Log Spam Error - [IndexerClusterCheckerThread] - Error while trying to check Elasticsearch disk usage

Graylog Central (peer support)
1

Howdy-

Recently I upgraded my graylog dev instance to 3.3.5+6436f1b.
Running elasticsearch 5.4.0-1.

After the upgrade my graylog logfile is getting spammed with the following every 30s now:

2020-09-09T11:26:28.740-07:00 ERROR [IndexerClusterCheckerThread] Error while trying to check Elasticsearch disk usage.Details: failed to parse setting [diskTotal] with value as a size in bytes: unit is missing or unrecognized

Tried searching for this error message but couldn’t find anything helpful.

Any ideas?

2

You use unsupported Elastic db for graylog. Graylog version 3.3 supports only 5.6.x, 6.8.x of Elastic Search.

https://docs.graylog.org/en/3.3/pages/configuration/elasticsearch.html#elasticsearch-versions

Elastic 5.4 doesn’t have support for diskTotal parameter:
https://www.elastic.co/guide/en/elasticsearch/reference/5.4/cat-nodes.html
Solution: Please upgrade at least to version 5.6:
https://www.elastic.co/guide/en/elasticsearch/reference/5.6/cat-nodes.html

3

Thanks for the reply. Looks like that is definitely the issue.

I was going by the guidelines at:
https://docs.graylog.org/en/3.3/pages/installation.htm
Which only says “Elasticsearch 5 or 6”

Maybe we should add a link to the more specific requirements here?

4

Yes you are right.

@jan can you please update installation docs, so it will include supported version of Elastic, because it’s not clear. Information about supported Elasticsearch is only in table of page Configuring Graylog - Elasticsearch:
https://docs.graylog.org/en/3.3/pages/installation.html#system-requirements
https://docs.graylog.org/en/3.3/pages/configuration/elasticsearch.html#elasticsearch-versions

5

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.