Graylog 2.3 not able to send data to Neo4j graph - Getting Error Cannot Perform rotation

Graylog Add-ons
1

Hi All,

We are using Graylog 2.3 + Elasticsearch 5.5.0 + neo4j 3.2.2 versions for log monitoring application and we have installed neo4j output plugin in graylog to send the data to neo4j graph database.

we have configured the neo4j output with the connection details + Cypher queries. From the graylog streams section we could able to see the data is coming (i.e 40 messages/second) and then in the Manage Output
we are trying to send the data to Neo4j graph database and I could see below error messages were thrown,

INFO  [Neo4JBoltTransport] Identified 3 fields in graph create query.
INFO  [Neo4jOutput] Neo4j output started!
ERROR [AbstractRotationStrategy] Cannot perform rotation at this moment.
ERROR [AbstractRotationStrategy] Cannot perform rotation at this moment.
ERROR [AbstractRotationStrategy] Cannot perform rotation at this moment.
WARN  [NodePingThread] Did not find meta info of this node. Re-registering.
ERROR [AbstractRotationStrategy] Cannot perform rotation at this moment.
ERROR [AbstractRotationStrategy] Cannot perform rotation at this moment.

index size info
index size info.PNG898×132 11.8 KB

Please kindly help on this issue to get resolved.

Regards,
Ganeshbabu R

2

Make sure that your Elasticsearch cluster is healthy and that Graylog is able to connect to it.
Also make sure to check the logs of your Elasticsearch and Graylog nodes for warnings and errors.

As for the Neo4J output plugin, it’s an experimental 3rd party plugin, so you should probably contact the author of that plugin.

3

Hi @jochen

Does the above error relates to this github issue?

Let me know your thoughts.

Yes before I checked the logs, I checked the health of the ES cluster so that the graylog can connect and push the data to index. ES cluster health is looks good and the data are sending frequently.

Regards,
Ganeshbabu R

4

Unless you’re using a beta version of Graylog 2.3.0, no.

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.