Graylog couldn't execute search

(Nimol) #1

Hi all,

Suddenly this happened to my Graylog. When I open the Web interface I am getting -

Error Message:
Unable to perform search query.
Search status code:
Search response:
cannot GET (500)

_and this is my current show-config result _

Starting Chef Client, version 12.6.0
Compiling Cookbooks…
_ “graylog”: {_
_ “bootstrap”: {_
_ “bootstrapped”: false_
_ },_
_ “etcd”: {_
_ “enabled”: true_
_ },_
_ “nginx”: {_
_ “enabled”: true_
_ },_
_ “mongodb”: {_
_ “enabled”: true_
_ },_
_ “elasticsearch”: {_
_ “enabled”: false_
_ },_
_ “graylog-server”: null_
_ }_
Converging 0 resources

can anyone help me to fix this?

(Jochen) #2

What’s in the logs of your Graylog and Elasticsearch nodes?

(Jochen) #4

Please provide the complete logs, not just arbitrary snippets.

(Jochen) #6

These are the logs of Elasticsearch. What about the logs of Graylog?

(Jochen) #8


Please post the complete logs.

(Nimol) #10

it’s about 8000 lines! would you really like to have all of them?

(Nimol) #11

I think my elasticsearch is not working! when I try to curl -XGET ‘localhost:9200’ I get : curl: (7) Failed to connect to localhost port 9200: Connection refused!

(Jochen) #12

Yes, that’s expected since the Elasticsearch service is disabled (see your first post).

(Jochen) #13

No, I’d like to have only the relevant pieces. But since neither you nor I know which parts are relevant, post everything (within a sensible range - I don’t care about logs from last week).

(Jochen) #15

Please use proper formatting for your post next time you want to share a large text snippet.



(Jochen) #16

How exactly did you configure the OVA?
Do you want Elasticsearch to run on another machine?
Is that machine accessible?

(Nimol) #17

I just import the OVA file into my VM cluster. No I want to have elastic on same machine.
It was working until today about 13:00 o’clock.
No it is not accessible!

(Jochen) #18

Try running the following command to reenable all services (including Elasticsearch):

sudo graylog-ctl enable-all-services

(Nimol) #19

I did try this solution before before but no result!

(Jochen) #20

What’s the content of /etc/graylog/graylog-services.json inside the virtual machine?

(Nimol) #21

It looks good.

“etcd”: {
“enabled”: true
“nginx”: {
“enabled”: true
“mongodb”: {
“enabled”: true
“elasticsearch”: {
“enabled”: true
“graylog_server”: {
“enabled”: true

(Nimol) #22

i think it’s going to be okay because my node ist trying to process 1,999,396 unprocessed messages. and after that should work again.

(Nimol) #23

Somehow my Server is working like a charm! :grinning:

(Nimol) #24

What I learned from this issue:

When Journal utilization is too high Live search result won’t work.

my solution: to make it funktionale have to stop inputs and let the Graylog to process the unprocessed messages.
After all messages are processed the search would work again.:star_struck:

(system) #25

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.