Try commenting out your MongoDB_uri in your graylog server.conf and replace with the above.
1 Like
http_external_uri = http://192.168.1.47:9000 # Uncomment this line in server.conf file
In the mongod.conf
#network interfaces
net:
port: 27017
bindIp: 0.0.0.0
/var/log/graylog-server/server.log
Just tried and same error. I stopped both services and restarted them. I tried with the browser on the machine as well as one off. Using my internal IP as well as 127.0.0.0:9000
Same error. Restarted both services and tried from the browser on the machine.
Here is what my server config looks like now:
is_leader = true
node_id_file = /etc/graylog/server/node-id
password_secret = ************************************
root_password_sha2 = *********************************
root_timezone = America/New_York
bin_dir = /usr/share/graylog-server/bin
data_dir = /var/lib/graylog-server
plugin_dir = /usr/share/graylog-server/plugin
http_bind_address = 192.168.1.47:9000
http_enable_cors = true
stream_aware_field_types=false
elasticsearch_hosts = http://node1:9200,http://user:password@node2:19200
rotation_strategy = count
elasticsearch_max_docs_per_index = 20000000
elasticsearch_max_number_of_indices = 20
retention_strategy = delete
elasticsearch_shards = 4
elasticsearch_replicas = 0
elasticsearch_index_prefix = graylog
allow_leading_wildcard_searches = false
allow_highlighting = false
elasticsearch_analyzer = standard
output_batch_size = 500
output_flush_interval = 1
output_fault_count_threshold = 5
output_fault_penalty_seconds = 30
processbuffer_processors = 5
outputbuffer_processors = 3
processor_wait_strategy = blocking
ring_size = 65536
inputbuffer_ring_size = 65536
inputbuffer_processors = 2
inputbuffer_wait_strategy = blocking
message_journal_enabled = true
message_journal_dir = /var/lib/graylog-server/journal
lb_recognition_period_seconds = 3
mongodb_uri = mongodb://localhost/graylog
mongodb_max_connections = 1000`Preformatted text`
Here is what my mongod.conf looks like:
storage:
dbPath: /var/lib/mongodb
journal:
enabled: true
systemLog:
destination: file
logAppend: true
path: /var/log/mongodb/mongod.log
net:
port: 27017
bindIp: 0.0.0.0
processManagement:
timeZoneInfo: /usr/share/zoneinfo
Any change in your Graylog Server log?
Nothing other than was has been listed here.
@Machiste , did you see this other forum post with a similar issue?
Might be worth a shot!
1 Like
Yep I tried this change as well and still no luck. 
Hey @Machiste
I did a mockup with your address. GL 5.x, on Ubuntu 22.0.4
Before installing Graylog and components. I adjusted my network config.
hosts_file
root@ansible:/etc/graylog/server# cat /etc/hosts | egrep -v "^\s*(#|$)"
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.1.47 <hostname_goes here>
root@ansible:/etc/graylog/server#
Graylog_config
root@ansible:/etc/graylog/server# cat /etc/graylog/server/server.conf | egrep -v "^\s*(#|$)"
is_leader = true
node_id_file = /etc/graylog/server/node-id
password_secret =d76m0mosVK79CFSTdgO4CfhgNyDXJh1sM
root_password_sha2 =ef92b778bafe771e89245b89ecbc08a4
bin_dir = /usr/share/graylog-server/bin
data_dir = /var/lib/graylog-server
plugin_dir = /usr/share/graylog-server/plugin
http_bind_address = 192.168.1.47:9000
elasticsearch_hosts = http://127.0.0.1:9200
rotation_strategy = count
elasticsearch_max_docs_per_index = 20000000
elasticsearch_max_number_of_indices = 20
retention_strategy = delete
elasticsearch_shards = 4
elasticsearch_replicas = 0
elasticsearch_index_prefix = graylog
allow_leading_wildcard_searches = false
allow_highlighting = false
elasticsearch_analyzer = standard
output_batch_size = 500
output_flush_interval = 1
output_fault_count_threshold = 5
output_fault_penalty_seconds = 30
processbuffer_processors = 5
outputbuffer_processors = 3
processor_wait_strategy = blocking
ring_size = 65536
inputbuffer_ring_size = 65536
inputbuffer_processors = 2
inputbuffer_wait_strategy = blocking
message_journal_enabled = true
message_journal_dir = /var/lib/graylog-server/journal
lb_recognition_period_seconds = 3
mongodb_uri = mongodb://127.0.0.1:27017/graylog
mongodb_max_connections = 1000
mongodb_threads_allowed_to_block_multiplier = 5
transport_email_enabled = true
transport_email_hostname = localhost
transport_email_port = 25
transport_email_subject_prefix = [graylog]
transport_email_from_email = root@enseva-labs.net
transport_email_web_interface_url = http://10.200.6.28
proxied_requests_thread_pool_size = 32
skip_preflight_checks = true
root@ansible:/etc/graylog/server#
Opensearch_Config
root@ansible:/etc/graylog/server# cat /etc/opensearch/opensearch.yml | egrep -v "^\s*(#|$)"
cluster.name: graylog
path.data: /var/lib/opensearch
path.logs: /var/log/opensearch
network.host: 127.0.0.1
http.port: 9200
plugins.security.disabled: true
discovery.type: single-node
bootstrap.memory_lock: true
action.auto_create_index: false
root@ansible:/etc/graylog/server#
Mongo_config
root@ansible:/etc/graylog/server# cat /etc/mongod.conf | egrep -v "^\s*(#|$)"
storage:
dbPath: /var/lib/mongodb
journal:
enabled: true
systemLog:
destination: file
logAppend: true
path: /var/log/mongodb/mongod.log
net:
port: 27017
bindIp: 127.0.0.1
processManagement:
timeZoneInfo: /usr/share/zoneinfo
root@ansible:/etc/graylog/server#
For troubleshoouting I have Disable Firewall, Disable Apparmor. Ensure ensure Graylog can access the correct files and directories.
I used this link below to install Graylog && MongoDb
I used these instructions to install Opensearch.
NOTE: I had to follow some of Graylog Documention for configuring opensearch, specially disabling Security plugin.
Question:
For my opensearch.yml has the following:
My node.name is $vm-moe02
My network.host is $vm-moe02
This is what the install instructions has with the $ plus the host name. Should I change it to the 127.0.0.1?
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.