Index exists in ES, Graylog is empty

Graylog Central (peer support)
,
1

Hi,

I docker-compse ES, Graylog and MongoDB via this docu:
https://docs.graylog.org/en/3.1/pages/installation/docker.html (Example Version 3)

I opened Port 9200 on ES to connect with a filebeat, this is the normal OSS download exe for windows. I configured it to watch a test log file and output.elasticsearch to my ES. The index is being build and grows when I watch ES via Postman and add to my test log file.

I configured 2 beat inputs to listen on 1514 and the default 5042, but Graylog stays empty. I changed the search to all messages, but still empty and no received messages through the inputs.

Another question: Why do I need the Beats input, when filebeat pushed to ES and Graylog connects to ES?

I have the feeling I missed something big :o

2

Ok, when I call ES with Postman with the query I find under “Search”, I´ll get:

"failures": [
  {
    "shard": 0,
    "index": "filebeat-7.4.2-2019.12.02",
    "node": "RukEOxjbT2OWFmpJuNnWdw",
    "reason": {
      "type": "query_shard_exception",
      "reason": "No mapping found for [timestamp] in order to sort on",
      "index_uuid": "3kH1rykhRfyZgVfDQmvZqg",
      "index": "filebeat-7.4.2-2019.12.02"
    }
  }

How can I fix that?

3

Graylog is not a drop-in-replacement for Kibana.

If you want to work with Graylog, the messages need to be ingested to Graylog and Graylog will store them in Elasticsearch.

You might want to read some of the docs about architecture and ingest of messages again.

1 Like
4

Ah I see, are sidercars mandatory or optional?

5

Works now, thanks a lot!

6

optional.
But you need to send logs to GL, not directly ES.
You can use nxlog, beats, etc without sidecar, it’s just a plus for the center management.

7

Thanks! Got it now and I´m diving into multiline logs at the moment. :slight_smile:

8

You have to handle it at the client side, collect it to one line
//GL can’t make connection between multiple messages (ok, alert function can…)

9

Ok, good, can you toss me in the right direction to split the message? I guess I should do that with pipelines?

10

extractor or pipelines can help.

11

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.