Graylog Web UI doesn't display logs

I am new to GrayLog and I have encountered a problem. I have setup my GrayLog server as follows:
Untitled Diagram

Now I am sending log data from all 3 hosts to RSYSLOG and then to GRAYLOG. On the GrayLog I can see logs from 1 host but if I try send logs from another host then it doesn’t show anything.

I ran a packet capture on the GrayLog and the packets are reaching GrayLog, I can see that in tcp dump.

But nothing comes up on the Web UI of GrayLog.

Anyone have any idea?
Thanks

@mgajjar
Hello and Welcome,

I would check the date/time of the devices sending and receiving logs is correct.
check the status of elasticsearch.
NOTE: change it to your correct ip address.

curl -XGET 'http://8.8.8.8:9200/_cluster/health?pretty=true'

What does the INPUT configuration look like? Did you try to use a global configuration?

Hope that helps

1 Like

@gsmith
Hello. I checked the timezone and they were different. It worked for me. Thank you so much.

Just one question does graylog take UTC as default timezone. Because the server where I installed graylog has EDT but graylog itself has UTC and thats why I wasn’t seeing any message?

And also is there anyway I can change timezone of graylog to EDT?

Because in the admin profile I can’t change timezone on WEB UI

But I really appreciate for your help. Now I know what the issue is. Thanks again

EDIT - I have installed graylog using docker container

1 Like

Thats great, I’m glad I could help.

About Docker, we dont get along very well, so my focus is in package handlers instead :slight_smile:
But as for your other question.
I read some where in the forum that Graylog by default uses UTC, Im not 100% sure thou, but there are other setting you can configure.

That would be here.

As for Graylog 4, I do know that the user/s can set there own Time zone in there profile.
Hope that helps

1 Like

Thank you for the help.
I found a parameter to add in the yaml file to set the timezone to EDT when we start the GrayLog docker
It is as follows:
“GRAYLOG_ROOT_TIMEZONE=America/Chicago”

1 Like