# Graylog Web interface Error. connection Closed for messages widget
**URL:** https://community.graylog.org/t/graylog-web-interface-error-connection-closed-for-messages-widget/22521
**Category:** Graylog Central (peer support)
**Tags:** alert, elastic
**Created:** [January 31, 2022, 8:05pm UTC](https://community.graylog.org/t/graylog-web-interface-error-connection-closed-for-messages-widget/22521 "2022-01-31T20:05:11Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Herald](https://community.graylog.org/u/Herald)
#### Post date: [January 31, 2022, 8:05pm UTC](https://community.graylog.org/t/graylog-web-interface-error-connection-closed-for-messages-widget/22521/1 "2022-01-31T20:05:11Z")
This has driven me up a wall for hours. I’m using the most recent versions of graylog and elastic search. Everything seems configured correctly until I get in the web inter face. Under the messages tabs it says " \*\*While retrieving data for this widget, the following error(s) occurred:\*Connection is closed.". I’ve tried all possible combinations of ip in the graylog and elastic search configuration file. The error in the elastic search log says not ssl/tls record and unable to index audit log. If you have anything for me I’d be greatly appreciated. [The github to the configuration files and log file](https://github.com/mrdj20000/Graylogstuff)
---
### Author:  [@gsmith](https://community.graylog.org/u/gsmith)
#### Post date: [February 1, 2022, 12:33am UTC](https://community.graylog.org/t/graylog-web-interface-error-connection-closed-for-messages-widget/22521/2 "2022-02-01T00:33:46Z")
Hello && Welcome @Herald
This error could be a couple different things.
Ok, so I went over you Elasticsearch and Graylog configuration. I was going to tell you to try a couple different settings, but instead going off of your information you gave us I did a mockup instead.
Double check to make sure the info below is correct.
> **Graylog\_config\_suggestion**
>
> ```auto
> is_master = true
> node_id_file = /etc/graylog/server/node-id
> password_secret = 2nzTCxwgz51WOv4UJ099j9YZ6VbdcyN2luumku4rwd8H5Rt2meLmYnyaN0ibtUA8SvCiypNRAMK2dXUXuTzccW99wQCiDyYB
> root_password_sha2 = 91b32b192b6e1e4c48a939d3b49387e14c9f00982d7b9664c6dc7d5f2723479b
> root_email = "my_email_address"
> root_timezone = America/Chicago
> bin_dir = /usr/share/graylog-server/bin
> data_dir = /var/lib/graylog-server
> plugin_dir = /usr/share/graylog-server/plugin
> http_bind_address = 10.169.16.17:9000
> http_enable_cors = true
> elasticsearch_hosts = http://10.169.16.17:9200
> rotation_strategy = count
> elasticsearch_max_docs_per_index = 20000000
> elasticsearch_max_number_of_indices = 20
> retention_strategy = delete
> elasticsearch_shards = 4
> elasticsearch_replicas = 0
> elasticsearch_index_prefix = graylog
> allow_leading_wildcard_searches = true
> allow_highlighting = false
> elasticsearch_analyzer = standard
> output_batch_size = 5000
> output_flush_interval = 1
> output_fault_count_threshold = 5
> output_fault_penalty_seconds = 30
> processbuffer_processors = 5
> outputbuffer_processors = 3
> processor_wait_strategy = blocking
> ring_size = 65536
> inputbuffer_ring_size = 65536
> inputbuffer_processors = 2
> inputbuffer_wait_strategy = blocking
> message_journal_enabled = true
> message_journal_dir = /var/lib/graylog-server/journal
> message_journal_max_size = 12gb
> lb_recognition_period_seconds = 3
> mongodb_uri = mongodb://localhost:27017/graylog
> mongodb_max_connections = 1000
> mongodb_threads_allowed_to_block_multiplier = 5
> http_connect_timeout = 10s
>
> ```
> **Elasticsearch\_config\_suggestion**
>
> ```auto
> cluster.name: graylog
> path.data: /var/lib/elasticsearch
> path.logs: /var/log/elasticsearch
> network.host: 10.169.16.17
> http.port: 9200
> action.auto_create_index: false
> discovery.type: single-node
>
> ```
And since you using public IP address for elasticsearch
> **hosts\_file\_suggestion**
>
> ```auto
> 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
> ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
> 10.169.16.17 some.domain.com or localhost
>
> ```
You may want to re-read of the documentation
[https://docs.graylog.org/docs/ubuntu](https://docs.graylog.org/docs/ubuntu)
[https://docs.graylog.org/docs/debian](https://docs.graylog.org/docs/debian)
[https://docs.graylog.org/docs/centos](https://docs.graylog.org/docs/centos)
Hope that helps
---
### Author:  [@system](https://community.graylog.org/u/system)
#### Post date: [February 15, 2022, 12:34am UTC](https://community.graylog.org/t/graylog-web-interface-error-connection-closed-for-messages-widget/22521/3 "2022-02-15T00:34:16Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.