Graylog 3.0 with docker container

Graylog Central (peer support)
, , , , ,
1

Hello

I’m trying to test the new graylog 3.0 using containers.
I’m following the official website documentation, but I can not access the webpage on port 9000.

http://docs.graylog.org/en/stable/pages/installation/docker.html

I execute the following commands as in the site:

docker run --name mongo -d mongo:3
docker run --name elasticsearch \
    -e "http.host=0.0.0.0" \
    -e "ES_JAVA_OPTS=-Xms512m -Xmx512m" \
    -p 9200:9200 -p 9300:9300 \
    -d docker.elastic.co/elasticsearch/elasticsearch-oss:6.5.4
docker run --link mongo --link elasticsearch \
    -p 9000:9000 -p 12201:12201 -p 514:514 \
    -e GRAYLOG_HTTP_BIND_ADDRESS=127.0.0.1:9000 \
    -e GRAYLOG_ROOT_PASSWORD_SHA2=8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92 \
    -e GRAYLOG_PASSWORD_SECRET=fGoTI07CooB6xNy5sdPVSKSuq6QSu2QyWf6G9z3haolgwbERTQ9ZbfbF6hxRYbJMMAlEZX7CXHxJLBkNyfM0420u8aFuZy9M \
    -d graylog/graylog:3.0

When I try to access via browser (http://127.0.0.1:9000/) the message appears:

The connection has been reset.
ERR_CONNECTION_RESET

I looked at the graylog container logs and it shows that it is working

2019-03-06 17:23:02,976 INFO : org.graylog2.bootstrap.ServerBootstrap - Graylog server up and running.

I made a simple test by just changing the graylog image from version 3.0 to 2.4 and it worked normally.

I can not understand why version 3 does not display the web page, do you have to do some configuration too or am I doing something wrong?

Thank you

2

is the port 9000 open and reachable on 127.0.0.1? Did you run this on your local computer? What if you use curl to connect?

3

is the port 9000 open and reachable on 127.0.0.1?

When I test with telnet and ss:

# telnet 127.0.0.1 9000
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
Connection closed by foreign host.

# ss -o state listening '( sport = 9000 )'
Netid         Recv-Q          Send-Q                    Local Address:Port                   Peer Address:Port          
tcp           0               128                                   *:9000                              *:*

I believe that door 9000 is open.

Did you run this on your local computer?
I use it on my local computer with Linux Mint 19.2

What if you use curl to connect?

# curl 127.0.0.1:9000
curl: (56) Recv failure: Connection closed by the other end
4

you might want to try it with the procotol included:

curl -v http://127.0.0.1:9000

In addition grep the port from netstat is more readable:

netstat -ln | grep ":9000"
5

Follows the output of the commands:

# curl -v http://127.0.0.1:9000
* Rebuilt URL to: http://127.0.0.1:9000/
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 9000 (#0)
> GET / HTTP/1.1
> Host: 127.0.0.1:9000
> User-Agent: curl/7.58.0
> Accept: */*
> 
* Recv failure: Connection closed by the other end
* stopped the pause stream!
* Closing connection 0
curl: (56) Recv failure: Connection closed by the other end

# netstat -ln | grep ":9000"
tcp6       0      0 :::9000                 :::*                    listen

tks

6

if Graylog is listening on port 9000 on localhost, the return would be:

~ curl -v http://127.0.0.1:9000
* Rebuilt URL to: http://127.0.0.1:9000/
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 9000 (#0)
> GET / HTTP/1.1
> Host: 127.0.0.1:9000
> User-Agent: curl/7.54.0
> Accept: */*
>
< HTTP/1.1 200 OK
< X-UA-Compatible: IE=edge
< X-Graylog-Node-ID: 2b7fc0aa-fa52-453e-8abd-068c9534df35
< Content-Type: text/html
< Date: Thu, 07 Mar 2019 16:25:29 GMT
< Content-Length: 1314
<
<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="X-UA-Compatible" content="IE=edge">
    <meta name="robots" content="noindex, nofollow">
    <meta charset="UTF-8">
    <title>Graylog Web Interface</title>
    <link rel="shortcut icon" href="http://127.0.0.1:9000/assets/favicon.png">

  </head>
  <body>
    <script src="http://127.0.0.1:9000/config.js"></script>

    <script src="http://127.0.0.1:9000/assets/vendor.4024e2a8db732781a971.js"></script>

    <script src="http://127.0.0.1:9000/assets/polyfill.567b98aaba093175141f.js"></script>

    <script src="http://127.0.0.1:9000/assets/builtins.567b98aaba093175141f.js"></script>

    <script src="http://127.0.0.1:9000/assets/plugin/org.graylog.plugins.threatintel.ThreatIntelPlugin/plugin.org.graylog.plugins.threatintel.ThreatIntelPlugin.2f242956705001cd058c.js"></script>

    <script src="http://127.0.0.1:9000/assets/plugin/org.graylog.plugins.collector.CollectorPlugin/plugin.org.graylog.plugins.collector.CollectorPlugin.8ad21418ad38b4d44bb7.js"></script>

    <script src="http://127.0.0.1:9000/assets/plugin/org.graylog.aws.AWSPlugin/plugin.org.graylog.aws.AWSPlugin.5485f767f3c63b51dbf4.js"></script>

    <script src="http://127.0.0.1:9000/assets/app.567b98aaba093175141f.js"></script>

  </body>
</html>
* Connection #0 to host 127.0.0.1 left intact

So I guess, it is not listening. Return to debug the container logfile … or open a firewall or whatever.

7

You are correct, the graylog is not listening to the port.

One question, graylog 3.0 in container works in your environment?

Here’s the graylog container logs.

# docker logs vibrant_shamir 
2019-03-07 16:09:02,787 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: AWS plugins 3.0.0 [org.graylog.aws.AWSPlugin]
2019-03-07 16:09:02,790 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Collector 3.0.0 [org.graylog.plugins.collector.CollectorPlugin]
2019-03-07 16:09:02,790 INFO : org.graylog2.bootstrap.CmdLineTool - Loaded plugin: Threat Intelligence Plugin 3.0.0 [org.graylog.plugins.threatintel.ThreatIntelPlugin]
2019-03-07 16:09:03,188 INFO : org.graylog2.bootstrap.CmdLineTool - Running with JVM arguments: -XX:+UnlockExperimentalVMOptions -XX:+UseCGroupMemoryLimitForHeap -XX:NewRatio=1 -XX:MaxMetaspaceSize=256m -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow -Dlog4j.configurationFile=/usr/share/graylog/data/config/log4j2.xml -Djava.library.path=/usr/share/graylog/lib/sigar/ -Dgraylog2.installation_source=docker
2019-03-07 16:09:03,434 INFO : org.hibernate.validator.internal.util.Version - HV000001: Hibernate Validator 5.1.3.Final
2019-03-07 16:09:06,216 INFO : org.graylog2.shared.buffers.InputBufferImpl - Message journal is enabled.
2019-03-07 16:09:06,246 INFO : org.graylog2.plugin.system.NodeId - No node ID file found. Generated: 7222aa7b-0a69-4325-aa33-448feb6f1699
2019-03-07 16:09:06,424 INFO : kafka.log.LogManager - Loading logs.
2019-03-07 16:09:06,429 INFO : kafka.log.LogManager - Logs loading complete.
2019-03-07 16:09:06,468 INFO : kafka.log.LogManager - Created log for partition [messagejournal,0] in /usr/share/graylog/data/journal with properties {file.delete.delay.ms -> 60000, compact -> false, max.message.bytes -> 104857600, min.insync.replicas -> 1, segment.jitter.ms -> 0, index.interval.bytes -> 4096, min.cleanable.dirty.ratio -> 0.5, unclean.leader.election.enable -> true, retention.bytes -> 5368709120, delete.retention.ms -> 86400000, flush.ms -> 60000, segment.bytes -> 104857600, segment.ms -> 3600000, retention.ms -> 43200000, flush.messages -> 1000000, segment.index.bytes -> 1048576}.
2019-03-07 16:09:06,468 INFO : org.graylog2.shared.journal.KafkaJournal - Initialized Kafka based journal at /usr/share/graylog/data/journal
2019-03-07 16:09:06,481 INFO : org.graylog2.shared.buffers.InputBufferImpl - Initialized InputBufferImpl with ring size <65536> and wait strategy <BlockingWaitStrategy>, running 2 parallel message handlers.
2019-03-07 16:09:06,498 INFO : org.mongodb.driver.cluster - Cluster created with settings {hosts=[mongo:27017], mode=SINGLE, requiredClusterType=UNKNOWN, serverSelectionTimeout='30000 ms', maxWaitQueueSize=500}
2019-03-07 16:09:06,542 INFO : org.mongodb.driver.cluster - Cluster description not yet available. Waiting for 30000 ms before timing out
2019-03-07 16:09:06,563 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:1, serverValue:1}] to mongo:27017
2019-03-07 16:09:06,567 INFO : org.mongodb.driver.cluster - Monitor thread successfully connected to server with description ServerDescription{address=mongo:27017, type=STANDALONE, state=CONNECTED, ok=true, version=ServerVersion{versionList=[3, 6, 11]}, minWireVersion=0, maxWireVersion=6, maxDocumentSize=16777216, logicalSessionTimeoutMinutes=30, roundTripTimeNanos=2732359}
2019-03-07 16:09:06,579 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:2, serverValue:2}] to mongo:27017
2019-03-07 16:09:09,054 INFO : io.searchbox.client.AbstractJestClient - Setting server pool to a list of 1 servers: [http://elasticsearch:9200]
2019-03-07 16:09:09,054 INFO : io.searchbox.client.JestClientFactory - Using multi thread/connection supporting pooling connection manager
2019-03-07 16:09:09,130 INFO : io.searchbox.client.JestClientFactory - Using custom ObjectMapper instance
2019-03-07 16:09:09,130 INFO : io.searchbox.client.JestClientFactory - Node Discovery disabled...
2019-03-07 16:09:09,130 INFO : io.searchbox.client.JestClientFactory - Idle connection reaping disabled...
2019-03-07 16:09:10,457 INFO : org.graylog2.shared.buffers.ProcessBuffer - Initialized ProcessBuffer with ring size <65536> and wait strategy <BlockingWaitStrategy>.
2019-03-07 16:09:11,109 WARN : org.graylog.plugins.map.geoip.GeoIpResolverEngine - GeoIP database file does not exist: /etc/graylog/server/GeoLite2-City.mmdb
2019-03-07 16:09:11,123 INFO : org.graylog2.buffers.OutputBuffer - Initialized OutputBuffer with ring size <65536> and wait strategy <BlockingWaitStrategy>.
2019-03-07 16:09:11,144 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:3, serverValue:3}] to mongo:27017
2019-03-07 16:09:11,164 WARN : org.graylog.plugins.map.geoip.GeoIpResolverEngine - GeoIP database file does not exist: /etc/graylog/server/GeoLite2-City.mmdb
2019-03-07 16:09:11,200 WARN : org.graylog.plugins.map.geoip.GeoIpResolverEngine - GeoIP database file does not exist: /etc/graylog/server/GeoLite2-City.mmdb
2019-03-07 16:09:11,220 WARN : org.graylog.plugins.map.geoip.GeoIpResolverEngine - GeoIP database file does not exist: /etc/graylog/server/GeoLite2-City.mmdb
2019-03-07 16:09:11,239 WARN : org.graylog.plugins.map.geoip.GeoIpResolverEngine - GeoIP database file does not exist: /etc/graylog/server/GeoLite2-City.mmdb
2019-03-07 16:09:12,307 INFO : org.graylog2.users.RoleServiceImpl - Admin role is missing or invalid, re-adding it as a built-in role.
2019-03-07 16:09:12,376 INFO : org.graylog2.users.RoleServiceImpl - Reader role is missing or invalid, re-adding it as a built-in role.
2019-03-07 16:09:16,480 INFO : org.graylog2.bootstrap.ServerBootstrap - Graylog server 3.0.0+db6cf59 starting up
2019-03-07 16:09:16,481 INFO : org.graylog2.bootstrap.ServerBootstrap - JRE: Oracle Corporation 1.8.0_181 on Linux 4.15.0-45-generic
2019-03-07 16:09:16,481 INFO : org.graylog2.bootstrap.ServerBootstrap - Deployment: docker
2019-03-07 16:09:16,481 INFO : org.graylog2.bootstrap.ServerBootstrap - OS: Debian GNU/Linux 9 (stretch) (debian)
2019-03-07 16:09:16,481 INFO : org.graylog2.bootstrap.ServerBootstrap - Arch: amd64
2019-03-07 16:09:16,684 INFO : org.graylog2.shared.initializers.PeriodicalsService - Starting 27 periodicals ...
2019-03-07 16:09:16,685 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.ThroughputCalculator] periodical in [0s], polling every [1s].
2019-03-07 16:09:16,731 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog.plugins.pipelineprocessor.periodical.LegacyDefaultStreamMigration] periodical, running forever.
2019-03-07 16:09:16,753 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.AlertScannerThread] periodical in [10s], polling every [60s].
2019-03-07 16:09:16,757 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.BatchedElasticSearchOutputFlushThread] periodical in [0s], polling every [1s].
2019-03-07 16:09:16,758 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.ClusterHealthCheckThread] periodical in [120s], polling every [20s].
2019-03-07 16:09:16,760 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.GarbageCollectionWarningThread] periodical, running forever.
2019-03-07 16:09:16,760 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.IndexerClusterCheckerThread] periodical in [0s], polling every [30s].
2019-03-07 16:09:16,761 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.IndexRetentionThread] periodical in [0s], polling every [300s].
2019-03-07 16:09:16,769 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.IndexRotationThread] periodical in [0s], polling every [10s].
2019-03-07 16:09:16,771 INFO : org.graylog.plugins.pipelineprocessor.periodical.LegacyDefaultStreamMigration - Legacy default stream has no connections, no migration needed.
2019-03-07 16:09:16,775 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.NodePingThread] periodical in [0s], polling every [1s].
2019-03-07 16:09:16,786 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.VersionCheckThread] periodical in [300s], polling every [1800s].
2019-03-07 16:09:16,790 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.ThrottleStateUpdaterThread] periodical in [1s], polling every [1s].
2019-03-07 16:09:16,792 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.events.ClusterEventPeriodical] periodical in [0s], polling every [1s].
2019-03-07 16:09:16,795 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.events.ClusterEventCleanupPeriodical] periodical in [0s], polling every [86400s].
2019-03-07 16:09:16,798 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.ClusterIdGeneratorPeriodical] periodical, running forever.
2019-03-07 16:09:16,799 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.IndexRangesMigrationPeriodical] periodical, running forever.
2019-03-07 16:09:16,800 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.IndexRangesCleanupPeriodical] periodical in [15s], polling every [3600s].
2019-03-07 16:09:16,808 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:4, serverValue:4}] to mongo:27017
2019-03-07 16:09:16,815 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.UserPermissionMigrationPeriodical] periodical, running forever.
2019-03-07 16:09:16,822 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.AlarmCallbacksMigrationPeriodical] periodical, running forever.
2019-03-07 16:09:16,823 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.ConfigurationManagementPeriodical] periodical, running forever.
2019-03-07 16:09:16,833 INFO : org.graylog2.periodical.UserPermissionMigrationPeriodical - Marking user permission migration as done.
2019-03-07 16:09:16,837 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.LdapGroupMappingMigration] periodical, running forever.
2019-03-07 16:09:16,841 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.IndexFailuresPeriodical] periodical, running forever.
2019-03-07 16:09:16,843 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.periodical.TrafficCounterCalculator] periodical in [0s], polling every [1s].
2019-03-07 16:09:16,845 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog2.indexer.fieldtypes.IndexFieldTypePollerPeriodical] periodical in [0s], polling every [3600s].
2019-03-07 16:09:16,849 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog.plugins.sidecar.periodical.PurgeExpiredSidecarsThread] periodical in [0s], polling every [600s].
2019-03-07 16:09:16,849 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:5, serverValue:5}] to mongo:27017
2019-03-07 16:09:16,853 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog.plugins.sidecar.periodical.PurgeExpiredConfigurationUploads] periodical in [0s], polling every [600s].
2019-03-07 16:09:16,869 INFO : org.graylog2.periodical.Periodicals - Starting [org.graylog.plugins.collector.periodical.PurgeExpiredCollectorsThread] periodical in [0s], polling every [3600s].
2019-03-07 16:09:16,875 INFO : org.graylog2.migrations.V20151210140600_ElasticsearchConfigMigration - Migrated "elasticsearch_max_docs_per_index" setting: MessageCountRotationStrategyConfig{type=org.graylog2.indexer.rotation.strategies.MessageCountRotationStrategyConfig, maxDocsPerIndex=20000000}
2019-03-07 16:09:16,892 INFO : org.graylog2.migrations.V20151210140600_ElasticsearchConfigMigration - Migrated "elasticsearch_max_size_per_index" setting: SizeBasedRotationStrategyConfig{type=org.graylog2.indexer.rotation.strategies.SizeBasedRotationStrategyConfig, maxSize=1073741824}
2019-03-07 16:09:16,933 INFO : org.graylog2.migrations.V20151210140600_ElasticsearchConfigMigration - Migrated "elasticsearch_max_time_per_index" setting: TimeBasedRotationStrategyConfig{type=org.graylog2.indexer.rotation.strategies.TimeBasedRotationStrategyConfig, rotationPeriod=P1D}
2019-03-07 16:09:16,974 INFO : org.graylog2.migrations.V20151210140600_ElasticsearchConfigMigration - Migrated "elasticsearch_max_number_of_indices" setting: ClosingRetentionStrategyConfig{type=org.graylog2.indexer.retention.strategies.ClosingRetentionStrategyConfig, maxNumberOfIndices=20}
2019-03-07 16:09:16,997 INFO : org.graylog2.migrations.V20151210140600_ElasticsearchConfigMigration - Migrated "elasticsearch_max_number_of_indices" setting: DeletionRetentionStrategyConfig{type=org.graylog2.indexer.retention.strategies.DeletionRetentionStrategyConfig, maxNumberOfIndices=20}
2019-03-07 16:09:17,036 INFO : org.graylog2.migrations.V20151210140600_ElasticsearchConfigMigration - Migrated "rotation_strategy" and "retention_strategy" setting: IndexManagementConfig{rotationStrategy=org.graylog2.indexer.rotation.strategies.MessageCountRotationStrategy, retentionStrategy=org.graylog2.indexer.retention.strategies.DeletionRetentionStrategy}
2019-03-07 16:09:17,046 INFO : org.graylog2.migrations.V20151210140600_ElasticsearchConfigMigration - Creating searches cluster config: SearchesClusterConfig{queryTimeRangeLimit=PT0S, relativeTimerangeOptions={PT5M=Search in the last 5 minutes, PT15M=Search in the last 15 minutes, PT30M=Search in the last 30 minutes, PT1H=Search in the last 1 hour, PT2H=Search in the last 2 hours, PT8H=Search in the last 8 hours, P1D=Search in the last 1 day, P2D=Search in the last 2 days, P5D=Search in the last 5 days, P7D=Search in the last 7 days, P14D=Search in the last 14 days, P30D=Search in the last 30 days, PT0S=Search in all messages}, surroundingTimerangeOptions={PT1S=1 second, PT5S=5 seconds, PT10S=10 seconds, PT30S=30 seconds, PT1M=1 minute, PT5M=5 minutes}, surroundingFilterFields=[source, gl2_source_input, file, source_file], analysisDisabledFields=[message, full_message]}
2019-03-07 16:09:17,415 INFO : org.graylog2.shared.initializers.JerseyService - Enabling CORS for HTTP endpoint
2019-03-07 16:09:17,493 INFO : org.graylog2.migrations.V20161116172200_CreateDefaultStreamMigration - Successfully created default stream: All messages
2019-03-07 16:09:17,595 INFO : org.graylog2.migrations.V20161124104700_AddRetentionRotationAndDefaultFlagToIndexSetMigration - Adding rotation_strategy_class <org.graylog2.indexer.rotation.strategies.MessageCountRotationStrategy> to index set <5c81422d4cedfd000e63ee54>
2019-03-07 16:09:17,595 INFO : org.graylog2.migrations.V20161124104700_AddRetentionRotationAndDefaultFlagToIndexSetMigration - Adding retention_strategy_class <org.graylog2.indexer.retention.strategies.DeletionRetentionStrategy> to index set <5c81422d4cedfd000e63ee54>
2019-03-07 16:09:17,601 INFO : org.graylog2.migrations.V20161124104700_AddRetentionRotationAndDefaultFlagToIndexSetMigration - Setting index set <5c81422d4cedfd000e63ee54> as default
2019-03-07 16:09:17,756 INFO : org.graylog2.migrations.V20161125142400_EmailAlarmCallbackMigration - No streams needed to be migrated.
2019-03-07 16:09:17,815 INFO : org.graylog2.migrations.V20161125161400_AlertReceiversMigration - No streams needed to be migrated.
2019-03-07 16:09:18,143 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:6, serverValue:7}] to mongo:27017
2019-03-07 16:09:18,145 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:7, serverValue:6}] to mongo:27017
2019-03-07 16:09:18,143 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:8, serverValue:8}] to mongo:27017
2019-03-07 16:09:18,143 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:9, serverValue:9}] to mongo:27017
2019-03-07 16:09:18,164 WARN : org.graylog2.indexer.fieldtypes.IndexFieldTypePollerPeriodical - Active write index for index set "Default index set" (5c81422d4cedfd000e63ee54) doesn't exist yet
2019-03-07 16:09:18,177 ERROR: org.graylog.plugins.sidecar.migrations.V20180212165000_AddDefaultCollectors - Couldn't find collector 'filebeat on linux' fixing it.
2019-03-07 16:09:18,178 INFO : org.graylog.plugins.sidecar.migrations.V20180212165000_AddDefaultCollectors - filebeat collector on linux is missing, adding it.
2019-03-07 16:09:18,191 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:10, serverValue:10}] to mongo:27017
2019-03-07 16:09:18,336 ERROR: org.graylog.plugins.sidecar.migrations.V20180212165000_AddDefaultCollectors - Couldn't find collector 'winlogbeat on windows' fixing it.
2019-03-07 16:09:18,336 INFO : org.graylog.plugins.sidecar.migrations.V20180212165000_AddDefaultCollectors - winlogbeat collector on windows is missing, adding it.
2019-03-07 16:09:18,341 ERROR: org.graylog.plugins.sidecar.migrations.V20180212165000_AddDefaultCollectors - Couldn't find collector 'nxlog on linux' fixing it.
2019-03-07 16:09:18,342 INFO : org.graylog.plugins.sidecar.migrations.V20180212165000_AddDefaultCollectors - nxlog collector on linux is missing, adding it.
2019-03-07 16:09:18,353 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:11, serverValue:11}] to mongo:27017
2019-03-07 16:09:18,354 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:12, serverValue:12}] to mongo:27017
2019-03-07 16:09:18,357 ERROR: org.graylog.plugins.sidecar.migrations.V20180212165000_AddDefaultCollectors - Couldn't find collector 'nxlog on windows' fixing it.
2019-03-07 16:09:18,365 WARN : org.graylog2.indexer.fieldtypes.IndexFieldTypePollerPeriodical - Active write index for index set "Default index set" (5c81422d4cedfd000e63ee54) doesn't exist yet
2019-03-07 16:09:18,369 INFO : org.graylog.plugins.sidecar.migrations.V20180212165000_AddDefaultCollectors - nxlog collector on windows is missing, adding it.
2019-03-07 16:09:18,373 INFO : org.mongodb.driver.connection - Opened connection [connectionId{localValue:13, serverValue:13}] to mongo:27017
2019-03-07 16:09:18,395 INFO : org.graylog2.migrations.MigrationHelpers - Sidecar System (Internal) role is missing or invalid, re-adding it as a built-in role.
2019-03-07 16:09:18,407 ERROR: org.graylog2.migrations.MigrationHelpers - Invalid user 'graylog-sidecar', fixing it.
2019-03-07 16:09:18,407 INFO : org.graylog2.migrations.MigrationHelpers - graylog-sidecar user is missing or invalid, re-adding it as a built-in user.
2019-03-07 16:09:18,537 INFO : org.graylog.plugins.sidecar.migrations.V20180601151500_AddDefaultConfiguration - Creating Sidecar cluster config: SidecarConfiguration{sidecarExpirationThreshold=P14D, sidecarInactiveThreshold=PT1M, sidecarUpdateInterval=PT30S, sidecarSendStatus=true, sidecarConfigurationOverride=false}
2019-03-07 16:09:18,870 WARN : org.graylog2.indexer.fieldtypes.IndexFieldTypePollerPeriodical - Active write index for index set "Default index set" (5c81422d4cedfd000e63ee54) doesn't exist yet
2019-03-07 16:09:23,867 WARN : org.graylog2.indexer.fieldtypes.IndexFieldTypePollerPeriodical - Active write index for index set "Default index set" (5c81422d4cedfd000e63ee54) doesn't exist yet
2019-03-07 16:09:26,793 INFO : org.graylog2.indexer.MongoIndexSet - Did not find a deflector alias. Setting one up now.
2019-03-07 16:09:26,800 INFO : org.graylog2.indexer.MongoIndexSet - There is no index target to point to. Creating one now.
2019-03-07 16:09:26,809 INFO : org.graylog2.indexer.MongoIndexSet - Cycling from <none> to <graylog_0>.
2019-03-07 16:09:26,809 INFO : org.graylog2.indexer.MongoIndexSet - Creating target index <graylog_0>.
2019-03-07 16:09:27,036 INFO : org.graylog2.indexer.indices.Indices - Successfully created index template graylog-internal
2019-03-07 16:09:28,167 INFO : org.graylog2.indexer.MongoIndexSet - Waiting for allocation of index <graylog_0>.
2019-03-07 16:09:28,181 INFO : org.graylog2.indexer.MongoIndexSet - Index <graylog_0> has been successfully allocated.
2019-03-07 16:09:28,182 INFO : org.graylog2.indexer.MongoIndexSet - Pointing index alias <graylog_deflector> to new index <graylog_0>.
2019-03-07 16:09:28,258 INFO : org.graylog2.indexer.MongoIndexSet - Successfully pointed index alias <graylog_deflector> to index <graylog_0>.
2019-03-07 16:09:38,172 INFO : org.glassfish.grizzly.http.server.NetworkListener - Started listener bound to [127.0.0.1:9000]
2019-03-07 16:09:38,173 INFO : org.glassfish.grizzly.http.server.HttpServer - [HttpServer] Started.
2019-03-07 16:09:38,173 INFO : org.graylog2.shared.initializers.JerseyService - Started REST API at <127.0.0.1:9000>
2019-03-07 16:09:38,174 INFO : org.graylog2.shared.initializers.ServiceManagerListener - Services are healthy
2019-03-07 16:09:38,175 INFO : org.graylog2.shared.initializers.InputSetupService - Triggering launching persisted inputs, node transitioned from Uninitialized [LB:DEAD] to Running [LB:ALIVE]
2019-03-07 16:09:38,175 INFO : org.graylog2.bootstrap.ServerBootstrap - Services started, startup times in ms: {InputSetupService [RUNNING]=28, OutputSetupService [RUNNING]=52, BufferSynchronizerService [RUNNING]=63, KafkaJournal [RUNNING]=85, EtagService [RUNNING]=105, StreamCacheService [RUNNING]=105, ConfigurationEtagService [RUNNING]=113, JournalReader [RUNNING]=118, LookupTableService [RUNNING]=131, PeriodicalsService [RUNNING]=228, JerseyService [RUNNING]=21491}
2019-03-07 16:09:38,176 INFO : org.graylog2.bootstrap.ServerBootstrap - Graylog server up and running.

tks!

8

it running and healthy:

 ~ docker ps
CONTAINER ID        IMAGE                                                     COMMAND                  CREATED             STATUS                 PORTS                                                                    NAMES
d8ac9e1ac16e        graylog/graylog:3.0                                       "/docker-entrypoint.…"   4 hours ago         Up 4 hours (healthy)   0.0.0.0:514->514/tcp, 0.0.0.0:9000->9000/tcp, 0.0.0.0:12201->12201/tcp   graylog
177a79d734a4        docker.elastic.co/elasticsearch/elasticsearch-oss:6.5.4   "/usr/local/bin/dock…"   8 hours ago         Up 8 hours             9200/tcp, 9300/tcp                                                       elasticsearch
24b95b5c4172        mongo:3                                                   "docker-entrypoint.s…"   8 hours ago         Up 8 hours             27017/tcp                                                                mongo

used the commands from the quickstart guide: http://docs.graylog.org/en/3.0/pages/installation/docker.html#quick-start

$ docker run --name mongo -d mongo:3
$ docker run --name elasticsearch \
    -e "http.host=0.0.0.0" \
    -e "ES_JAVA_OPTS=-Xms512m -Xmx512m" \
    -d docker.elastic.co/elasticsearch/elasticsearch-oss:6.6.1
$ docker run --name graylog --link mongo --link elasticsearch \
    -p 9000:9000 -p 12201:12201 -p 1514:1514 \
    -e GRAYLOG_HTTP_EXTERNAL_URI="http://127.0.0.1:9000/" \
    -d graylog/graylog:3.0

(ok, adjusted the ports and the container name)

9

I found the problem!

I was not using the correct commands, missing the main line.
-e GRAYLOG_HTTP_EXTERNAL_URI="http://127.0.0.1:9000/" \

I realized that I was wrong when you showed your example, that it is working perfectly.

I honestly do not know why the commands I used are different from the site, it was a big mistake of mine.

Jan, thank you very much for all the explanations and patience in the answers.

Thank you!

1 Like
10

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.