# Graylog Time out **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [May 6, 2021, 10:30am UTC](https://community.graylog.org/t/graylog-time-out/19753 "2021-05-06T10:30:10Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Juancho](https://avatars.discourse-cdn.com/v4/letter/j/c77e96/32.png) [@Juancho](https://community.graylog.org/u/Juancho)\ **Post date:** [May 6, 2021, 10:30am UTC](https://community.graylog.org/t/graylog-time-out/19753/1 "2021-05-06T10:30:10Z")
Hello friends, I have Graylog community version Graylog 3.2.6+e255fcc and I am using the fortinet pack.I am configuring a dashboard that works if I put 5 minutes, but if I select a date range for example all the previous day gives me time out could you help me to configure or optimize. I have a Centos 7 server with 4CPU and 8 RAM. Attached are some errors found. ![Screenshot_6](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/f/f19fc1255dfca33a5a407e49e008e8a383dc09e2.jpeg) Regards ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [May 7, 2021, 4:01am UTC](https://community.graylog.org/t/graylog-time-out/19753/2 "2021-05-07T04:01:43Z")
@Juancho Hello and welcome I took a glance at your picture. Looks like you may have a connection problem to Elasticsearch. I see the "could not connect to 127.0.0.1:9200 also connection refused. Sounds like a permission/configuration issues. Does Graylog have access to the fortinet pack? Was this working before or did this just happen? Do you have any other problems like this or only for fortinet Dashboard? Out of curiosity what do you get when you execute this command. `curl -XGET 'http://127.0.0.1:9200/_cluster/health?pretty=true'` Edit: Graylog config file `elasticsearch_hosts=` match Elasticsearch config `network.host:` ? ---
**Author:** ![Juancho](https://avatars.discourse-cdn.com/v4/letter/j/c77e96/32.png) [@Juancho](https://community.graylog.org/u/Juancho)\ **Post date:** [May 7, 2021, 8:49am UTC](https://community.graylog.org/t/graylog-time-out/19753/3 "2021-05-07T08:49:37Z")
> [@gsmith](#): > > elasticsearch\_hosts Hello, Thanks for your help. I am new with Graylog and Elasticsearch. To install and configure it I was guided by this video. [![](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/e/e6fa817fe152e817a623d0591f60e3125cf0db66.jpeg "Fortigate Graylog Centos7") ](https://www.youtube.com/watch?v=SYcPBB0msVk) I have a MV with 4CPU, 16GB RAM, I modified the Java HEAD of both Graylog and Elasticsearch going from 1GB to 4GB in each. I also installed this pack > **[the NEW Marketplace](https://community.graylog.org/c/marketplace/31)** > > Find, explore, and try out Graylog add-ons created by Graylog community members and enthusiasts. Plugins, extractors, content packs and GELF libraries are available as well as guides and documentation. It works correctly but the problem I have is that when I make a new dashboard with some fields if I select in a range of 15 minutes it does it correctly but if I extend the time as for example 1,2,3 days ago I get a time out and it gets stuck so I restart the server again and it works again. I attach the curl ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/a/a75375914a2b0f268891b570cf56f141845fcb66.png) now in elasticsearch the field network.host: 0.0.0.0.0 and in Graylog the field elasticsearch\_hosts= is commented out. What should I change here? Thanks ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [May 7, 2021, 10:13pm UTC](https://community.graylog.org/t/graylog-time-out/19753/4 "2021-05-07T22:13:46Z")
Hello, To be honest I not sure right now, but if I had to guess it could be a couple different things. Judging from the picture above, this is showing _connection time outs, couldnt update field in index, failed to connect to 127.0.0.1:9200._ Since you showed ES is fine and I assume MongoDb, Graylog services are good also you stated that only 15 minutes of searched logs are shown but when you go to a date range it times out . This makes be believe it could be a configuration problem or resource problem (i.e. CPU) To check for resources run TOP or HTOP then go to your dashboard and execute what you did before when dashboard times out. IF the CPU is maxed out try adding 2 or 4 more cores on your virtual machine. Do you have Selinux enabled? If so maybe put it into passive mode and reboot? > [@Juancho](#): > > network.host: 0.0.0.0.0 Thats to many octets above. Maybe try 127.0.0.1 or 0.0.0.0 and restart Elasticsearch service. Is it posibable to show both you Elasticsearch configuration file and Graylog configuration file? ---
**Author:** ![Juancho](https://avatars.discourse-cdn.com/v4/letter/j/c77e96/32.png) [@Juancho](https://community.graylog.org/u/Juancho)\ **Post date:** [May 8, 2021, 8:12am UTC](https://community.graylog.org/t/graylog-time-out/19753/5 "2021-05-08T08:12:39Z")
Thanks @gsmith, I think it is more of configuration, when I launch the date range the CPU goes up but it does not get stuck that is to say I do not think it is the CPU I use glances and processes do not reach critical as well as memory. Then the selinux I have it disabled. The network.host by mistake I put a 0 of more currently I have it in 0.0.0.0, I think it is a configuration issue that tries to search by date range and makes a time out because it does not end but I do not know what it can be. That is why I resort to the forum if you have any suggestions where I can see I will appreciate it. Regards ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [May 11, 2021, 12:02am UTC](https://community.graylog.org/t/graylog-time-out/19753/6 "2021-05-11T00:02:41Z")
Hello, > [@Juancho](#): > > I think it is more of configuration, If that is true, could you do the following statement? > [@gsmith](#): > > Is it posibable to show both you Elasticsearch configuration file and Graylog configuration file? ---
**Author:** ![Juancho](https://avatars.discourse-cdn.com/v4/letter/j/c77e96/32.png) [@Juancho](https://community.graylog.org/u/Juancho)\ **Post date:** [May 11, 2021, 7:36am UTC](https://community.graylog.org/t/graylog-time-out/19753/7 "2021-05-11T07:36:42Z")
Hello @gsmith I add you graylog and elasticsearch elasticsearch.yml node.name: graylog action.auto\_create\_index: false path.data: /var/lib/elasticsearch path.logs: /var/log/elasticsearch network.host: 0.0.0.0 http.port: 9200 server.conf is\_master = true node\_id\_file = /etc/graylog/server/node-id password\_secret = BmDsgau4VJAE9RzJxILDFMWEHg4dzqaEHfJn93lOlzy9gWl8nUHQ3GzYOo8v4E2KeMkk1xp15QiUgQBSJeULzxHWSUCabXLu root\_password\_sha2 = 1b5a38c34d1fd3d0bf56c611763d3fa069e5102cd48537d5d7464a076ec0ec33 root\_timezone = Europe/Madrid bin\_dir = /usr/share/graylog-server/bin data\_dir = /var/lib/graylog-server plugin\_dir = /usr/share/graylog-server/plugin http\_bind\_address = 10.20.30.234:9000 http\_publish\_uri = [http://10.20.30.234:9000/](http://10.20.30.234:9000/) rotation\_strategy = count elasticsearch\_max\_docs\_per\_index = 20000000 elasticsearch\_max\_number\_of\_indices = 20 retention\_strategy = delete elasticsearch\_shards = 1 elasticsearch\_replicas = 0 elasticsearch\_index\_prefix = graylog allow\_leading\_wildcard\_searches = false allow\_highlighting = false elasticsearch\_analyzer = standard output\_batch\_size = 500 output\_flush\_interval = 1 output\_fault\_count\_threshold = 5 output\_fault\_penalty\_seconds = 30 processbuffer\_processors = 5 outputbuffer\_processors = 3 processor\_wait\_strategy = blocking ring\_size = 65536 inputbuffer\_ring\_size = 65536 inputbuffer\_processors = 2 inputbuffer\_wait\_strategy = blocking message\_journal\_enabled = true message\_journal\_dir = /var/lib/graylog-server/journal lb\_recognition\_period\_seconds = 3 mongodb\_uri = mongodb://localhost/graylog mongodb\_max\_connections = 1000 mongodb\_threads\_allowed\_to\_block\_multiplier = 5 proxied\_requests\_thread\_pool\_size = 32 Thanks for the help, any suggestions for improvement please let me know. Regards ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [May 11, 2021, 10:51pm UTC](https://community.graylog.org/t/graylog-time-out/19753/8 "2021-05-11T22:51:25Z")
@Juancho Hello, I have a couple suggestion to see if it would resolve your issue. First thing I noticed was this. > [@Juancho](#): > > processbuffer\_processors = 5 > outputbuffer\_processors = 3 > inputbuffer\_processors = 2 It has been know that these should match the physical processors on the graylog server. > [@Juancho](#): > > I have a Centos 7 server with 4CPU and 8 RAM. As an example, I have CentOS7 virtual machine with 12 CPU, 12 GB memory. > processbuffer\_processors = 6 > outputbuffer\_processors = 2 > inputbuffer\_processors = 3 I would try lowering those settings or adding more CPU’s on that server to see if that helps. I dont think you need this uncommented , but you could try to commented that out to see if that helps. > [@Juancho](#): > > http\_publish\_uri = [http://10.20.30.234:9000/](http://10.20.30.234:9000/) The default setting should look like this. `# Default: http://$http_bind_address/` ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [May 25, 2021, 10:51pm UTC](https://community.graylog.org/t/graylog-time-out/19753/9 "2021-05-25T22:51:41Z")
Closed on May 25, 2021, 10:51pm UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.