# Graylog Not Providing Results **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [July 7, 2017, 7:18pm UTC](https://community.graylog.org/t/graylog-not-providing-results/1674 "2017-07-07T19:18:29Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![chavez243ca](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/chavez243ca/32/556_2.png) [@chavez243ca](https://community.graylog.org/u/chavez243ca)\ **Post date:** [July 7, 2017, 7:18pm UTC](https://community.graylog.org/t/graylog-not-providing-results/1674/1 "2017-07-07T19:18:29Z")
Fairly new Graylog install on FreeBSD; graylog 2.3.3 / elasticsearch 2.4.4; I have a couple basic inputs running and tcpdump shows data flowing from clients to the graylog server on the expected ports. However, any attempts to search events gives me a “Loading…” message and nothing happens. The ES index is growing, but I can’t seem to get any data to display. ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [July 10, 2017, 7:10am UTC](https://community.graylog.org/t/graylog-not-providing-results/1674/2 "2017-07-10T07:10:47Z")
What’s the configuration of Graylog? What’s the configuration of Elasticsearch? What’s in the logs of your Graylog and Elasticsearch nodes? ---
**Author:** ![chavez243ca](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/chavez243ca/32/556_2.png) [@chavez243ca](https://community.graylog.org/u/chavez243ca)\ **Post date:** [July 10, 2017, 1:40pm UTC](https://community.graylog.org/t/graylog-not-providing-results/1674/3 "2017-07-10T13:40:01Z")
**gl server.conf** ```auto is_master = true node_id_file = /var/graylog/server/node-id plugin_dir = /usr/local/share/graylog/plugin rest_listen_uri = http://10.31.0.60:12900/ elasticsearch_config_file = /usr/local/etc/elasticsearch/elasticsearch.yml rotation_strategy = count elasticsearch_max_docs_per_index = 20000000 elasticsearch_max_number_of_indices = 20 retention_strategy = delete elasticsearch_shards = 4 elasticsearch_replicas = 0 elasticsearch_index_prefix = graylog2 allow_leading_wildcard_searches = false allow_highlighting = false elasticsearch_cluster_name = graylog2 elasticsearch_node_name = graylog2-server elasticsearch_transport_tcp_port = 9350 elasticsearch_discovery_zen_ping_multicast_enabled = false elasticsearch_discovery_zen_ping_unicast_hosts = 10.31.0.60:9300 elasticsearch_analyzer = standard output_batch_size = 500 output_flush_interval = 1 output_fault_count_threshold = 5 output_fault_penalty_seconds = 30 processbuffer_processors = 5 outputbuffer_processors = 3 processor_wait_strategy = blocking ring_size = 65536 inputbuffer_ring_size = 65536 inputbuffer_processors = 2 inputbuffer_wait_strategy = blocking message_journal_enabled = true message_journal_dir = /var/db/graylog/journal dead_letters_enabled = false lb_recognition_period_seconds = 3 mongodb_useauth = false mongodb_host = 127.0.0.1 mongodb_database = graylog2 mongodb_port = 27017 ``` **es yml** ```auto cluster.name: graylog2 node.name: graylog2-server path.data: /var/db/elasticsearch path.logs: /var/log/elasticsearch bootstrap.memory_lock: true network.host: 10.31.0.60 http.port: 9200 discovery.zone.ping.multicast.enable: false discovery.zen.ping.unicast.hosts: ["127.0.0.1:9300", "10.31.0.60:9300"] node.max_local_storage_nodes: 1 ``` es log ```auto [2017-07-07 15:48:19,760][INFO][cluster.metadata] [graylog2-server] [graylog2_4] update_mapping [message] [2017-07-07 15:48:23,741][INFO][cluster.metadata] [graylog2-server] [graylog2_4] update_mapping [message] [2017-07-07 16:26:59,740][INFO][cluster.metadata] [graylog2-server] [graylog2_4] update_mapping [message] [2017-07-07 20:48:09,739][INFO][cluster.metadata] [graylog2-server] [graylog2_4] update_mapping [message] ``` Errors in GL log ```auto 2017-07-07 15:07:44,515 ERROR o.g.r.r.s.i.IndicesResource [rest-worker-5] Index [graylog2_0] not found. 2017-07-07 15:07:44,516 ERROR o.g.r.r.s.i.IndicesResource [rest-worker-7] Index [graylog2_0] not found. 2017-07-07 15:07:52,907 ERROR o.g.r.r.s.i.IndicesResource [rest-worker-5] Index [graylog2_1] not found. 2017-07-07 15:08:00,930 ERROR o.g.r.r.s.i.IndicesResource [rest-worker-2] Index [graylog2_2] not found. 2017-07-07 15:08:34,483 ERROR o.g.r.r.s.i.IndicesResource [rest-worker-12] Index [graylog2_3] not found. 2017-07-07 15:08:53,786 ERROR o.g.s.j.SystemJobManager [systemjob-executor-0] Unhandled error while running SystemJob [org.graylog2.indexer.indices.jobs.SetIndexReadOnlyAndCalculateRangeJob] ``` ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [July 10, 2017, 2:01pm UTC](https://community.graylog.org/t/graylog-not-providing-results/1674/4 "2017-07-10T14:01:46Z")
> [@chavez243ca](#): > > ```auto > elasticsearch_config_file = /usr/local/etc/elasticsearch/elasticsearch.yml > > ``` This is (with 99.99999% certainty) wrong. Please read the annotated configuration file and the docs: [http://docs.graylog.org/en/2.2/pages/configuration/elasticsearch.html](http://docs.graylog.org/en/2.2/pages/configuration/elasticsearch.html) > Additionally, the name of the standalone Elasticsearch node(s) and the embedded Elasticsearch node in Graylog shouldn’t be identical to make identifying each node easier (see `elasticsearch_node_name` and `node.name` settings respectively). In general, you have quite a few deprecated settings in your Graylog configuration file. You should probably start with the matching version of the annotated configuration file and only change the required settings: [graylog2-server/misc/graylog.conf at 2.2.3 · Graylog2/graylog2-server · GitHub](https://github.com/Graylog2/graylog2-server/blob/2.2.3/misc/graylog.conf) > [@chavez243ca](#): > > Errors in GL log ![](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/a/8/a8e7123d48b0f1ca7017b62ccfe7003207803787.gif) ---
**Author:** ![chavez243ca](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/chavez243ca/32/556_2.png) [@chavez243ca](https://community.graylog.org/u/chavez243ca)\ **Post date:** [July 11, 2017, 12:31pm UTC](https://community.graylog.org/t/graylog-not-providing-results/1674/5 "2017-07-11T12:31:39Z")
root@secdev1:/var/log/graylog # ls /usr/local/etc/elasticsearch/ **elasticsearch.yml** elasticsearch.yml.sample logging.yml logging.yml.sample So the above has been determined to be fine. 0.000001% FTW I grabbed the updated graylog config from github and transferred the necessary bits to it, to be honest there seemed to be very few differences save a couple lines. I copied over the important parts of the previous config and restarted and got things working. ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [July 11, 2017, 1:10pm UTC](https://community.graylog.org/t/graylog-not-providing-results/1674/6 "2017-07-11T13:10:17Z")
> [@chavez243ca](#): > > So the above has been determined to be fine. 0.000001% FTW It’s not the path that’s wrong, it’s the fact that it’s the configuration file for your (standalone) Elasticsearch node, not for the **embedded** Elasticsearch node in Graylog. ---
**Author:** ![chavez243ca](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/chavez243ca/32/556_2.png) [@chavez243ca](https://community.graylog.org/u/chavez243ca)\ **Post date:** [July 11, 2017, 4:05pm UTC](https://community.graylog.org/t/graylog-not-providing-results/1674/7 "2017-07-11T16:05:50Z")
Would the embedded ES node run under the graylog user, or elasticsearch user? I’m trying to find evidence of it, but it doesn’t seem to exist. Graylog is working perfectly right now, but if there is something fundamentally incorrect about this setup I would like to address it before I spin up another one. Any pointers on how to locate the elusive embedded ES node? Searched the entire filesystems for another elasticsearch.yml and came up empty. ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [July 11, 2017, 4:33pm UTC](https://community.graylog.org/t/graylog-not-providing-results/1674/8 "2017-07-11T16:33:56Z")
> [@chavez243ca](#): > > Would the embedded ES node run under the graylog user, or elasticsearch user? It’s part of the Graylog process, so it would run in the context of the system user running that process. ---
**Author:** ![chavez243ca](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/chavez243ca/32/556_2.png) [@chavez243ca](https://community.graylog.org/u/chavez243ca)\ **Post date:** [July 11, 2017, 4:58pm UTC](https://community.graylog.org/t/graylog-not-providing-results/1674/9 "2017-07-11T16:58:59Z")
One of these? graylog java 53065 89 tcp4 10.31.0.60:9350 _:_ graylog java 53065 91 tcp4 10.31.0.60:9000 _:_ graylog java 53065 120 tcp4 10.31.0.60:9443 _:_ graylog java 53065 194 udp4 \*:5140 _:_ graylog java 53065 204 udp4 \*:12201 _:_ graylog java 53065 205 tcp4 \*:5043 _:_ ---
**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\ **Post date:** [July 11, 2017, 5:18pm UTC](https://community.graylog.org/t/graylog-not-providing-results/1674/10 "2017-07-11T17:18:30Z")
Yes, probably. I’m not the administrator of that system, you know? 😉 ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [July 25, 2017, 5:18pm UTC](https://community.graylog.org/t/graylog-not-providing-results/1674/11 "2017-07-25T17:18:40Z")
Closed on July 25, 2017, 5:18pm UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.