Graylog 3.0 Upgrade

I’ve upgraded to Graylog 3.0 yesterday and now my configuration is no longer working, I’m getting a “502 BAD GATEWAY” error from NGINX. My configuration for my server consists of elasticsearch, mongodb, graylog server and NGINX all running on the same host. It appears that my configuration is listening on 127.0.0.1:9000 however not on 10.1.3.19:9000 which seems to be what is causing the issues, I really don’t know anymore as I’ve been trying everything and have made zero headway on getting this issue corrected…

`**curl -i -H 'Accept: text/html' 'http://10.1.3.19:9000/**`
curl: (7) Failed to connect to 10.1.3.19 port 9000: Connection refused

**curl -i -H 'Accept: text/html' 'http://127.0.0.1:9000/**'
HTTP/1.1 200 OK
X-UA-Compatible: IE=edge
X-Graylog-Node-ID: facbca0e-514c-4c31-b366-3b30ec03e40f
Content-Type: text/html
Date: Fri, 15 Feb 2019 17:57:16 GMT
Content-Length: 1314

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="robots" content="noindex, nofollow">
    <meta charset="UTF-8">
    <title>Graylog Web Interface</title>
    <link rel="shortcut icon" href="http://127.0.0.1:9000/assets/favicon.png">

  </head>
  <body>
    <script src="http://127.0.0.1:9000/config.js"></script>

    <script src="http://127.0.0.1:9000/assets/vendor.4024e2a8db732781a971.js"></script>

    <script src="http://127.0.0.1:9000/assets/polyfill.567b98aaba093175141f.js"></script>

    <script src="http://127.0.0.1:9000/assets/builtins.567b98aaba093175141f.js"></script>

    <script src="http://127.0.0.1:9000/assets/plugin/org.graylog.plugins.threatintel.ThreatIntelPlugin/plugin.org.graylog.plugins.threatintel.ThreatIntelPlugin.2f242956705001cd058c.js"></script>

    <script src="http://127.0.0.1:9000/assets/plugin/org.graylog.plugins.collector.CollectorPlugin/plugin.org.graylog.plugins.collector.CollectorPlugin.8ad21418ad38b4d44bb7.js"></script>

    <script src="http://127.0.0.1:9000/assets/plugin/org.graylog.aws.AWSPlugin/plugin.org.graylog.aws.AWSPlugin.5485f767f3c63b51dbf4.js"></script>

    <script src="http://127.0.0.1:9000/assets/app.567b98aaba093175141f.js"></script>

  </body>
</html>

netstat -tulpe
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State User Inode PID/Program name
tcp 0 0 localhost:27017 0.0.0.0:* LISTEN mongodb 29738 520/mongod
tcp 0 0 0.0.0.0:http 0.0.0.0:* LISTEN root 84770 2550/nginx: master
tcp 0 0 localhost:domain 0.0.0.0:* LISTEN systemd-resolve 27585 490/systemd-resolve
tcp 0 0 0.0.0.0:ssh 0.0.0.0:* LISTEN root 29502 545/sshd
tcp6 0 0 localhost:9000 [::]:* LISTEN graylog 110455 2904/java
tcp6 0 0 localhost:9200 [::]:* LISTEN elasticsearch 111421 3155/java
tcp6 0 0 localhost:9200 [::]:* LISTEN elasticsearch 111420 3155/java
tcp6 0 0 [::]:http [::]:* LISTEN root 84771 2550/nginx: master
tcp6 0 0 localhost:9300 [::]:* LISTEN elasticsearch 112075 3155/java
tcp6 0 0 localhost:9300 [::]:* LISTEN elasticsearch 112068 3155/java
tcp6 0 0 [::]:ssh [::]:* LISTEN root 29504 545/sshd
udp 0 0 0.0.0.0:45009 0.0.0.0:* root 30752 525/snmpd
udp 0 0 localhost:domain 0.0.0.0:* systemd-resolve 27584 490/systemd-resolve
udp 0 0 0.0.0.0:snmp 0.0.0.0:* root 30754 525/snmpd
udp6 0 0 localhost:snmp [::]:* root 30755 525/snmpd
udp6 0 0 [::]:5514 [::]:* graylog 110981 2904/java
udp6 0 0 [::]:5514 [::]:* graylog 110457 2904/java
udp6 0 0 [::]:5514 [::]:* graylog 110986 2904/java
udp6 0 0 [::]:5514 [::]:* graylog 110987 2904/java

Check this out!

https://docs.graylog.org/en/3.0/pages/upgrade/graylog-3.0.html

First paragraph: the changes wrt configuration file and the HTTP(s) configuration.

Welcome to the forums dude :slight_smile:

EDIT: My apologies for the earlier version of this post, adding the YouTube link and the accompanying language was inappropriate.

This can be deleted as I’ve corrected it, what it boiled down to is that you have to implement the new .conf file and make the appropriate changes within it for your configuration. Feel free to delete this entire thread if you’d like.

-SNerone

1 Like

Glad you got it sorted Scott!

No need to delete it, as it’ll maybe help others find the answer :slight_smile:

Hello, i just upgraded my graylog from 2.5 to 3 ! i kept the default conf file when asked and made the change to nginx removing the /api path !
everything seem to workl fine ! i wasnt sure if i had to reconfigure everything so i say keep the current conf file ! i went to look for the conf file and it way the same !
should i have to say yes to the new conf file ?
Thanks

Nope, sounds good to me!

As long as everything works, right?

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.