Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question.
Don’t forget to select tags to help index your topic!
1. Describe your incident:
(All separate docker containers)
Server1 had Graylog 6.0 accessing MongoDB and Elasticsearch on Server2. Had been working perfectly fine for the past year. Now wanting to upgrade to Graylog 6.2 using DataNode.
Stopped Elasticsearch on Server2 and am now running Data node container on Server2 --docker logs show:
It seems you are starting Data node for the first time. The current configuration is not sufficient to start the indexer process because a security configuration is missing. You have to either provide http and transport SSL certificates or use the Graylog preflight interface to configure this Data node remotely.
Then I started Graylog 6.2 on Server1 with configuration settings from 6.0. Started it up and docker logs show looping of this message:
2025-06-17 13:45:30,913 ERROR: org.graylog2.storage.versionprobe.VersionProbe - Unable to retrieve version from indexer node: Failed to connect to :9200. - Connection refused.
I have what I think are the proper ports open on Server2; and it seems the error is occurring because Datanode on Server2 is waiting on preflight completion?
Graylog web interface isn’t accessible so I’m stuck.
2. Describe your environment:
- OS Information:
Docker containers - Package Version:
Graylog 6.2 with Matrix supported versions of MongoDB and DataNode - Service logs, configurations, and environment variables:
3. What steps have you already taken to try and solve the problem?
Have tried using, and then commenting out, elasticsearch_hosts entry pointing at Server2.
4. How can the community help?
How can I resolve this issue? It seems like I’m close.
Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]