I recently set up a three host graylog cluster on CentOS using Amazon’s EC2.
I have tested sending messages to the cluster, and they seem to be arriving, but when I attempt to use the search function, I get no results.
I attempted some troubleshooting, and determined that the messages were finding their way into Elasticsearch. I then attempted to query the data using the Graylog API.
Using:
curl -u user:password -H 'Accept: text/csv' -X GET 'http://172.16.13.138:9000/api/search/universal/absolute?query=David&from=2017-09-01T04%3A00%3A00.000Z&to=2017-10-01T04%3A00%3A00.000Z&limit=150&sort=timestamp%3Adesc&fields=message'
I get results. I can see the timestamp and the log message, as I would expect.
Using:
curl -u user:password -H 'Accept: application/json' -X GET 'http://172.16.13.138:9000/api/search/universal/absolute?query=David&from=2017-09-01T04%3A00%3A00.000Z&to=2017-10-01T04%3A00%3A00.000Z&limit=150&sort=timestamp%3Adesc&fields=message'
I get:
{"query":"David","built_query":"{\n \"from\" : 0,\n \"size\" : 150,\n \"query\" : {\n \"bool\" : {\n \"must\" : {\n \"query_string\" : {\n \"query\" : \"David\",\n \"allow_leading_wildcard\" : false\n }\n },\n \"filter\" : {\n \"bool\" : {\n \"must\" : {\n \"range\" : {\n \"timestamp\" : {\n \"from\" : \"2017-09-01 04:00:00.000\",\n \"to\" : \"2017-10-01 04:00:00.000\",\n \"include_lower\" : true,\n \"include_upper\" : true\n }\n }\n }\n }\n }\n }\n },\n \"_source\" : {\n \"includes\" : [ \"timestamp\", \"message\" ],\n \"excludes\" : [ ]\n },\n \"sort\" : [ {\n \"timestamp\" : {\n \"order\" : \"desc\"\n }\n } ]\n}","used_indices":[],"messages":[],"fields":[],"time":0,"total_results":0,"from":"2017-09-01T04:00:00.000Z","to":"2017-10-01T04:00:00.000Z","decoration_stats":null}
Which I believe is telling me there are no results.
I feel like I am missing something, but at this point, I’m not feeling like I can find it, and would appreciate help.
Thanks!