Importing Content Pack from Version 3.1.3 to 4.2.6 Failure

Graylog Central (peer support)
1

Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!

1. Describe your incident:

I have a lot of dashboards in my older Graylog instance that I want to migrate to the newer version. I have built a new graylog instance from scratch as that was easier than upgrading the older one. So I exported the dashboards as a json content pack, but when I tried importing it to the new version I got the below error. Is this just a straight up compatibility issue between the two versions, or is there a way to do it?

Installing content pack failed with status: FetchError: There was an error fetching a resource: Internal Server Error. Additional information: Cannot construct instance of org.graylog2.contentpacks.model.entities.AutoValue_KeywordRangeEntity$Builder, problem: Missing required properties: timezone at [Source: UNKNOWN; line: -1, column: -1] (through reference chain: org.graylog2.contentpacks.model.entities.DashboardEntity[“widgets”]->java.util.ArrayList[8]->org.graylog2.contentpacks.model.entities.DashboardWidgetEntity[“time_range”]). Could not install Content Pack with ID: 55ab8188-e8df-4013-a5e5-d35eace2f21a

2. Describe your environment:

  • OS Information:

Ubuntu 20.04.4

  • Package Version:

Newly installed Graylog as of today. Version 4.2.6

  • Service logs, configurations, and environment variables:

Base configuration, other than a password change.

3. What steps have you already taken to try and solve the problem?

Seems to be a problem with this time range value. Should I edit the json file to remove that maybe?

4. How can the community help?

How can I import this content pack, so that I do not have to manually re-add all dashboards. Note that the dashboards contain hundreds of widgets, which we had to enter in manually. I am wary about uploading the content pack file since it contains some addresses of our customers, but I can change them if the file is needed.

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]

2

Hello && Welcome

Yes,

Yes, I have done a similar upgrade but a little bit different way going about doing it. As you know MongoDb stores all the metadata ( configuration, INPUT , Dashboards, etc…)
Before starting Graylog on the new node. I migrated old MongoDb (mongodump) database over to the new node. I had to make sure MongoDb versions were the same or there could be issues.
Once Graylog was running there were some new changes with Graylog Version/s I had to correct, after that it ran smooth. I upgrade MongoDb later on…

As for your errors. Not sure what type of content packs you have installed but sometimes old content packs that are build on-up-to older version of Graylog are not compatible with Graylog New versions. This does depend from what version you did have to the newest versions you now have.

Yeah, you might have to.

3

Hi, thanks for the response. The content packs are just exports of the existing dashboards. So I just selected all dashboards when creating the content pack. I then downloaded this file as a json file and tried importing it with the error I mentioned.

I am going to try to recreate a few of the widgets in the newer version, then exporting to the json file and compare the two. Hopefully there is an easy way to do this, would hate to have to manually add all of them again.

If you have any other suggestions I would greatly appreciate it.

4

I agree, keep us updated. By chance what version did you have prior?

5

I was using 3.1.3, now I am using 4.2.6

1 Like
6

:laughing: I must be tired , I just seen to title of this post.

7

To me they seem like completely different formats.I might have to do it manually. As an example, the below is one of the widgets from the old version. The purpose of this is tracking dhcp assigned messages from a specific unit in an apartment building. We have one widgets per unit, and there is about 1200 of them. Removed names for security purposes (xxxxxx was basically a building/unit # combo)

        "id": {
          "@type": "string",
          "@value": "fb403167-b261-4456-b051-c45197a4b2f1"
        },
        "description": {
          "@type": "string",
          "@value": "xxxxxxxxxx "
        },
        "type": {
          "@type": "string",
          "@value": "SEARCH_RESULT_COUNT"
        },
        "cache_time": {
          "@type": "integer",
          "@value": 10
        },
        "time_range": {
          "type": {
            "@type": "string",
            "@value": "relative"
          },
          "range": {
            "@type": "integer",
            "@value": 2592000
          }
        },
        "configuration": {
          "timerange": {
            "type": {
              "@type": "string",
              "@value": "relative"
            },
            "range": {
              "@type": "integer",
              "@value": 2592000
            }
          },
          "lower_is_better": {
            "@type": "boolean",
            "@value": false
          },
          "trend": {
            "@type": "boolean",
            "@value": false
          },
          "query": {
            "@type": "string",
            "@value": "source:10.32.3.2 AND \"xxxxxxxx assigned\""
          }
        },
        "position": {
          "width": {
            "@type": "integer",
            "@value": 1
          },
          "height": {
            "@type": "integer",
            "@value": 1
          },
          "row": {
            "@type": "integer",
            "@value": 1
          },
          "col": {
            "@type": "integer",
            "@value": 2
          }
        }
      },

Now the below is the same widgets, but recreated in 4.2.6. It is separated into two sections in the json file, but I put them together here for clarity. They just seem too different to me…

            {
              "query": {
                "type": "elasticsearch",
                "query_string": "source:10.32.3.2 AND \"xxxxxxxxx assigned\""
              },
              "name": "chart",
              "timerange": {
                "type": "relative",
                "from": 2592000
              },
              "streams": [],
              "series": [
                {
                  "type": "count",
                  "id": "xxxxxxxxx ",
                  "field": null
                }
              ],
              "filter": null,
              "rollup": true,
              "row_groups": [],
              "type": "pivot",
              "id": "89eaa740-e036-4a1d-83b7-8787427c5c63",
              "column_groups": [],
              "sort": []
            },

          {
            "id": "5f57be1c-7294-4790-8dd0-2ac8d8f8a681",
            "type": "aggregation",
            "filter": null,
            "timerange": {
              "type": "relative",
              "from": 2592000
            },
            "query": {
              "type": "elasticsearch",
              "query_string": "source:10.32.3.2 AND \"xxxxxxxx assigned\""
            },
            "streams": [],
            "config": {
              "visualization": "numeric",
              "event_annotation": false,
              "row_pivots": [],
              "series": [
                {
                  "config": {
                    "name": "xxxxxxx "
                  },
                  "function": "count()"
                }
              ],
              "rollup": true,
              "column_pivots": [],
              "visualization_config": {
                "trend": false,
                "trend_preference": "NEUTRAL"
              },
              "formatting_settings": null,
              "sort": []
            }
          },
8

Just had a thought, I am going to load a separate instance of Graylog on another server with 3.1.3. Then I will load the dashboards there. I should be able to upgrade that to Graylog version 4 and the dashboards should hopefully carry over.

Can someone confirm that that would work? I can’t imagine that Graylog would not support carrying over dashboards from version 3 to 4 by this method.

9

Hello,

To be honest, the amount of time your troubleshooting this issue I would have you old Graylog server update and completed.
BUT if your going that route, and have two GL nodes that are the same versions, I would just execute a Mongo dump and SCP of to the GL node you want. Then restart services. If you not familiar with execute database dumps then the creating a content pack is the way to go.

10

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.