.
2018-02-08 17:40:54,656 INFO : org.graylog2.system.jobs.SystemJobManager - Submitted SystemJob <d4c9e0f0-0cee-11e8-a915-005056810b61> [org.graylog2.indexer.indices.jobs.OptimizeIndexJob]
2018-02-08 17:40:54,658 INFO : org.graylog2.indexer.indices.jobs.OptimizeIndexJob - Optimizing index <unix_syslog_mail_0>.
2018-02-08 17:40:54,660 INFO : org.graylog2.indexer.ranges.CreateNewSingleIndexRangeJob - Calculating ranges for index unix_syslog_mail_0.
2018-02-08 17:40:55,926 INFO : org.graylog2.indexer.ranges.MongoIndexRangeService - Calculated range of [unix_syslog_mail_0] in [1264ms].
2018-02-08 17:40:55,928 INFO : org.graylog2.indexer.ranges.CreateNewSingleIndexRangeJob - Created ranges for index unix_syslog_mail_0.
2018-02-08 17:40:55,928 INFO : org.graylog2.system.jobs.SystemJobManager - SystemJob <c2c880f0-0cee-11e8-a915-005056810b61> [org.graylog2.indexer.indices.jobs.SetIndexReadOnlyAndCalculateRangeJob] finished in 1478ms.
2018-02-08 17:41:41,661 INFO : org.graylog2.system.jobs.SystemJobManager - SystemJob <d4c9e0f0-0cee-11e8-a915-005056810b61> [org.graylog2.indexer.indices.jobs.OptimizeIndexJob] finished in 47005ms.
2018-02-08 17:42:38,181 INFO : org.apache.directory.api.ldap.codec.osgi.DefaultLdapCodecService - Registered pre-bundled control factory: 1.3.6.1.4.1.18060.0.0.1
2018-02-08 17:42:38,182 INFO : org.apache.directory.api.ldap.codec.osgi.DefaultLdapCodecService - Registered pre-bundled control factory: 2.16.840.1.113730.3.4.7
2018-02-08 17:42:38,182 INFO : org.apache.directory.api.ldap.codec.osgi.DefaultLdapCodecService - Registered pre-bundled control factory: 2.16.840.1.113730.3.4.2
2018-02-08 17:42:38,182 INFO : org.apache.directory.api.ldap.codec.osgi.DefaultLdapCodecService - Registered pre-bundled control factory: 2.16.840.1.113730.3.4.18
2018-02-08 17:42:38,183 INFO : org.apache.directory.api.ldap.codec.osgi.DefaultLdapCodecService - Registered pre-bundled control factory: 1.2.840.113556.1.4.319
2018-02-08 17:42:38,183 INFO : org.apache.directory.api.ldap.codec.osgi.DefaultLdapCodecService - Registered pre-bundled control factory: 2.16.840.1.113730.3.4.3
2018-02-08 17:42:38,183 INFO : org.apache.directory.api.ldap.codec.osgi.DefaultLdapCodecService - Registered pre-bundled control factory: 1.3.6.1.4.1.4203.1.10.1
2018-02-08 17:42:38,184 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled control factory: 1.3.6.1.4.1.18060.0.0.1
2018-02-08 17:42:38,184 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled control factory: 2.16.840.1.113730.3.4.7
2018-02-08 17:42:38,184 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled control factory: 2.16.840.1.113730.3.4.2
2018-02-08 17:42:38,184 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled control factory: 2.16.840.1.113730.3.4.18
2018-02-08 17:42:38,185 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled control factory: 1.2.840.113556.1.4.319
2018-02-08 17:42:38,185 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled control factory: 2.16.840.1.113730.3.4.3
2018-02-08 17:42:38,185 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled control factory: 1.3.6.1.4.1.4203.1.10.1
2018-02-08 17:42:38,185 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled control factory: 1.3.6.1.4.1.42.2.27.8.5.1
2018-02-08 17:42:38,185 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled control factory: 2.16.840.1.113730.3.4.9
2018-02-08 17:42:38,186 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled control factory: 2.16.840.1.113730.3.4.10
2018-02-08 17:42:38,186 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled control factory: 1.3.6.1.4.1.4203.1.9.1.3
2018-02-08 17:42:38,186 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled control factory: 1.3.6.1.4.1.4203.1.9.1.4
2018-02-08 17:42:38,187 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled control factory: 1.3.6.1.4.1.4203.1.9.1.1
2018-02-08 17:42:38,187 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled control factory: 1.3.6.1.4.1.4203.1.9.1.2
2018-02-08 17:42:38,187 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled control factory: 1.2.840.113556.1.4.473
2018-02-08 17:42:38,187 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled control factory: 1.2.840.113556.1.4.474
2018-02-08 17:42:38,188 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled control factory: 1.2.840.113556.1.4.841
2018-02-08 17:42:38,188 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled control factory: 1.2.840.113556.1.4.417
2018-02-08 17:42:38,189 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled control factory: 1.2.840.113556.1.4.1413
2018-02-08 17:42:38,189 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled control factory: 1.2.840.113556.1.4.528
2018-02-08 17:42:38,190 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled extended operation factory: 1.3.6.1.1.8
2018-02-08 17:42:38,191 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled extended operation factory: 1.3.6.1.4.1.18060.0.1.8
2018-02-08 17:42:38,191 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled extended operation factory: 1.3.6.1.4.1.18060.0.1.3
2018-02-08 17:42:38,192 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled extended operation factory: 1.3.6.1.4.1.18060.0.1.6
2018-02-08 17:42:38,193 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled extended operation factory: 1.3.6.1.4.1.18060.0.1.5
2018-02-08 17:42:38,193 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled extended operation factory: 1.3.6.1.4.1.4203.1.11.1
2018-02-08 17:42:38,194 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled extended operation factory: 1.3.6.1.4.1.4203.1.11.3
2018-02-08 17:42:38,195 INFO : org.apache.directory.api.ldap.codec.standalone.CodecFactoryUtil - Registered pre-bundled extended operation factory: 1.3.6.1.4.1.1466.20037
2018-02-08 17:42:39,619 ERROR: org.glassfish.jersey.message.internal.WriterInterceptorExecutor - MessageBodyWriter not found for media type=text/csv, type=class org.graylog2.rest.resources.search.responses.AutoValue_SearchError, genericType=class org.graylog2.rest.resources.search.responses.AutoValue_SearchError.
2018-02-08 17:42:39,619 ERROR: org.glassfish.jersey.server.ServerRuntime$Responder - Error occurred when processing a response created from an already mapped exception.

Regards
Kevin

Edit: Don’t know if this correlates, but i tried to export the query results to CSV via the web UI. Even that won’t work. I get the exact same error messages in the graylog-server.log, as when i’m submitting the API call:

2018-02-11 15:10:13,172 ERROR: org.glassfish.jersey.message.internal.WriterInterceptorExecutor - MessageBodyWriter not found for media type=text/csv, type=class org.graylog2.rest.resources.search.responses.AutoValue_SearchError, genericType=class org.graylog2.rest.resources.search.responses.AutoValue_SearchError.
2018-02-11 15:10:13,173 ERROR: org.glassfish.jersey.server.ServerRuntime$Responder - Error occurred when processing a response created from an already mapped exception.

Any other ideas?

6

Because it’s the same request to the Graylog REST API.

For reference:

7

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.