I installed a graylog server on CentOS7 (fresh installation). I tried to add inputs using the option ‘System/Inputs > Inputs > Select Inputs’, but it says ‘No inputs available’.
I have restarted graylog-server service and obtained following logs while starting on /var/log/graylog-server/server.log.
===============
2017-06-06T14:45:33.487+04:00 INFO [CmdLineTool] Loaded plugin: Elastic Beats Input 2.2.3 [org.graylog.plugins.beats.BeatsInputPlugin]
2017-06-06T14:45:33.494+04:00 INFO [CmdLineTool] Loaded plugin: Collector 2.2.3 [org.graylog.plugins.collector.CollectorPlugin]
2017-06-06T14:45:33.496+04:00 INFO [CmdLineTool] Loaded plugin: Enterprise Integration Plugin 2.2.3 [org.graylog.plugins.enterprise_integration.EnterpriseIntegrationPlugin]
2017-06-06T14:45:33.498+04:00 INFO [CmdLineTool] Loaded plugin: MapWidgetPlugin 2.2.3 [org.graylog.plugins.map.MapWidgetPlugin]
2017-06-06T14:45:33.510+04:00 INFO [CmdLineTool] Loaded plugin: Pipeline Processor Plugin 2.2.3 [org.graylog.plugins.pipelineprocessor.ProcessorPlugin]
2017-06-06T14:45:33.511+04:00 INFO [CmdLineTool] Loaded plugin: Anonymous Usage Statistics 2.2.3 [org.graylog.plugins.usagestatistics.UsageStatsPlugin]
2017-06-06T14:45:33.894+04:00 INFO [CmdLineTool] Running with JVM arguments: -Xms1g -Xmx1g -XX:NewRatio=1 -XX:+ResizeTLAB -XX:+UseConcMarkSweepGC -XX:+CMSConcurrentMTEnabled -XX:+CMSClassUnloadingEnabled -XX:+UseParNewGC -XX:-OmitStackTraceInFastThrow -Dlog4j.configurationFile=file:///etc/graylog/server/log4j2.xml -Djava.library.path=/usr/share/graylog-server/lib/sigar -Dgraylog2.installation_source=rpm
2017-06-06T14:45:34.341+04:00 INFO [Version] HV000001: Hibernate Validator null
2017-06-06T14:45:37.790+04:00 INFO [InputBufferImpl] Message journal is enabled.
2017-06-06T14:45:37.839+04:00 INFO [NodeId] Node ID: 4771c246-c1f9-4100-bf45-71923c5375cb
2017-06-06T14:45:38.178+04:00 INFO [LogManager] Loading logs.
2017-06-06T14:45:38.271+04:00 INFO [LogManager] Logs loading complete.
2017-06-06T14:45:38.272+04:00 INFO [KafkaJournal] Initialized Kafka based journal at /var/lib/graylog-server/journal
2017-06-06T14:45:38.289+04:00 INFO [InputBufferImpl] Initialized InputBufferImpl with ring size <65536> and wait strategy , running 2 parallel message handlers.
2017-06-06T14:45:38.324+04:00 INFO [cluster] Cluster created with settings {hosts=[localhost:27017], mode=SINGLE, requiredClusterType=UNKNOWN, serverSelectionTimeout=‘30000 ms’, maxWaitQueueSize=5000}
2017-06-06T14:45:38.392+04:00 INFO [cluster] No server chosen by ReadPreferenceServerSelector{readPreference=primary} from cluster description ClusterDescription{type=UNKNOWN, connectionMode=SINGLE, serverDescriptions=[ServerDescription{address=localhost:27017, type=UNKNOWN, state=CONNECTING}]}. Waiting for 30000 ms before timing out
2017-06-06T14:45:38.451+04:00 INFO [connection] Opened connection [connectionId{localValue:1, serverValue:8}] to localhost:27017
2017-06-06T14:45:38.458+04:00 INFO [cluster] Monitor thread successfully connected to server with description ServerDescription{address=localhost:27017, type=STANDALONE, state=CONNECTED, ok=true, version=ServerVersion{versionList=[3, 2, 13]}, minWireVersion=0, maxWireVersion=4, maxDocumentSize=16777216, roundTripTimeNanos=792084}
2017-06-06T14:45:38.472+04:00 INFO [connection] Opened connection [connectionId{localValue:2, serverValue:9}] to localhost:27017
2017-06-06T14:45:38.916+04:00 INFO [node] [graylog-4771c246-c1f9-4100-bf45-71923c5375cb] version[2.4.4], pid[4195], build[fcbb46d/2017-01-03T11:33:16Z]
2017-06-06T14:45:38.917+04:00 INFO [node] [graylog-4771c246-c1f9-4100-bf45-71923c5375cb] initializing …
2017-06-06T14:45:38.925+04:00 INFO [plugins] [graylog-4771c246-c1f9-4100-bf45-71923c5375cb] modules , plugins [graylog-monitor], sites
2017-06-06T14:45:41.458+04:00 INFO [node] [graylog-4771c246-c1f9-4100-bf45-71923c5375cb] initialized
2017-06-06T14:45:41.569+04:00 INFO [ProcessBuffer] Initialized ProcessBuffer with ring size <65536> and wait strategy .
2017-06-06T14:45:43.583+04:00 INFO [RulesEngineProvider] No static rules file loaded.
2017-06-06T14:45:44.092+04:00 WARN [GeoIpResolverEngine] GeoIP database file does not exist: /etc/graylog/server/GeoLite2-City.mmdb
2017-06-06T14:45:44.104+04:00 INFO [OutputBuffer] Initialized OutputBuffer with ring size <65536> and wait strategy .
2017-06-06T14:45:44.200+04:00 WARN [GeoIpResolverEngine] GeoIP database file does not exist: /etc/graylog/server/GeoLite2-City.mmdb
2017-06-06T14:45:44.317+04:00 WARN [GeoIpResolverEngine] GeoIP database file does not exist: /etc/graylog/server/GeoLite2-City.mmdb
2017-06-06T14:45:44.398+04:00 WARN [GeoIpResolverEngine] GeoIP database file does not exist: /etc/graylog/server/GeoLite2-City.mmdb
2017-06-06T14:45:44.486+04:00 WARN [GeoIpResolverEngine] GeoIP database file does not exist: /etc/graylog/server/GeoLite2-City.mmdb
2017-06-06T14:45:45.693+04:00 INFO [ServerBootstrap] Graylog server 2.2.3+7adc951 starting up
2017-06-06T14:45:45.694+04:00 INFO [ServerBootstrap] JRE: Oracle Corporation 1.8.0_131 on Linux 3.10.0-514.21.1.el7.x86_64
2017-06-06T14:45:45.694+04:00 INFO [ServerBootstrap] Deployment: rpm
2017-06-06T14:45:45.694+04:00 INFO [ServerBootstrap] OS: CentOS Linux 7 (Core) (centos)
2017-06-06T14:45:45.694+04:00 INFO [ServerBootstrap] Arch: amd64
2017-06-06T14:45:45.701+04:00 WARN [DeadEventLoggingListener] Received unhandled event of type <org.graylog2.plugin.lifecycles.Lifecycle> from event bus <AsyncEventBus{graylog-eventbus}>
2017-06-06T14:45:45.998+04:00 INFO [node] [graylog-4771c246-c1f9-4100-bf45-71923c5375cb] starting …
2017-06-06T14:45:45.996+04:00 INFO [PeriodicalsService] Starting 26 periodicals …
2017-06-06T14:45:46.016+04:00 INFO [Periodicals] Starting [org.graylog2.periodical.ThroughputCalculator] periodical in [0s], polling every [1s].
2017-06-06T14:45:46.021+04:00 INFO [Periodicals] Starting [org.graylog2.periodical.AlertScannerThread] periodical in [10s], polling every [60s].
2017-06-06T14:45:46.023+04:00 INFO [Periodicals] Starting [org.graylog2.periodical.BatchedElasticSearchOutputFlushThread] periodical in [0s], polling every [1s].
2017-06-06T14:45:46.025+04:00 INFO [Periodicals] Starting [org.graylog2.periodical.ClusterHealthCheckThread] periodical in [120s], polling every [20s].
2017-06-06T14:45:46.027+04:00 INFO [Periodicals] Starting [org.graylog2.periodical.ContentPackLoaderPeriodical] periodical, running forever.
2017-06-06T14:45:46.036+04:00 INFO [Periodicals] Starting [org.graylog2.periodical.GarbageCollectionWarningThread] periodical, running forever.
2017-06-06T14:45:46.039+04:00 INFO [Periodicals] Starting [org.graylog2.periodical.IndexerClusterCheckerThread] periodical in [0s], polling every [30s].
2017-06-06T14:45:46.040+04:00 INFO [Periodicals] Starting [org.graylog2.periodical.IndexRetentionThread] periodical in [0s], polling every [300s].
2017-06-06T14:45:46.041+04:00 INFO [Periodicals] Starting [org.graylog2.periodical.IndexRotationThread] periodical in [0s], polling every [10s].
2017-06-06T14:45:46.044+04:00 INFO [Periodicals] Starting [org.graylog2.periodical.NodePingThread] periodical in [0s], polling every [1s].
2017-06-06T14:45:46.045+04:00 INFO [Periodicals] Starting [org.graylog2.periodical.VersionCheckThread] periodical in [300s], polling every [1800s].
2017-06-06T14:45:46.046+04:00 INFO [Periodicals] Starting [org.graylog2.periodical.ThrottleStateUpdaterThread] periodical in [1s], polling every [1s].
2017-06-06T14:45:46.047+04:00 INFO [IndexRetentionThread] Elasticsearch cluster not available, skipping index retention checks.
2017-06-06T14:45:46.055+04:00 INFO [connection] Opened connection [connectionId{localValue:5, serverValue:12}] to localhost:27017
2017-06-06T14:45:46.055+04:00 INFO [connection] Opened connection [connectionId{localValue:3, serverValue:10}] to localhost:27017
2017-06-06T14:45:46.059+04:00 INFO [Periodicals] Starting [org.graylog2.events.ClusterEventPeriodical] periodical in [0s], polling every [1s].
2017-06-06T14:45:46.060+04:00 INFO [Periodicals] Starting [org.graylog2.events.ClusterEventCleanupPeriodical] periodical in [0s], polling every [86400s].
2017-06-06T14:45:46.068+04:00 INFO [connection] Opened connection [connectionId{localValue:4, serverValue:11}] to localhost:27017
2017-06-06T14:45:46.073+04:00 INFO [Periodicals] Starting [org.graylog2.periodical.ClusterIdGeneratorPeriodical] periodical, running forever.
2017-06-06T14:45:46.076+04:00 INFO [Periodicals] Starting [org.graylog2.periodical.IndexRangesMigrationPeriodical] periodical, running forever.
2017-06-06T14:45:46.082+04:00 INFO [Periodicals] Starting [org.graylog2.periodical.IndexRangesCleanupPeriodical] periodical in [15s], polling every [3600s].
2017-06-06T14:45:46.098+04:00 INFO [connection] Opened connection [connectionId{localValue:7, serverValue:14}] to localhost:27017
2017-06-06T14:45:46.101+04:00 INFO [connection] Opened connection [connectionId{localValue:6, serverValue:13}] to localhost:27017
2017-06-06T14:45:46.130+04:00 INFO [connection] Opened connection [connectionId{localValue:9, serverValue:16}] to localhost:27017
2017-06-06T14:45:46.129+04:00 INFO [connection] Opened connection [connectionId{localValue:8, serverValue:15}] to localhost:27017
2017-06-06T14:45:46.189+04:00 INFO [IndexerClusterCheckerThread] Indexer not fully initialized yet. Skipping periodic cluster check.
2017-06-06T14:45:46.210+04:00 INFO [PeriodicalsService] Not starting [org.graylog2.periodical.UserPermissionMigrationPeriodical] periodical. Not configured to run on this node.
2017-06-06T14:45:46.211+04:00 INFO [Periodicals] Starting [org.graylog2.periodical.AlarmCallbacksMigrationPeriodical] periodical, running forever.
2017-06-06T14:45:46.224+04:00 INFO [Periodicals] Starting [org.graylog2.periodical.ConfigurationManagementPeriodical] periodical, running forever.
2017-06-06T14:45:46.240+04:00 INFO [Periodicals] Starting [org.graylog2.periodical.LdapGroupMappingMigration] periodical, running forever.
2017-06-06T14:45:46.243+04:00 INFO [Periodicals] Starting [org.graylog2.periodical.IndexFailuresPeriodical] periodical, running forever.
2017-06-06T14:45:46.276+04:00 INFO [Periodicals] Starting [org.graylog.plugins.usagestatistics.UsageStatsNodePeriodical] periodical in [300s], polling every [21600s].
2017-06-06T14:45:46.280+04:00 INFO [Periodicals] Starting [org.graylog.plugins.usagestatistics.UsageStatsClusterPeriodical] periodical in [300s], polling every [21600s].
2017-06-06T14:45:46.290+04:00 INFO [Periodicals] Starting [org.graylog.plugins.pipelineprocessor.periodical.LegacyDefaultStreamMigration] periodical, running forever.
2017-06-06T14:45:46.291+04:00 INFO [Periodicals] Starting [org.graylog.plugins.collector.periodical.PurgeExpiredCollectorsThread] periodical in [0s], polling every [3600s].
2017-06-06T14:45:46.302+04:00 INFO [LegacyDefaultStreamMigration] Legacy default stream has no connections, no migration needed.
2017-06-06T14:45:46.602+04:00 INFO [transport] [graylog-4771c246-c1f9-4100-bf45-71923c5375cb] publish_address {127.0.0.1:9350}, bound_addresses {[::1]:9350}, {127.0.0.1:9350}
2017-06-06T14:45:46.620+04:00 INFO [discovery] [graylog-4771c246-c1f9-4100-bf45-71923c5375cb] graylog/ubt_KjwWTpSYwVY2W0r4WQ
2017-06-06T14:45:46.646+04:00 INFO [V20161130141500_DefaultStreamRecalcIndexRanges] Cluster not connected yet, delaying migration until it is reachable.
2017-06-06T14:45:47.192+04:00 INFO [JerseyService] Enabling CORS for HTTP endpoint
2017-06-06T14:45:49.663+04:00 WARN [discovery] [graylog-4771c246-c1f9-4100-bf45-71923c5375cb] waited for 3s and no initial state was set by the discovery
2017-06-06T14:45:49.664+04:00 INFO [node] [graylog-4771c246-c1f9-4100-bf45-71923c5375cb] started
2017-06-06T14:45:50.190+04:00 INFO [service] [graylog-4771c246-c1f9-4100-bf45-71923c5375cb] detected_master {Force}{gjQMBObBT16PzKwGE2wItg}{127.0.0.1}{127.0.0.1:9300}, added {{Force}{gjQMBObBT16PzKwGE2wItg}{127.0.0.1}{127.0.0.1:9300},}, reason: zen-disco-receive(from master [{Force}{gjQMBObBT16PzKwGE2wItg}{127.0.0.1}{127.0.0.1:9300}])
2017-06-06T14:46:05.054+04:00 INFO [NetworkListener] Started listener bound to [192.168.11.53:9000]
2017-06-06T14:46:05.056+04:00 INFO [HttpServer] [HttpServer] Started.
2017-06-06T14:46:05.056+04:00 INFO [JerseyService] Started REST API at http://192.168.11.53:9000/api/
2017-06-06T14:46:05.057+04:00 INFO [JerseyService] Started Web Interface at http://192.168.11.53:9000/
2017-06-06T14:46:05.058+04:00 INFO [ServiceManagerListener] Services are healthy
2017-06-06T14:46:05.060+04:00 INFO [ServerBootstrap] Services started, startup times in ms: {KafkaJournal [RUNNING]=35, OutputSetupService [RUNNING]=53, BufferSynchronizerService [RUNNING]=54, InputSetupService [RUNNING]=135, JournalReader [RUNNING]=198, ConfigurationEtagService [RUNNING]=207, StreamCacheService [RUNNING]=207, PeriodicalsService [RUNNING]=305, IndexerSetupService [RUNNING]=4257, JerseyService [RUNNING]=19065}
2017-06-06T14:46:05.060+04:00 INFO [InputSetupService] Triggering launching persisted inputs, node transitioned from Uninitialized [LB:DEAD] to Running [LB:ALIVE]
2017-06-06T14:46:05.069+04:00 INFO [ServerBootstrap] Graylog server up and running.
I don’t have any adblocker / JSBlocker in my browser, I tried on diff browsers as well.
I found one thing. Graylog server is on a NATed environment. I was accessing interface using public IP after doing port forwarding. When I accessed interface with local IP, it worked within network. I have added inputs and started to getting logs also. But when I checked using public IP, I’m not able to see inputs or logs. Did I miss any settings in graylog for NAT? I did port forwarding in below manner. Any more port forwarding required other than this?