Graylog HA - Failed to call API on node

dawidsniegon · March 7, 2025, 12:59pm

1. Describe your incident:

2025-03-07 10:57:17,856 WARN : org.graylog2.shared.rest.resources.ProxiedResource - Failed to call API on node <4cafb399-387b-4b90-9116-2f7deac188b2>, cause: timeout (duration: 1003 ms)
2025-03-07 10:57:19,865 WARN : org.graylog2.shared.rest.resources.ProxiedResource - Failed to call API on node <4cafb399-387b-4b90-9116-2f7deac188b2>, cause: timeout (duration: 1002 ms)
2025-03-07 10:57:20,479 WARN : org.graylog2.shared.rest.resources.ProxiedResource - Failed to call API on node <4cafb399-387b-4b90-9116-2f7deac188b2>, cause: timeout (duration: 5001 ms)

I have set up Graylog in HA mode according to guides at:
Graylog-Cluster-Docker-Swarm/README.md at main · s0p4L1n3/Graylog-Cluster-Docker-Swarm

I made only tiny tweaks to the whole set up that would fit my current server architecture.

The config files for all 3 Graylog instances are the default config files and the only config changes come with env variables set in the docker stack yaml file, as per: Graylog-Cluster-Docker-Swarm/docker-stack-with-Traefik.yml at main · s0p4L1n3/Graylog-Cluster-Docker-Swarm

When deploying the cluster, graylog nodes connect RANDOMLY. Meaning, sometimes when deploying the stack only 1 node is connected, sometimes 2, sometimes all 3. On the /system/nodes, the unavailable node(s) appear, but with message “System information is currently unavailable.”, and when trying to open node info page, I get errors:
1)
Could not get plugins
Getting plugins on node “4cafb399-387b-4b90-9116-2f7deac188b2” failed: FetchError: There was an error fetching a resource: . Additional information: timeout
2)
Could not get JVM information
Getting JVM information for node ‘4cafb399-387b-4b90-9116-2f7deac188b2’ failed: FetchError: There was an error fetching a resource: . Additional information: timeout

2. Describe your environment:

OS Information:
All 3 VMs are set up exactly the same way.
NAME=“AlmaLinux”
VERSION=“9.5 (Teal Serval)”
Package Version:
Docker v. 27.4.1
GlusterFS v. 11.1
Keepalived v. 2.2.8
Traefik v. 3.3.2 (image traefik:3.3.2)
MongoDB v. 7.0.14 (image mongo:7.0.14)
OpenSearch v. 2.15.0 (image opensearchproject/opensearch:2.15.0)
Graylog v. 6.1.5 (image graylog/graylog:6.1.5)
Service logs, configurations, and environment variables:
Environment variables for the services as per abovementioned github guide.
Also, GRAYLOG_IS_MASTER is changed to GRAYLOG_IS_LEADER for proper config read and setup.

http_bind_address = 0.0.0.0:9000 (on all three nodes)

When opening the node page at /system/nodes/, in graylog logs additionally I get:

2025-03-07 10:57:21,836 ERROR: org.graylog2.shared.rest.exceptionmappers.AnyExceptionClassMapper - Unhandled exception in REST resource
java.io.InterruptedIOException: timeout
        at okhttp3.internal.connection.RealCall.timeoutExit(RealCall.kt:398) ~[graylog.jar:?]
        at okhttp3.internal.connection.RealCall.callDone(RealCall.kt:360) ~[graylog.jar:?]
        at okhttp3.internal.connection.RealCall.noMoreExchanges$okhttp(RealCall.kt:325) ~[graylog.jar:?]
        at okhttp3.internal.connection.RealCall.getResponseWithInterceptorChain$okhttp(RealCall.kt:209) ~[graylog.jar:?]
        at okhttp3.internal.connection.RealCall.execute(RealCall.kt:154) ~[graylog.jar:?]
        at retrofit2.OkHttpCall.execute(OkHttpCall.java:207) ~[graylog.jar:?]
        at org.graylog2.rest.resources.cluster.ClusterSystemResource.jvm(ClusterSystemResource.java:92) ~[graylog.jar:?]
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) ~[?:?]
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) ~[?:?]
        at java.base/java.lang.reflect.Method.invoke(Unknown Source) ~[?:?]
        at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory.lambda$static$0(ResourceMethodInvocationHandlerFactory.java:52) ~[graylog.jar:?]
        at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:146) ~[graylog.jar:?]
        at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:189) ~[graylog.jar:?]
        at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:219) ~[graylog.jar:?]
        at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:93) ~[graylog.jar:?]
        at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:478) ~[graylog.jar:?]
        at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:400) ~[graylog.jar:?]
        at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:81) ~[graylog.jar:?]
        at org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:274) [graylog.jar:?]
        at org.glassfish.jersey.internal.Errors$1.call(Errors.java:248) [graylog.jar:?]
        at org.glassfish.jersey.internal.Errors$1.call(Errors.java:244) [graylog.jar:?]
        at org.glassfish.jersey.internal.Errors.process(Errors.java:292) [graylog.jar:?]
        at org.glassfish.jersey.internal.Errors.process(Errors.java:274) [graylog.jar:?]
        at org.glassfish.jersey.internal.Errors.process(Errors.java:244) [graylog.jar:?]
        at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:266) [graylog.jar:?]
        at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:253) [graylog.jar:?]
        at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:696) [graylog.jar:?]
        at org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:367) [graylog.jar:?]
        at org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:190) [graylog.jar:?]
        at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:259) [graylog.jar:?]
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?]
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?]
        at java.base/java.lang.Thread.run(Unknown Source) [?:?]
Caused by: java.net.SocketException: Socket closed
        at java.base/sun.nio.ch.NioSocketImpl.endConnect(Unknown Source) ~[?:?]
        at java.base/sun.nio.ch.NioSocketImpl.connect(Unknown Source) ~[?:?]
        at java.base/java.net.SocksSocketImpl.connect(Unknown Source) ~[?:?]
        at java.base/java.net.Socket.connect(Unknown Source) ~[?:?]
        at okhttp3.internal.platform.Platform.connectSocket(Platform.kt:128) ~[graylog.jar:?]
        at okhttp3.internal.connection.RealConnection.connectSocket(RealConnection.kt:295) ~[graylog.jar:?]
        at okhttp3.internal.connection.RealConnection.connect(RealConnection.kt:207) ~[graylog.jar:?]
        at okhttp3.internal.connection.ExchangeFinder.findConnection(ExchangeFinder.kt:226) ~[graylog.jar:?]
        at okhttp3.internal.connection.ExchangeFinder.findHealthyConnection(ExchangeFinder.kt:106) ~[graylog.jar:?]
        at okhttp3.internal.connection.ExchangeFinder.find(ExchangeFinder.kt:74) ~[graylog.jar:?]
        at okhttp3.internal.connection.RealCall.initExchange$okhttp(RealCall.kt:255) ~[graylog.jar:?]
        at okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.kt:32) ~[graylog.jar:?]
        at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109) ~[graylog.jar:?]
        at okhttp3.internal.cache.CacheInterceptor.intercept(CacheInterceptor.kt:95) ~[graylog.jar:?]
        at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109) ~[graylog.jar:?]
        at okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.kt:83) ~[graylog.jar:?]
        at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109) ~[graylog.jar:?]
        at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.kt:76) ~[graylog.jar:?]
        at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109) ~[graylog.jar:?]
        at org.graylog2.rest.RemoteInterfaceProvider.lambda$get$0(RemoteInterfaceProvider.java:75) ~[graylog.jar:?]
        at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109) ~[graylog.jar:?]
        at okhttp3.internal.connection.RealCall.getResponseWithInterceptorChain$okhttp(RealCall.kt:201) ~[graylog.jar:?]
        ... 30 more
2025-03-07 10:57:21,847 WARN : org.graylog2.shared.rest.resources.ProxiedResource - Failed to call API on node <4cafb399-387b-4b90-9116-2f7deac188b2>, cause: timeout (duration: 5008 ms)
2025-03-07 10:57:21,861 ERROR: org.graylog2.shared.rest.exceptionmappers.AnyExceptionClassMapper - Unhandled exception in REST resource
java.io.InterruptedIOException: timeout
        at okhttp3.internal.connection.RealCall.timeoutExit(RealCall.kt:398) ~[graylog.jar:?]
        at okhttp3.internal.connection.RealCall.callDone(RealCall.kt:360) ~[graylog.jar:?]
        at okhttp3.internal.connection.RealCall.noMoreExchanges$okhttp(RealCall.kt:325) ~[graylog.jar:?]
        at okhttp3.internal.connection.RealCall.getResponseWithInterceptorChain$okhttp(RealCall.kt:209) ~[graylog.jar:?]
        at okhttp3.internal.connection.RealCall.execute(RealCall.kt:154) ~[graylog.jar:?]
        at retrofit2.OkHttpCall.execute(OkHttpCall.java:207) ~[graylog.jar:?]
        at org.graylog2.rest.resources.cluster.ClusterSystemPluginResource.list(ClusterSystemPluginResource.java:77) ~[graylog.jar:?]
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:?]
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) ~[?:?]
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) ~[?:?]
        at java.base/java.lang.reflect.Method.invoke(Unknown Source) ~[?:?]
        at org.glassfish.jersey.server.model.internal.ResourceMethodInvocationHandlerFactory.lambda$static$0(ResourceMethodInvocationHandlerFactory.java:52) ~[graylog.jar:?]
        at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher$1.run(AbstractJavaResourceMethodDispatcher.java:146) ~[graylog.jar:?]
        at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.invoke(AbstractJavaResourceMethodDispatcher.java:189) ~[graylog.jar:?]
        at org.glassfish.jersey.server.model.internal.JavaResourceMethodDispatcherProvider$TypeOutInvoker.doDispatch(JavaResourceMethodDispatcherProvider.java:219) ~[graylog.jar:?]
        at org.glassfish.jersey.server.model.internal.AbstractJavaResourceMethodDispatcher.dispatch(AbstractJavaResourceMethodDispatcher.java:93) ~[graylog.jar:?]
        at org.glassfish.jersey.server.model.ResourceMethodInvoker.invoke(ResourceMethodInvoker.java:478) ~[graylog.jar:?]
        at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:400) ~[graylog.jar:?]
        at org.glassfish.jersey.server.model.ResourceMethodInvoker.apply(ResourceMethodInvoker.java:81) ~[graylog.jar:?]
        at org.glassfish.jersey.server.ServerRuntime$1.run(ServerRuntime.java:274) [graylog.jar:?]
        at org.glassfish.jersey.internal.Errors$1.call(Errors.java:248) [graylog.jar:?]
        at org.glassfish.jersey.internal.Errors$1.call(Errors.java:244) [graylog.jar:?]
        at org.glassfish.jersey.internal.Errors.process(Errors.java:292) [graylog.jar:?]
        at org.glassfish.jersey.internal.Errors.process(Errors.java:274) [graylog.jar:?]
        at org.glassfish.jersey.internal.Errors.process(Errors.java:244) [graylog.jar:?]
        at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:266) [graylog.jar:?]
        at org.glassfish.jersey.server.ServerRuntime.process(ServerRuntime.java:253) [graylog.jar:?]
        at org.glassfish.jersey.server.ApplicationHandler.handle(ApplicationHandler.java:696) [graylog.jar:?]
        at org.glassfish.jersey.grizzly2.httpserver.GrizzlyHttpContainer.service(GrizzlyHttpContainer.java:367) [graylog.jar:?]
        at org.glassfish.grizzly.http.server.HttpHandler$1.run(HttpHandler.java:190) [graylog.jar:?]
        at com.codahale.metrics.InstrumentedExecutorService$InstrumentedRunnable.run(InstrumentedExecutorService.java:259) [graylog.jar:?]
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source) [?:?]
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source) [?:?]
        at java.base/java.lang.Thread.run(Unknown Source) [?:?]
Caused by: java.net.SocketException: Socket closed
        at java.base/sun.nio.ch.NioSocketImpl.endConnect(Unknown Source) ~[?:?]
        at java.base/sun.nio.ch.NioSocketImpl.connect(Unknown Source) ~[?:?]
        at java.base/java.net.SocksSocketImpl.connect(Unknown Source) ~[?:?]
        at java.base/java.net.Socket.connect(Unknown Source) ~[?:?]
        at okhttp3.internal.platform.Platform.connectSocket(Platform.kt:128) ~[graylog.jar:?]
        at okhttp3.internal.connection.RealConnection.connectSocket(RealConnection.kt:295) ~[graylog.jar:?]
        at okhttp3.internal.connection.RealConnection.connect(RealConnection.kt:207) ~[graylog.jar:?]
        at okhttp3.internal.connection.ExchangeFinder.findConnection(ExchangeFinder.kt:226) ~[graylog.jar:?]
        at okhttp3.internal.connection.ExchangeFinder.findHealthyConnection(ExchangeFinder.kt:106) ~[graylog.jar:?]
        at okhttp3.internal.connection.ExchangeFinder.find(ExchangeFinder.kt:74) ~[graylog.jar:?]
        at okhttp3.internal.connection.RealCall.initExchange$okhttp(RealCall.kt:255) ~[graylog.jar:?]
        at okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.kt:32) ~[graylog.jar:?]
        at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109) ~[graylog.jar:?]
        at okhttp3.internal.cache.CacheInterceptor.intercept(CacheInterceptor.kt:95) ~[graylog.jar:?]
        at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109) ~[graylog.jar:?]
        at okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.kt:83) ~[graylog.jar:?]
        at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109) ~[graylog.jar:?]
        at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.kt:76) ~[graylog.jar:?]
        at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109) ~[graylog.jar:?]
        at org.graylog2.rest.RemoteInterfaceProvider.lambda$get$0(RemoteInterfaceProvider.java:75) ~[graylog.jar:?]
        at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.kt:109) ~[graylog.jar:?]
        at okhttp3.internal.connection.RealCall.getResponseWithInterceptorChain$okhttp(RealCall.kt:201) ~[graylog.jar:?]
        ... 30 more

3. What steps have you already taken to try and solve the problem?
I redeployed the whole stack multiple times - each time different working/not working node combination comes up.

I tried opening all ports on all nodes - no help.

I restarted individual docker containers.

I restarted and recreated individual docker stack services.

I verified all services are up, healthy and can communicate with each other (graylog, mongo, elasticsearch).

I manually started a mongodb replicaset from inside mongodb service.

I CAN reach problematic node /api from inside the Leader container and receive a proper response with
curl graylog03:9000/api

{"cluster_id":"3cf39bee-d21a-4854-b66c-396f4baf4525","node_id":"4cafb399-387b-4b90-9116-2f7deac188b2","version":"6.1.5+e3ae3ce","tagline":"Manage your logs in the dark and have lasers going and make it look like you're from space!"}

Everything seems to work, but still, the gaylog cluster can’t see the last node (graylog03 in my case) and I’m still getting the error:

2025-03-07 11:56:32,096 WARN : org.graylog2.shared.rest.resources.ProxiedResource - Failed to call API on node <4cafb399-387b-4b90-9116-2f7deac188b2>, cause: timeout (duration: 5003 ms)
2025-03-07 11:57:27,948 WARN : org.graylog2.shared.rest.resources.ProxiedResource - Failed to call API on node <4cafb399-387b-4b90-9116-2f7deac188b2>, cause: timeout (duration: 1002 ms)
2025-03-07 11:57:32,176 WARN : org.graylog2.shared.rest.resources.ProxiedResource - Failed to call API on node <4cafb399-387b-4b90-9116-2f7deac188b2>, cause: timeout (duration: 5001 ms)

4. How can the community help?

Please help me find a root cause for why this is happening. Everything seems to be working, all services are healthy and communicating, but each time I redeploy the whole stack, I get a different combination of working/not working nodes in graylog cluster.

dawidsniegon · March 14, 2025, 5:56am

Okay, I think I cracked it.

TL;DR: set http_publish_uri to your nodes’ IP:PUBLISH_PORT, or ADDRESS:PUBLISH_PORT, such as
http_publish_uri= "http://graylog01.example.com:9000"

The whole stack is deployed with docker swarm, which adds a bit of complexity when troubleshooting networking. Apart from creating our own docker overlay network (used for service-to-service communication), docker swarm creates additional network - docker_gwbridge - for docker daemons communication on the hosts that are joined to the docker swarm cluster. In the end, each created docker service has IP assigned not only from the overlay network, but also an additional one coming from the docker_gwbridge network.

The services can easily communicate with each other using docker service dns names assigned in the docker compose file (e.g., graylog01, opensearch02, mongodb03, etc.). However, when it comes to graylog cluster node API discovery, you will notice that unless you clearly specify http_publish_uri for each graylog node, the graylog cluster will automatically pick up the graylog docker services’ IPs randomly assigned by docker_gwbridge.

To check what is the currently assigned “transport address” you can check what address is assigned to each node in mongodb.

Ensure the stack is deployed and mongodb services are running,
Log in to any runing mongodb container on any node,
Run:
mongosh,
use graylog (to operate on graylog table),
db.nodes.find(),
Check “transport_address” field for each node.

For some reason, if for any node the IP was not exactly the same as the leader node IP, the node could not be found by the graylog cluster.

Example:

dbrs [direct: primary] test> use graylog
switched to db graylog
dbrs [direct: primary] graylog> db.nodes.find()
[
  {
    _id: ObjectId('67d29c3adb8f5566403d5a39'),
    node_id: '4cafb399-387b-4b90-9116-2f7deac188b2',
    hostname: 'graylog03',
    is_leader: false,
    last_seen: Timestamp({ t: 1741857874, i: 3 }),
    transport_address: 'http://172.19.0.6:9000/api/'  ##### 0.6   <---- Standby node, available
  },
  {
    _id: ObjectId('67d2a089db8f5566403ec32a'),
    node_id: 'c70f79da-37ba-4db4-a0cc-cbe505c73776',
    hostname: 'graylog01',
    is_leader: true,
    last_seen: Timestamp({ t: 1741857874, i: 9 }),
    transport_address: 'http://172.19.0.6:9000/api/'   ##### 0.6   <---- Leader node, available
  },
  {
    _id: ObjectId('67d2a42edb8f55664040393e'),
    node_id: '58f698be-13f3-45ab-82ae-1a77600aebc4',
    hostname: 'graylog02',
    is_leader: false,
    last_seen: Timestamp({ t: 1741857874, i: 7 }),
    transport_address: 'http://172.19.0.5:9000/api/'   ##### 0.5   <---- Standby node, UNAVAILABLE
  }
]

Since this is a docker swarm deployment, you cannot assign ipv4_address to the services directly, so trying to force all graylog services to have the same IP address won’t help.

Solution 1 - set http_publish_uri to service name - INCOMPLETE

One way to solve the graylog nodes’ api discovery is to set http_publish_uri to point directly to the graylog docker service name, such as:

Graylog01:

http_publish_uri= “http://graylog01:9000/”

Graylog02:

http_publish_uri= “http://graylog02:9000/”

Graylog03:

http_publish_uri= “http://graylog03:9000/”

This way, you define the publish URI which can be resolved by docker stack internally and finally point to the correct nodes. Also, you can see the changes to “transport_address” in mongodb.

This solution is fine by itself, but you might encounter another nuisance.

When you open https:<graylog_url>/system/nodes you will find that you can’t reach the individual node’s API browser, as the button points to the currently set publish URI and http://<service-name>:<port>/api/api-browser is not a URL recognized anywhere outside of the docker stack overlay network. You can still directly input individual node’s full IP address or a DNS (with published API port) assigned to that host into the browser, but still, that could be a nuisance.

Solution 2 - set http_publish_uri to host’s DNS - COMPLETE

A complete solution that would allow both for graylog cluster to discover its nodes’ APIs and for the web UI to point to correct individual node’s API browsers requires two steps:

In docker-compose.yaml include extra hosts with all nodes’ host’s IP mapped to their respective IPs, such as:

services:
  ...
  graylog01:
    ...
    extra_hosts:
      - "graylog01.example.com:192.168.xx.x1"
      - "graylog02.example.com:192.168.xx.x2"
      - "graylog03.example.com:192.168.xx.x3"

Edit http_publish_uri to the actual host IP and published graylog API port for each graylog node:

Graylog01:
http_publish_uri= “http://graylog01.example.com:9000/”
Graylog02:
http_publish_uri= "http://graylog02.example.com:9001/"
Graylog03:
http_publish_uri= "http://graylog03.example.com:9002/"

Of course, you can also point http_publish_uri directly to the hosts’ IPs instead of whole FQDN, in which case you can skip point 1 altogether and replace domains with IPs, such as:

http_publish_uri= “http://192.168.xx.x1:9000” for Graylog01, and so on.

IMPORTANT - incomplete URL

Right now, although the link redirects to a correct individual node’s API, the URL is still incomplete. There is no mention of this in documentation and it might be fixed in future Graylog versions.

The individual node’s api-browser button points to url: <node-dns>:<node-port>/api/api-browser. However, this is NOT a correct target URL. You must add /global/index.html for the URL to work.

For example: http://graylog03.example.com:9002/api/api-browser/global/index.html

system · March 28, 2025, 5:57am

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Unable to call -api- on node Graylog Central (peer support)	2	1547	June 30, 2021
Graylog - Failed to call API on node <node>, cause: timeout (duration: 5006ms) Graylog Central (peer support)	8	552	May 31, 2024
Failed to call API on node Graylog Central (peer support)	5	1198	April 4, 2024
Call API metrics timeout Graylog Central (peer support)	1	423	October 26, 2020
ProxiedResource Unable to call http Graylog Central (peer support)	3	2287	March 1, 2019

Graylog HA - Failed to call API on node

Solution 1 - set http_publish_uri to service name - INCOMPLETE

Solution 2 - set http_publish_uri to host’s DNS - COMPLETE

IMPORTANT - incomplete URL

Related topics