Graylog server cannot connect to ElasticSearch

Graylog Central (peer support)
1

I’m following this getting-started guide. Mongo and ElasticSearch lift correctly, but the Graylog server does not access ElasticSearch.

This is the docker-compose configuration I use for it (I’m on a Mac, that’s why I declare the networks additionally):

version: '2'
services:
  mongo:
    image: "mongo:3"
    container_name: graylog-mongo
    tty: true
    networks:
      - graylog_default

  elasticsearch:
    image: "elasticsearch:5"
    container_name: graylog-elastic
    #command: "elasticsearch -dEs.cluster.name='graylog'"
    tty: true
    ports:
      - "9200:9200"
    networks:
      - graylog_default

  graylog:
    image: graylog2/server:2.3.0-1
    container_name: graylog-server
    tty: true
    environment:
      GRAYLOG_PASSWORD_SECRET: asdf1234asdf1234
      GRAYLOG_ROOT_PASSWORD_SHA2: 5edf3ff590e9e85565024392d4938564a411dcd3ae9f6787d1e2a087098381f1
      GRAYLOG_WEB_ENDPOINT_URI: http://127.0.0.1:9000/api
    depends_on:
      - mongo
      - elasticsearch
    ports:
      - "9000:9000"
      - "5555:5555"
    networks:
      - graylog_default

networks:
  default:
    external:
      name: graylog_default

I’ve got 2 questions:

  1. Can I review messages w/o having the elastic search running (cuz I could not list/view/find any messages, even though I can see statistics that I have a number of unprocessed messages)
  2. I believe it’s a networking problem between Graylog and ES. Graylog should be trying to access ES on graylog-elastic:9200 host instead of on localhost:9200. Is there a way to specify that?
2

Okay, I found it…
In the Graylog server, in the graylog.conf file located in /usr/share/graylog/data/config/ I added the line:

elasticsearch_hosts=http://graylog-elastic:9200

So, basically, I told Graylog to look for the ES server at a specific URI instead of using the default 127.0.0.1:9200

3

You can override that setting with the GRAYLOG_ELASTICSEARCH_HOSTS environment variable and don’t need to modify the configuration file.

4

I’ve given the Docker chapter from the documentation an overhaul.

Feel free to check out and comment on PR #348.

The new Docker chapter can be previewed at:

1 Like
5

The Quick Start looks much better with the updated commands! Nice work!

6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.