Hello community,
I am installing a graylog cluster using the following architecture.
My software versions:
CentOS 8
graylog 4.0.5
mongo 4.4.4
elastic 7.10.1
nginx 1.14.1
My configurations:
GRAYLOG1
ip: 192.168.1.8
hostname: graylog01
config:
is_master = true
http_bind_address = 192.168.1.8:9000
http_publish_uri = http://$http_bind_address/
rest_listen_uri = http://192.168.1.8:9000/api
http_external_uri = http://graylog.mydomain.net/
trusted_proxies = 192.168.1.12/32
GRAYLOG2
ip: 192.168.1.15
hostname: graylog02
config:
is_master = false
http_bind_address = 192.168.1.15:9000
http_publish_uri = http://$http_bind_address/
rest_listen_uri = http://192.168.1.15:9000/api/
http_external_uri = http://graylog.mydomain.net/
trusted_proxies = 192.168.1.12/32
GRAYLOG3
ip: 192.168.1.16
hostname: graylog03
config:
is_master = false
http_bind_address = 192.168.1.16:9000
http_publish_uri = http://$http_bind_address/
rest_listen_uri = http://192.168.1.16:9000/api/
http_external_uri = http://graylog.mydomain.net/
trusted_proxies = 192.168.1.12/32
nginx
ip: 192.168.1.12
hostname: graylog
config:
stream {
upstream cluster_syslog {
server 192.168.1.8:514;
server 192.168.1.15:514;
server 192.168.1.16:514;
}
server {
listen 192.168.1.12:514 udp;
proxy_timeout 10s;
proxy_pass cluster_syslog;
}
}
http {
upstream cluster_http {
server 192.168.1.8:9000 max_fails=3 fail_timeout=30s;
server 192.168.1.15:9000 max_fails=3 fail_timeout=30s;
server 192.168.1.16:9000 max_fails=3 fail_timeout=30s;
}
server {
listen 192.168.1.12:80;
server_name graylog.mydomain.net;
location /
{
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Graylog-Server-URL http://$server_name/;
proxy_pass http://cluster_http;
}
}
}
Http requests to the graylog cluster or syslog messages are reaching the servers correctly.
The problem is in accessing the api.
When I access http://graylog.mydomain.net/system/nodes it identifies the 3 nodes but with the information
“System information is currently unavailable.”
Acessing http://graylog.mydomain.net/system/overview identifies the cluster ID as well as the indication that it has 3 active members.
On the servers I have the following errors (on each member)
WARN [ProxiedResource] Unable to call http://api/system/metrics/multiple on node : api: Name or service not known
WARN [ProxiedResource] Unable to call http://api/system/metrics/multiple on node : api
Yes, without a FQDN or IP.
I have been searching but until now all attempts have always resulted in this problem.
Does anyone have a tip to point in the right direction?
Thank you all so much for your time.
