# Graylog server cannot connect to ElasticSearch

**URL:** <https://community.graylog.org/t/graylog-server-cannot-connect-to-elasticsearch/2027>\
**Category:** Graylog Central (peer support)\
**Created:** [August 9, 2017, 3:17pm UTC](https://community.graylog.org/t/graylog-server-cannot-connect-to-elasticsearch/2027 "2017-08-09T15:17:45Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![milkncookiez](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@milkncookiez](https://community.graylog.org/u/milkncookiez)\
**Post date:** [August 9, 2017, 3:17pm UTC](https://community.graylog.org/t/graylog-server-cannot-connect-to-elasticsearch/2027/1 "2017-08-09T15:17:45Z")

</div>

I’m following [this getting-started guide](http://docs.graylog.org/en/2.3/pages/installation/docker.html). Mongo and ElasticSearch lift correctly, but the Graylog server does not access ElasticSearch.

This is the `docker-compose` configuration I use for it (I’m on a Mac, that’s why I declare the networks additionally):

```auto
version: '2'
services:
  mongo:
    image: "mongo:3"
    container_name: graylog-mongo
    tty: true
    networks:
      - graylog_default

  elasticsearch:
    image: "elasticsearch:5"
    container_name: graylog-elastic
    #command: "elasticsearch -dEs.cluster.name='graylog'"
    tty: true
    ports:
      - "9200:9200"
    networks:
      - graylog_default

  graylog:
    image: graylog2/server:2.3.0-1
    container_name: graylog-server
    tty: true
    environment:
      GRAYLOG_PASSWORD_SECRET: asdf1234asdf1234
      GRAYLOG_ROOT_PASSWORD_SHA2: 5edf3ff590e9e85565024392d4938564a411dcd3ae9f6787d1e2a087098381f1
      GRAYLOG_WEB_ENDPOINT_URI: http://127.0.0.1:9000/api
    depends_on:
      - mongo
      - elasticsearch
    ports:
      - "9000:9000"
      - "5555:5555"
    networks:
      - graylog_default

networks:
  default:
    external:
      name: graylog_default

```

I’ve got 2 questions:

1. Can I review messages w/o having the elastic search running (cuz I could not list/view/find any messages, even though I can see statistics that I have a number of _unprocessed_ messages)
2. I believe it’s a networking problem between Graylog and ES. Graylog should be trying to access ES on `graylog-elastic:9200` host instead of on `localhost:9200`. Is there a way to specify that?

---

<div class="post-metadata">

**Author:** ![milkncookiez](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@milkncookiez](https://community.graylog.org/u/milkncookiez)\
**Post date:** [August 10, 2017, 9:49am UTC](https://community.graylog.org/t/graylog-server-cannot-connect-to-elasticsearch/2027/2 "2017-08-10T09:49:14Z")

</div>

Okay, I found it…  
In the Graylog server, in the `graylog.conf` file located in `/usr/share/graylog/data/config/` I added the line:

```auto
elasticsearch_hosts=http://graylog-elastic:9200

```

So, basically, I told Graylog to look for the ES server at a specific URI instead of using the default `127.0.0.1:9200`

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [August 10, 2017, 10:14am UTC](https://community.graylog.org/t/graylog-server-cannot-connect-to-elasticsearch/2027/3 "2017-08-10T10:14:19Z")

</div>

You can override that setting with the `GRAYLOG_ELASTICSEARCH_HOSTS` environment variable and don’t need to modify the configuration file.

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [August 10, 2017, 4:18pm UTC](https://community.graylog.org/t/graylog-server-cannot-connect-to-elasticsearch/2027/4 "2017-08-10T16:18:55Z")

</div>

I’ve given the Docker chapter from the documentation an overhaul.

Feel free to check out and comment on [PR #348](https://github.com/Graylog2/documentation/pull/348).

The new Docker chapter can be previewed at:

> <https://github.com/Graylog2/documentation/blob/ef9d26a/pages/installation/docker.rst>

---

<div class="post-metadata">

**Author:** ![milkncookiez](https://avatars.discourse-cdn.com/v4/letter/m/ce73a5/32.png) [@milkncookiez](https://community.graylog.org/u/milkncookiez)\
**Post date:** [August 11, 2017, 9:17am UTC](https://community.graylog.org/t/graylog-server-cannot-connect-to-elasticsearch/2027/5 "2017-08-11T09:17:47Z")

</div>

The **Quick Start** looks much better with the updated commands! Nice work!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [August 25, 2017, 9:17am UTC](https://community.graylog.org/t/graylog-server-cannot-connect-to-elasticsearch/2027/6 "2017-08-25T09:17:57Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.