Graylog 4 Install contentpack with parameters

Graylog Central (peer support)
1

Hi,
using graylog 4 I need to install a content pack using REST API like this

/system/content_packs/{contentPackId}/{revision}/installations

When I use it from swagger or REST API browser I have the problen to understand how set the parameters. I can use the parameter default values.
If I leave the textarea empty I have the follor error:

image
image774×293 8.08 KB

So I don’t know the parameters json structure as the model shema say:
image

Somebody can help me?
the parameters are:

“parameters”: [
{
“name”: “locale”,
“title”: “Locale”,
“description”: “Locale used for time data ingestion”,
“type”: “string”,
“default_value”: “EN”
},
{
“name”: “timezone”,
“title”: “Timezone”,
“description”: “the timezone used for data event ingestion”,
“type”: “string”,
“default_value”: “UTC”
}
]

Is there a simple way to use the default values too?

Thanks
Gianluca

2

Hi @gianluca-valentini,
format for parameters:

{
"parameters":
{
"parameter1":{"@type":"string","@value":"EN"},
"parameter2":{"@type":"integer","@value":10},
"parameter3":{"@type":"boolean","@value":false}
"parameter4":{"@type":"double","@value":0.1}
},
"comment":"comment string"}
}

Hope it helps you.

3

Great!
thank you very much, I really appreciated it

4

Ok it works fine.
Now I have this particular problem:
ContentPack creation and installation work fine but I have this problem on the input view

image
image897×390 40.4 KB

Looking the Graylog log I see:

image
image1251×290 139 KB

If I create another input using the UI it works fine

image
image1240×600 35.2 KB

I’m sure that the 12201 is not used. If I restart the application it become green

image
image996×506 27.8 KB

someone can help me to understand what happened?

5

Hi, does you content pack contains input with parameter? Did you remove exported input to content pack before install?

6

Hi the input contains some static fields. And I didn’t remove input from content pack as I have to install them. Is there something wrong?

7

If you have exported input to content pack, I think you have to delete it before install content pack.

8

So I cannot install them using content pack?

9

Yes you can install them, but you can’t replace them when they already exists, so this probably create your problems.

10

You are right,
but this problem happens on a new Graylog installation. So I’m sure that the input does not exist.
This is the strange behavior.
If I restart the appliance, the input that after content pack input were red, become green.

So it seems something related with the content-pack import

11

The problem is the

[POST]/system/content_packs/{contentPackId}/{revision}/installations

after that, the input does not start or start with fail status giving address already in use. If I restart Graylog, the input does not fail anymore

Any suggestions?

12

I’ve tried it and it works fine for me. I created content pack with input and install it using curl and resp api, and input started as desired. So probably you have already started (something listening on the same port) some services in that port or started 2 inputs with same port?

13

Thanks @shoothub
I tried a new empty installation. Then using graylog node API I imported my content pack (with input) and the I installed it

image
image1787×407 32.9 KB

This is what i see in the input view
Then if I start the input I have the follow error:

image
image1750×363 35.6 KB

Caused by: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2021-05-18T15:19:21.142Z INFO [InputStateListener] Input [GELF TCP/60a3d9efe7651b64a50cc77c] is now FAILED

Can you help me to understand if the port is already used? because the strange thing is that if I restart Graylog it become geen and started

14

Hi @gianluca-valentini
small note, why you use Beats (deprecated) input, which is old and deprecated, so not used anymore?

15

Hi @shoothub
the deprecated input comes from the Graylog migration.
I currently need to migrate from 2.5.2 to the last 4.
The content pack import is required for devel environment to client test one

16

Hello I’ve tried import content pack and install it using curl in clear version of graylog OVA 4.0.7 and everything worked as expected, input started correctly with status was Running.

How did you configure your graylog box, what type of installation do you use? Docker or standalone version on Debian/Ubuntu, CentOS?

Check also your listening ports before installing content pack to check if nothing is listening in used port in input with command:
ss -tulpn

17

Hi @shoothub
currently I’m using graylog OVA 4.0.7.
Now I have an empty environment where I delete all input

image
image1661×122 18 KB

using the command ss-tulpn I see something strange

image
image1280×453 104 KB

Because there are some old input port 12201 used without configured inputs
So this is a first strange thing

Then I restart Graylog. No input, no Stream (empty configuration) and this is the ss -tulpn output

image
image1280×265 72.8 KB

Then I create and install my content-pack (without parameters but with required inputs)

Content pack is uploaded with success but looking the input I see

image
image481×517 24.6 KB

running ss -tulpn

image
image1280×471 117 KB

When I try to start the input I have and error:
image

where the log say

2021-05-19T13:04:51.627Z WARN [AbstractTcpTransport] Failed to start channel for input BeatsInput{title=AX-Beat, type=org.graylog.plugins.beats.BeatsInput, nodeId=null}
io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2021-05-19T13:04:51.627Z ERROR [InputLauncher] The [org.graylog.plugins.beats.BeatsInput] input with ID <60a50c20a010fd30e2204d1a> misfired. Reason: bind(…) failed: Address already in use.
org.graylog2.plugin.inputs.MisfireException: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:158) ~[graylog.jar:?]
at org.graylog2.shared.inputs.InputLauncher$1.run(InputLauncher.java:84) [graylog.jar:?]
at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:180) [graylog.jar:?]
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511) [?:1.8.0_292]
at java.util.concurrent.FutureTask.run(FutureTask.java:266) [?:1.8.0_292]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [?:1.8.0_292]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [?:1.8.0_292]
at java.lang.Thread.run(Thread.java:748) [?:1.8.0_292]
Caused by: org.graylog2.plugin.inputs.MisfireException: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
at org.graylog2.plugin.inputs.transports.AbstractTcpTransport.launch(AbstractTcpTransport.java:199) ~[graylog.jar:?]
at org.graylog2.plugin.inputs.MessageInput.launch(MessageInput.java:155) ~[graylog.jar:?]
… 7 more
Caused by: io.netty.channel.unix.Errors$NativeIoException: bind(…) failed: Address already in use
2021-05-19T13:04:51.631Z INFO [InputStateListener] Input [Beats (deprecated)/60a50c20a010fd30e2204d1a] is now FAILED

At the end the strange, very strange, situation is that is I restart Graylog, I don’t have input error anymore

18

That’s strange behaviour, because you have no input but ports are still listening. I think thats the problem, why are input not started after import.

19

I agree. So do you have any suggestions?
I don’t know how to complete my task

It seems an import bug but I’m not sure. This should be a big problem for everyone but I don’t find anything about it

What I can do?

20

I don’t think it’s a bug, because it works with clear OVA install. Did you create/import/stop/delete some inputs before importing content pack? Did you upgrade from older version?