Graylog 7.1 – Input failures on a single node and Extractors UI broken after upgrade from 6.3 to 7.1

Graylog Central (peer support)
1

1. Description of the incident

I have upgraded all my Graylog nodes from Graylog Open 6.3 to 7.1, following the recommended path via 7.0, as suggested in the documentation.

Before proceeding with the second upgrade step, I performed general functional checks and everything appeared to be working correctly.

After completing the upgrade, I noticed an issue affecting only one node. Thanks to the new UI, I can now see that one specific input reports several “input failures”.

To troubleshoot this:

  • I checked the Pipelines, but could not find any configured pipelines that might explain the failures.

  • I then tried to access the Extractors for that input, but the Extractors page does not load.

  • I extended the check to all extractors on all inputs across all nodes, and none of the Extractors pages load anymore.

2. Environment details

  • OS: Ubuntu 22.04

  • Deployment: Docker Swarm

  • Graylog version: 7.1

  • MongoDB version: 7.0

  • OpenSearch version: 2.19.4

Logs and errors:
I could not find any clear or specific error messages related to this issue in the Graylog, MongoDB, or OpenSearch container logs.
The only visible symptom is thousands of “Message failed to process” errors, and affecting only that single input on one node.

3. Troubleshooting already performed

  • Tested the UI using two different browsers

  • Checked behavior across seven different Graylog nodes

  • Reviewed logs of all relevant containers (Graylog, MongoDB, OpenSearch)

  • Checked breaking changes for each upgrade not finding any issue on that list

None of these steps changed the behavior or surfaced a clear error explaining why Extractors are not loading.

4. How the community can help

I would like to understand why the input is running with all those processing errors and why the Extractors pages are no longer accessible after the upgrade.

I’m happy to provide sanitized debug logs or additional diagnostics—just let me know what to collect and how so I can share the relevant information.

2

Hello @soc,

Its a regression and a fix is already in the works here.

Perhaps this could be an excuse to move any processing occurring within extractors to pipelines and rules.

3

Thanks very much for the quick response.
I actually ended up reaching the same conclusion after debugging the issue myself on the frontend side.

I’ll keep an eye on upcoming updates and patches. Hopefully this fix can be included in a release soon. As you mentioned, since this issue seems to reappear over time, it might indicate a broader underlying problem that would benefit from a more structural solution to prevent regressions in the future.

Cheers.

“Manage extractors” button adds extra “/undefined/”

4

@soc