# Graylog couldn't execute search

**URL:** <https://community.graylog.org/t/graylog-couldnt-execute-search/2181>\
**Category:** Graylog Central (peer support)\
**Created:** [August 22, 2017, 11:58am UTC](https://community.graylog.org/t/graylog-couldnt-execute-search/2181 "2017-08-22T11:58:06Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![nimolvanpersien](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/nimolvanpersien/32/324_2.png) [@nimolvanpersien](https://community.graylog.org/u/nimolvanpersien)\
**Post date:** [August 22, 2017, 11:58am UTC](https://community.graylog.org/t/graylog-couldnt-execute-search/2181/1 "2017-08-22T11:58:07Z")

</div>

Hi all,

Suddenly this happened to my Graylog. When I open the Web interface I am getting -

_Error Message:_  
_Unable to perform search query._  
_Details:_  
_Search status code:_  
_500_  
_Search response:_  
_cannot GET [https://10.50.10.10:443/api/search/universal/relative?query=gl2\_source\_input%3A5992e8e41bcc9403b6eb20be&range=0&limit=150&sort=timestamp%3Adesc](https://10.50.10.10:443/api/search/universal/relative?query=gl2_source_input%3A5992e8e41bcc9403b6eb20be&range=0&limit=150&sort=timestamp%3Adesc) (500)_

\_and this is my current show-config result \_

_Starting Chef Client, version 12.6.0_  
_Compiling Cookbooks…_  
_{_  
\_ “graylog”: {\_  
\_ “bootstrap”: {\_  
\_ “bootstrapped”: false\_  
\_ },\_  
\_ “etcd”: {\_  
\_ “enabled”: true\_  
\_ },\_  
\_ “nginx”: {\_  
\_ “enabled”: true\_  
\_ },\_  
\_ “mongodb”: {\_  
\_ “enabled”: true\_  
\_ },\_  
\_ “elasticsearch”: {\_  
\_ “enabled”: false\_  
\_ },\_  
\_ “graylog-server”: null\_  
\_ }\_  
_}_  
_Converging 0 resources_

can anyone help me to fix this?

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [August 22, 2017, 12:19pm UTC](https://community.graylog.org/t/graylog-couldnt-execute-search/2181/2 "2017-08-22T12:19:44Z")

</div>

What’s in the logs of your Graylog and Elasticsearch nodes?  
[http://docs.graylog.org/en/2.3/pages/configuration/file\_location.html#omnibus-package](http://docs.graylog.org/en/2.3/pages/configuration/file_location.html#omnibus-package)

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [August 22, 2017, 12:54pm UTC](https://community.graylog.org/t/graylog-couldnt-execute-search/2181/4 "2017-08-22T12:54:56Z")

</div>

Please provide _the complete logs_, not just arbitrary snippets.

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [August 22, 2017, 12:59pm UTC](https://community.graylog.org/t/graylog-couldnt-execute-search/2181/6 "2017-08-22T12:59:12Z")

</div>

These are the logs of Elasticsearch. What about the logs of Graylog?

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [August 22, 2017, 1:08pm UTC](https://community.graylog.org/t/graylog-couldnt-execute-search/2181/8 "2017-08-22T13:08:01Z")

</div>

Really?

Please post the complete logs.

---

<div class="post-metadata">

**Author:** ![nimolvanpersien](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/nimolvanpersien/32/324_2.png) [@nimolvanpersien](https://community.graylog.org/u/nimolvanpersien)\
**Post date:** [August 22, 2017, 1:08pm UTC](https://community.graylog.org/t/graylog-couldnt-execute-search/2181/10 "2017-08-22T13:08:33Z")

</div>

it’s about 8000 lines! would you really like to have all of them?

---

<div class="post-metadata">

**Author:** ![nimolvanpersien](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/nimolvanpersien/32/324_2.png) [@nimolvanpersien](https://community.graylog.org/u/nimolvanpersien)\
**Post date:** [August 22, 2017, 1:19pm UTC](https://community.graylog.org/t/graylog-couldnt-execute-search/2181/11 "2017-08-22T13:19:15Z")

</div>

I think my elasticsearch is not working! when I try to curl -XGET ‘localhost:9200’ I get : curl: (7) Failed to connect to localhost port 9200: Connection refused!

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [August 22, 2017, 1:40pm UTC](https://community.graylog.org/t/graylog-couldnt-execute-search/2181/12 "2017-08-22T13:40:48Z")

</div>

Yes, that’s expected since the Elasticsearch service is disabled (see your first post).

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [August 22, 2017, 1:41pm UTC](https://community.graylog.org/t/graylog-couldnt-execute-search/2181/13 "2017-08-22T13:41:38Z")

</div>

No, I’d like to have only the relevant pieces. But since neither you nor I know which parts are relevant, post everything (within a sensible range - I don’t care about logs from last week).

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [August 22, 2017, 2:05pm UTC](https://community.graylog.org/t/graylog-couldnt-execute-search/2181/15 "2017-08-22T14:05:33Z")

</div>

Please use proper formatting for your post next time you want to share a large text snippet.  
[http://commonmark.org/help/](http://commonmark.org/help/)

Example:

````
```
Text
```
````

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [August 22, 2017, 2:06pm UTC](https://community.graylog.org/t/graylog-couldnt-execute-search/2181/16 "2017-08-22T14:06:01Z")

</div>

How exactly did you configure the OVA?  
Do you _want_ Elasticsearch to run on another machine?  
Is that machine accessible?

---

<div class="post-metadata">

**Author:** ![nimolvanpersien](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/nimolvanpersien/32/324_2.png) [@nimolvanpersien](https://community.graylog.org/u/nimolvanpersien)\
**Post date:** [August 22, 2017, 2:12pm UTC](https://community.graylog.org/t/graylog-couldnt-execute-search/2181/17 "2017-08-22T14:12:38Z")

</div>

I just import the OVA file into my VM cluster. No I want to have elastic on same machine.  
It was working until today about 13:00 o’clock.  
No it is not accessible!

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [August 22, 2017, 2:22pm UTC](https://community.graylog.org/t/graylog-couldnt-execute-search/2181/18 "2017-08-22T14:22:13Z")

</div>

Try running the following command to reenable all services (including Elasticsearch):

```
sudo graylog-ctl enable-all-services
```

---

<div class="post-metadata">

**Author:** ![nimolvanpersien](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/nimolvanpersien/32/324_2.png) [@nimolvanpersien](https://community.graylog.org/u/nimolvanpersien)\
**Post date:** [August 22, 2017, 2:26pm UTC](https://community.graylog.org/t/graylog-couldnt-execute-search/2181/19 "2017-08-22T14:26:46Z")

</div>

I did try this solution before before but no result!

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [August 22, 2017, 2:31pm UTC](https://community.graylog.org/t/graylog-couldnt-execute-search/2181/20 "2017-08-22T14:31:23Z")

</div>

What’s the content of `/etc/graylog/graylog-services.json` inside the virtual machine?

---

<div class="post-metadata">

**Author:** ![nimolvanpersien](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/nimolvanpersien/32/324_2.png) [@nimolvanpersien](https://community.graylog.org/u/nimolvanpersien)\
**Post date:** [August 22, 2017, 2:40pm UTC](https://community.graylog.org/t/graylog-couldnt-execute-search/2181/21 "2017-08-22T14:40:09Z")

</div>

It looks good.

{  
“etcd”: {  
“enabled”: true  
},  
“nginx”: {  
“enabled”: true  
},  
“mongodb”: {  
“enabled”: true  
},  
“elasticsearch”: {  
“enabled”: true  
},  
“graylog\_server”: {  
“enabled”: true  
}  
}

---

<div class="post-metadata">

**Author:** ![nimolvanpersien](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/nimolvanpersien/32/324_2.png) [@nimolvanpersien](https://community.graylog.org/u/nimolvanpersien)\
**Post date:** [August 22, 2017, 2:42pm UTC](https://community.graylog.org/t/graylog-couldnt-execute-search/2181/22 "2017-08-22T14:42:27Z")

</div>

i think it’s going to be okay because my node ist trying to process 1,999,396 unprocessed messages. and after that should work again.

---

<div class="post-metadata">

**Author:** ![nimolvanpersien](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/nimolvanpersien/32/324_2.png) [@nimolvanpersien](https://community.graylog.org/u/nimolvanpersien)\
**Post date:** [August 23, 2017, 6:22am UTC](https://community.graylog.org/t/graylog-couldnt-execute-search/2181/23 "2017-08-23T06:22:28Z")

</div>

Somehow my Server is working like a charm! 😀

---

<div class="post-metadata">

**Author:** ![nimolvanpersien](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/nimolvanpersien/32/324_2.png) [@nimolvanpersien](https://community.graylog.org/u/nimolvanpersien)\
**Post date:** [August 23, 2017, 8:03am UTC](https://community.graylog.org/t/graylog-couldnt-execute-search/2181/24 "2017-08-23T08:03:49Z")

</div>

What I learned from this issue:

When Journal utilization is too high Live search result won’t work.

my solution: to make it funktionale have to stop inputs and let the Graylog to process the unprocessed messages.  
After all messages are processed the search would work again.🤩

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [September 6, 2017, 8:03am UTC](https://community.graylog.org/t/graylog-couldnt-execute-search/2181/25 "2017-09-06T08:03:59Z")

</div>

Closed on September 6, 2017, 8:03am UTC

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.