Graylog Search empty after 3.1 -> 3.3.8 upgrade

Graylog Central (peer support)
1

After upgrading from 3.1 to 3.3.8 using the instructions found at:

https://docs.graylog.org/en/3.3/pages/installation/operating_system_packages.html#operating-package-upgrade-rpm-yum-dnf

I am not able to bring any logs up in the search window.

I have verified that I am receiving logs by looking at the input metrics, as well as the pipeline throughput.

However, /var/log/graylog-server/server.log contains the following errors:

2020-11-02T15:30:35.408-05:00 WARN [ProcessBufferProcessor] Unable to process message <430441f0-1d4a-11eb-861b-78e7d18dd4e6>: java.lang.ClassCastException: org.graylog.plugins.pipelineprocessor.ast.expressions.StringExpression cannot be cast to org.graylog.plugins.pipelineprocessor.ast.expressions.LogicalExpression
2020-11-02T15:30:35.411-05:00 WARN [ProcessBufferProcessor] Unable to process message <4304b720-1d4a-11eb-861b-78e7d18dd4e6>: java.lang.ClassCastException: org.graylog.plugins.pipelineprocessor.ast.expressions.StringExpression cannot be cast to org.graylog.plugins.pipelineprocessor.ast.expressions.LogicalExpression
2020-11-02T15:30:35.415-05:00 WARN [ProcessBufferProcessor] Unable to process message <43052c50-1d4a-11eb-861b-78e7d18dd4e6>: java.lang.ClassCastException: org.graylog.plugins.pipelineprocessor.ast.expressions.StringExpression cannot be cast to org.graylog.plugins.pipelineprocessor.ast.expressions.LogicalExpression
2020-11-02T15:30:35.417-05:00 WARN [ProcessBufferProcessor] Unable to process message <4305a181-1d4a-11eb-861b-78e7d18dd4e6>: java.lang.ClassCastException: org.graylog.plugins.pipelineprocessor.ast.expressions.StringExpression cannot be cast to org.graylog.plugins.pipelineprocessor.ast.expressions.LogicalExpression
2020-11-02T15:30:35.420-05:00 WARN [ProcessBufferProcessor] Unable to process message <430616b0-1d4a-11eb-861b-78e7d18dd4e6>: java.lang.ClassCastException: org.graylog.plugins.pipelineprocessor.ast.expressions.StringExpression cannot be cast to org.graylog.plugins.pipelineprocessor.ast.expressions.LogicalExpression
2020-11-02T15:30:35.421-05:00 WARN [ProcessBufferProcessor] Unable to process message <430664d0-1d4a-11eb-861b-78e7d18dd4e6>: java.lang.ClassCastException: org.graylog.plugins.pipelineprocessor.ast.expressions.StringExpression cannot be cast to org.graylog.plugins.pipelineprocessor.ast.expressions.LogicalExpression
2020-11-02T15:30:35.425-05:00 WARN [ProcessBufferProcessor] Unable to process message <4306da00-1d4a-11eb-861b-78e7d18dd4e6>: java.lang.ClassCastException: org.graylog.plugins.pipelineprocessor.ast.expressions.StringExpression cannot be cast to org.graylog.plugins.pipelineprocessor.ast.expressions.LogicalExpression
2020-11-02T15:30:35.428-05:00 WARN [ProcessBufferProcessor] Unable to process message <43074f30-1d4a-11eb-861b-78e7d18dd4e6>: java.lang.ClassCastException: org.graylog.plugins.pipelineprocessor.ast.expressions.StringExpression cannot be cast to org.graylog.plugins.pipelineprocessor.ast.expressions.LogicalExpression
2020-11-02T15:30:35.431-05:00 WARN [ProcessBufferProcessor] Unable to process message <4307c460-1d4a-11eb-861b-78e7d18dd4e6>: java.lang.ClassCastException: org.graylog.plugins.pipelineprocessor.ast.expressions.StringExpression cannot be cast to org.graylog.plugins.pipelineprocessor.ast.expressions.LogicalExpression
2020-11-02T15:30:35.434-05:00 WARN [ProcessBufferProcessor] Unable to process message <43083991-1d4a-11eb-861b-78e7d18dd4e6>: java.lang.ClassCastException: org.graylog.plugins.pipelineprocessor.ast.expressions.StringExpression cannot be cast to org.graylog.plugins.pipelineprocessor.ast.expressions.LogicalExpression

I’ve tried removing the pipeline rules, as well as disconnected the streams from the pipelines, but that did not resolve the issue.

Any suggestions on how to resolve would be appreciated.

2

A couple of things I’ve verified/tried:

  • I have data in the index using curl -H ‘Content-Type: application/json’ -X GET http://localhost:9200/graylog_18/_search?pretty
  • Time is what I expect it to be in System -> Overview
  • I have recalculated the indices
  • Disabled pipeline rules
  • Recreated inputs
  • Searched absolute times in the past
  • Searched 8 hours into the future
3

I figured it out. This issue was caused by not upgrading the configurations to be at the same version as the Graylog. Running this command upgraded Integrations from 3.1.8 to 3.3.8, and now I see data in search:

yum install graylog-integrations-plugins graylog-enterprise-integrations-plugins

4

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.