Graylog is getting stuck when i want to see messages from inputs. It worked fine untill one moment when the “Update Search Results” pop-up showed up and stayed there forever.
The dashboards are updating fine
I’m running:
MongoDB version 3.05
Graylog version 2.2.3
Elasticsearch version 2.3.1
Check the logs of your Graylog and Elasticsearch node(s).
http://docs.graylog.org/en/2.4/pages/configuration/file_location.html
i think the problem started from here
2018-06-05T20:50:23.891+03:00 WARN [SearchResource] Unable to execute search: all shards failed
but i can’t figure anything from those logs. Elasticsearch seems fine, it looks like it receives all the messages but i can’t display those messages from the web interface. It gets stuck with the updating search results while my dashboards are updating using the messages received
Unfortunately, we can’t either if you don’t share the logs.
how can i send you all those logs because i can’t post more the 32000 characters ? Do you want a link to a file containing all those logs ?
You can use a pastebin service such as https://gist.github.com or https://0bin.net and share the link.
MongoDB is regularly not reachable and Elasticsearch has some problems with the indices.
Check the logs of MongoDB and Elasticsearch for details.
MongoDB logs:
https://0bin.net/paste/8884c0a+I2t3Dvw1#AaEY-PC+rSB7TYxhx0cwlA1rzsI530NgUruidJgPKz+
Elasticsearch logs:
https://0bin.net/paste/C+dhn-PXXTng1pgI#AsP8iOF2FlwGawkpfb5YyVbg5DSo8cmJSdQpgR9UzfG
They seem fine, as i said before messages are coming to Elasticsearch only that Graylog can’t upload search results. Do you know if anyone had this problem before ?
And one more detail. This started to happen right after I had many messages in graylog and I could not see results starting with page 50 or something like that.
I’m running the Graylog,Elasticsearch and MongoDb inside a Ubuntu 16.04.3 VMware machine.
Is there a storage configuration that I need to make ? I didn’t find anything about that anywhere
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
