# No logs displayed in streams **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [July 23, 2019, 9:16am UTC](https://community.graylog.org/t/no-logs-displayed-in-streams/11299 "2019-07-23T09:16:48Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![zorel](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/zorel/32/4754_2.png) [@zorel](https://community.graylog.org/u/zorel)\ **Post date:** [July 23, 2019, 9:16am UTC](https://community.graylog.org/t/no-logs-displayed-in-streams/11299/1 "2019-07-23T09:16:48Z")
Hello. I have a Graylog 3.0.2+1686930, single node with ES 6.8. Logs are shipped this way: filebeat → kafka → graylog (input → all messages → pipelines → route to 2 streams) Shipping works well, i see the logs in the kafka topic. Graylog accept and index the log, i can see the logs in elasticsearch. But since **2019-07-22 19:55:25.844** nothing appears in All Messages stream or in “show received message” in the input. I have this message log from that time: > 2019-07-22T19:55:25.610+02:00 INFO [AbstractRotationStrategy] Deflector index (index set \) should be rotated, Pointing deflector to new index now! > 2019-07-22T19:55:25.970+02:00 INFO [MongoIndexSet] Cycling from \ to \. > 2019-07-22T19:55:25.970+02:00 INFO [MongoIndexSet] Creating target index \. > 2019-07-22T19:55:26.222+02:00 INFO [Indices] Successfully created index template graylog-internal > 2019-07-22T19:55:26.375+02:00 INFO [MongoIndexSet] Waiting for allocation of index \. > 2019-07-22T19:55:26.547+02:00 INFO [MongoIndexSet] Index \ has been successfully allocated. > 2019-07-22T19:55:26.547+02:00 INFO [MongoIndexSet] Pointing index alias \ to new index \. > 2019-07-22T19:55:26.631+02:00 INFO [SystemJobManager] Submitted SystemJob [org.graylog2.indexer.indices.jobs.SetIndexReadOnlyAndCalculateRangeJob] > 2019-07-22T19:55:26.631+02:00 INFO [MongoIndexSet] Successfully pointed index alias \ to index \. > 2019-07-22T19:55:56.641+02:00 INFO [SetIndexReadOnlyJob] Flushing old index \. > 2019-07-22T19:55:57.122+02:00 INFO [SetIndexReadOnlyJob] Setting old index \ to read-only. > 2019-07-22T19:55:57.142+02:00 INFO [SystemJobManager] Submitted SystemJob [org.graylog2.indexer.indices.jobs.OptimizeIndexJob] > 2019-07-22T19:55:57.156+02:00 INFO [OptimizeIndexJob] Optimizing index \. > 2019-07-22T19:55:57.157+02:00 INFO [CreateNewSingleIndexRangeJob] Calculating ranges for index graylog\_4. > 2019-07-22T19:55:58.887+02:00 INFO [MongoIndexRangeService] Calculated range of [graylog\_4] in [1729ms]. > 2019-07-22T19:55:58.890+02:00 INFO [CreateNewSingleIndexRangeJob] Created ranges for index graylog\_4. > 2019-07-22T19:55:58.891+02:00 INFO [SystemJobManager] SystemJob [org.graylog2.indexer.indices.jobs.SetIndexReadOnlyAndCalculateRangeJob] finished in 2259ms. > 2019-07-22T19:58:25.523+02:00 INFO [SystemJobManager] SystemJob [org.graylog2.indexer.indices.jobs.OptimizeIndexJob] finished in 148380ms. I suppose this behaviour is linked to the index rotation. I had to recalculate index range in the index set to make it work again. I have this messages in the log when i clicked: > 2019-07-23T10:23:25.324+02:00 ERROR [Cluster] Couldn’t read cluster health for indices [graylog\_\*] (Could not connect to [http://127.0.0.1:9200](http://127.0.0.1:9200)) > 2019-07-23T10:23:25.324+02:00 INFO [IndexerClusterCheckerThread] Indexer not fully initialized yet. Skipping periodic cluster check. > 2019-07-23T10:23:45.383+02:00 INFO [MongoIndexSet] Did not find a deflector alias. Setting one up now. > 2019-07-23T10:23:46.194+02:00 INFO [MongoIndexSet] Pointing to already existing index target \ Is this some part of the configuration i missed? I don’t remember changing something related. Thanks for any pointer ---
**Author:** ![jan](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jan/32/11_2.png) [@jan](https://community.graylog.org/u/jan)\ **Post date:** [July 23, 2019, 11:03am UTC](https://community.graylog.org/t/no-logs-displayed-in-streams/11299/2 "2019-07-23T11:03:03Z")
I guess your Elasticsearch has issues - you should check your Elasticsearch: > 2019-07-23T10:23:25.324+02:00 ERROR [Cluster] Couldn’t read cluster health for indices [graylog\_\*] (Could not connect to [http://127.0.0.1:9200](http://127.0.0.1:9200)) indicates that Graylog could not reach elasticsearch. ---
**Author:** ![zorel](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/zorel/32/4754_2.png) [@zorel](https://community.graylog.org/u/zorel)\ **Post date:** [July 23, 2019, 11:27am UTC](https://community.graylog.org/t/no-logs-displayed-in-streams/11299/3 "2019-07-23T11:27:55Z")
I restarted it minutes before I clic to “recalculate index range”. ES is ok, graylog feeds correctly messages in it. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [August 6, 2019, 11:30am UTC](https://community.graylog.org/t/no-logs-displayed-in-streams/11299/4 "2019-08-06T11:30:05Z")
Closed on August 6, 2019, 11:30am UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.